Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2024, 05:33
Behavioral task
behavioral1
Sample
013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe
Resource
win10v2004-20241007-en
General
-
Target
013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe
-
Size
172KB
-
MD5
93f75667e60838eb69e64f07c626fe60
-
SHA1
46a8738cfd06af8651b9710ee2efa4078a8ccba3
-
SHA256
013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6
-
SHA512
0a9092ead8ef053b6bcaee2a839c796552a93d6786f97a13f02758cc87527d6f5bba9f65fff9b0214a5ad9158036290d8f573cae09902fb4255b588d3c55abbc
-
SSDEEP
1536:JxqjQ+P04wsmJCwcmxsLxY+xGHGI4wwMtjp78HN2hSOxqjQ+P04wsmJCzOxqjQ+9:sr85CVSIxGx4wwMtGFr85C7r85C
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral2/files/0x0008000000023cad-4.dat family_neshta behavioral2/files/0x0007000000023cb2-10.dat family_neshta behavioral2/memory/2624-16-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2712-26-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4548-28-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4556-32-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3344-40-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2544-51-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2776-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4948-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2132-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3584-68-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2008-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2904-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0004000000020348-89.dat family_neshta behavioral2/files/0x0006000000020217-97.dat family_neshta behavioral2/files/0x000600000002021b-94.dat family_neshta behavioral2/files/0x0007000000020283-93.dat family_neshta behavioral2/memory/1184-111-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1348-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3872-124-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3676-130-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000214df-140.dat family_neshta behavioral2/files/0x00010000000214e0-150.dat family_neshta behavioral2/files/0x00010000000214e1-147.dat family_neshta behavioral2/files/0x0001000000022f41-154.dat family_neshta behavioral2/files/0x0001000000022f7f-157.dat family_neshta behavioral2/files/0x0001000000022f7e-163.dat family_neshta behavioral2/memory/3544-166-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000167ab-169.dat family_neshta behavioral2/files/0x00010000000167fd-168.dat family_neshta behavioral2/files/0x0001000000022f80-162.dat family_neshta behavioral2/files/0x00010000000167c0-179.dat family_neshta behavioral2/files/0x000100000001dbca-187.dat family_neshta behavioral2/files/0x0001000000022e7a-202.dat family_neshta behavioral2/files/0x0001000000016912-201.dat family_neshta behavioral2/files/0x00020000000215d2-215.dat family_neshta behavioral2/files/0x000200000000072b-208.dat family_neshta behavioral2/memory/3116-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000500000001e6a9-226.dat family_neshta behavioral2/files/0x000300000001e8bb-225.dat family_neshta behavioral2/files/0x000300000001e86a-224.dat family_neshta behavioral2/memory/636-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2400-244-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/968-245-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5104-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3412-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2