Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/11/2024, 05:33
Behavioral task
behavioral1
Sample
013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe
-
Size
172KB
-
MD5
93f75667e60838eb69e64f07c626fe60
-
SHA1
46a8738cfd06af8651b9710ee2efa4078a8ccba3
-
SHA256
013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6
-
SHA512
0a9092ead8ef053b6bcaee2a839c796552a93d6786f97a13f02758cc87527d6f5bba9f65fff9b0214a5ad9158036290d8f573cae09902fb4255b588d3c55abbc
-
SSDEEP
1536:JxqjQ+P04wsmJCwcmxsLxY+xGHGI4wwMtjp78HN2hSOxqjQ+P04wsmJCzOxqjQ+9:sr85CVSIxGx4wwMtGFr85C7r85C
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016d3e-2.dat family_neshta behavioral1/files/0x0008000000016d46-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x000100000001070c-18.dat family_neshta behavioral1/files/0x00010000000107e5-17.dat family_neshta behavioral1/memory/2256-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2508-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2732-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1108-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2908-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1564-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2708-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2652-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1200-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2848-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1468-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1876-113-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2000-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f776-128.dat family_neshta behavioral1/files/0x000100000000f7e6-133.dat family_neshta behavioral1/memory/1456-144-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2856-143-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2152-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2912-166-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1968-177-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2976-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2568-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2148-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/572-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1012-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1452-216-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2352-225-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1416-226-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1932-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2560-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2332-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2284-262-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2496-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-275-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2612-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2584-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2756-306-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2876-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1692-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1688-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2044-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1908-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1200-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1864-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2000-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1876-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1616-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2276-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2940-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2956-366-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2180-365-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2192-373-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2416-374-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2512 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 2508 svchost.com 2256 013F90~1.EXE 2732 svchost.com 2740 013F90~1.EXE 1108 svchost.com 2908 013F90~1.EXE 1564 svchost.com 2708 013F90~1.EXE 2652 svchost.com 1200 013F90~1.EXE 2848 svchost.com 1468 013F90~1.EXE 2000 svchost.com 1876 013F90~1.EXE 2856 svchost.com 1456 013F90~1.EXE 2912 svchost.com 2152 013F90~1.EXE 1968 svchost.com 2976 013F90~1.EXE 2568 svchost.com 2084 013F90~1.EXE 2148 svchost.com 572 013F90~1.EXE 1012 svchost.com 1452 013F90~1.EXE 2352 svchost.com 1416 013F90~1.EXE 1932 svchost.com 2560 013F90~1.EXE 2332 svchost.com 2284 013F90~1.EXE 2496 svchost.com 2808 013F90~1.EXE 2712 svchost.com 2612 013F90~1.EXE 2620 svchost.com 2584 013F90~1.EXE 2876 svchost.com 2756 013F90~1.EXE 1692 svchost.com 1688 013F90~1.EXE 2044 svchost.com 1908 013F90~1.EXE 1200 svchost.com 1864 013F90~1.EXE 1708 svchost.com 2000 013F90~1.EXE 1876 svchost.com 1616 013F90~1.EXE 2940 svchost.com 2276 013F90~1.EXE 2956 svchost.com 2180 013F90~1.EXE 2416 svchost.com 2192 013F90~1.EXE 3064 svchost.com 2160 013F90~1.EXE 1132 svchost.com 1848 013F90~1.EXE 1036 svchost.com 788 013F90~1.EXE 1448 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2068 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 2068 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 2508 svchost.com 2508 svchost.com 2732 svchost.com 2732 svchost.com 1108 svchost.com 1108 svchost.com 1564 svchost.com 1564 svchost.com 2652 svchost.com 2652 svchost.com 2848 svchost.com 2848 svchost.com 2000 svchost.com 2000 svchost.com 2856 svchost.com 2856 svchost.com 2068 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 2512 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 2512 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 2912 svchost.com 2912 svchost.com 2512 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 1968 svchost.com 1968 svchost.com 2568 svchost.com 2568 svchost.com 2148 svchost.com 2148 svchost.com 1012 svchost.com 1012 svchost.com 2352 svchost.com 2352 svchost.com 1932 svchost.com 1932 svchost.com 2332 svchost.com 2332 svchost.com 2512 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 2496 svchost.com 2496 svchost.com 2068 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 2712 svchost.com 2712 svchost.com 2620 svchost.com 2620 svchost.com 2876 svchost.com 2876 svchost.com 1692 svchost.com 1692 svchost.com 2044 svchost.com 2044 svchost.com 1200 svchost.com 1200 svchost.com 1708 svchost.com 1708 svchost.com 1876 svchost.com 1876 svchost.com 2940 svchost.com 2940 svchost.com 2956 svchost.com 2956 svchost.com 2416 svchost.com 2416 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2512 2068 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 30 PID 2068 wrote to memory of 2512 2068 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 30 PID 2068 wrote to memory of 2512 2068 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 30 PID 2068 wrote to memory of 2512 2068 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 30 PID 2512 wrote to memory of 2508 2512 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 31 PID 2512 wrote to memory of 2508 2512 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 31 PID 2512 wrote to memory of 2508 2512 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 31 PID 2512 wrote to memory of 2508 2512 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 31 PID 2508 wrote to memory of 2256 2508 svchost.com 32 PID 2508 wrote to memory of 2256 2508 svchost.com 32 PID 2508 wrote to memory of 2256 2508 svchost.com 32 PID 2508 wrote to memory of 2256 2508 svchost.com 32 PID 2256 wrote to memory of 2732 2256 013F90~1.EXE 33 PID 2256 wrote to memory of 2732 2256 013F90~1.EXE 33 PID 2256 wrote to memory of 2732 2256 013F90~1.EXE 33 PID 2256 wrote to memory of 2732 2256 013F90~1.EXE 33 PID 2732 wrote to memory of 2740 2732 svchost.com 34 PID 2732 wrote to memory of 2740 2732 svchost.com 34 PID 2732 wrote to memory of 2740 2732 svchost.com 34 PID 2732 wrote to memory of 2740 2732 svchost.com 34 PID 2740 wrote to memory of 1108 2740 013F90~1.EXE 35 PID 2740 wrote to memory of 1108 2740 013F90~1.EXE 35 PID 2740 wrote to memory of 1108 2740 013F90~1.EXE 35 PID 2740 wrote to memory of 1108 2740 013F90~1.EXE 35 PID 1108 wrote to memory of 2908 1108 svchost.com 37 PID 1108 wrote to memory of 2908 1108 svchost.com 37 PID 1108 wrote to memory of 2908 1108 svchost.com 37 PID 1108 wrote to memory of 2908 1108 svchost.com 37 PID 2908 wrote to memory of 1564 2908 013F90~1.EXE 38 PID 2908 wrote to memory of 1564 2908 013F90~1.EXE 38 PID 2908 wrote to memory of 1564 2908 013F90~1.EXE 38 PID 2908 wrote to memory of 1564 2908 013F90~1.EXE 38 PID 1564 wrote to memory of 2708 1564 svchost.com 39 PID 1564 wrote to memory of 2708 1564 svchost.com 39 PID 1564 wrote to memory of 2708 1564 svchost.com 39 PID 1564 wrote to memory of 2708 1564 svchost.com 39 PID 2708 wrote to memory of 2652 2708 013F90~1.EXE 40 PID 2708 wrote to memory of 2652 2708 013F90~1.EXE 40 PID 2708 wrote to memory of 2652 2708 013F90~1.EXE 40 PID 2708 wrote to memory of 2652 2708 013F90~1.EXE 40 PID 2652 wrote to memory of 1200 2652 svchost.com 76 PID 2652 wrote to memory of 1200 2652 svchost.com 76 PID 2652 wrote to memory of 1200 2652 svchost.com 76 PID 2652 wrote to memory of 1200 2652 svchost.com 76 PID 1200 wrote to memory of 2848 1200 013F90~1.EXE 42 PID 1200 wrote to memory of 2848 1200 013F90~1.EXE 42 PID 1200 wrote to memory of 2848 1200 013F90~1.EXE 42 PID 1200 wrote to memory of 2848 1200 013F90~1.EXE 42 PID 2848 wrote to memory of 1468 2848 svchost.com 43 PID 2848 wrote to memory of 1468 2848 svchost.com 43 PID 2848 wrote to memory of 1468 2848 svchost.com 43 PID 2848 wrote to memory of 1468 2848 svchost.com 43 PID 1468 wrote to memory of 2000 1468 013F90~1.EXE 79 PID 1468 wrote to memory of 2000 1468 013F90~1.EXE 79 PID 1468 wrote to memory of 2000 1468 013F90~1.EXE 79 PID 1468 wrote to memory of 2000 1468 013F90~1.EXE 79 PID 2000 wrote to memory of 1876 2000 svchost.com 80 PID 2000 wrote to memory of 1876 2000 svchost.com 80 PID 2000 wrote to memory of 1876 2000 svchost.com 80 PID 2000 wrote to memory of 1876 2000 svchost.com 80 PID 1876 wrote to memory of 2856 1876 013F90~1.EXE 46 PID 1876 wrote to memory of 2856 1876 013F90~1.EXE 46 PID 1876 wrote to memory of 2856 1876 013F90~1.EXE 46 PID 1876 wrote to memory of 2856 1876 013F90~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe"C:\Users\Admin\AppData\Local\Temp\013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE18⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE20⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE22⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE24⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE26⤵
- Executes dropped EXE
PID:572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE28⤵
- Executes dropped EXE
PID:1452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE30⤵
- Executes dropped EXE
PID:1416 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE34⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE36⤵
- Executes dropped EXE
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE40⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE42⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE44⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE46⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE48⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE52⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE54⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE56⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE58⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"59⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE60⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE62⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"63⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE64⤵
- Executes dropped EXE
PID:788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"65⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE66⤵PID:2456
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"67⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE68⤵PID:2080
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"69⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE70⤵
- System Location Discovery: System Language Discovery
PID:356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"71⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE72⤵PID:324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"73⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE74⤵PID:2436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"75⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE76⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"77⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE78⤵PID:2516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"79⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE80⤵PID:2284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"81⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE82⤵PID:2508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"83⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE84⤵PID:2836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"85⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE86⤵PID:2720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"87⤵
- Drops file in Windows directory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE88⤵PID:2640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"89⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE90⤵PID:1656
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"91⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE92⤵PID:2488
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"93⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE94⤵PID:1868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"95⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE96⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"97⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE98⤵PID:2832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"99⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE100⤵PID:1920
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE102⤵PID:1264
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"103⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE104⤵PID:2956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"105⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE106⤵PID:2416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"107⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE108⤵PID:1872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"109⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE110⤵PID:2968
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"111⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE112⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"113⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE114⤵PID:2456
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"115⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE116⤵PID:2556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"117⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE118⤵PID:1756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"119⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"121⤵
- Drops file in Windows directory
PID:1572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-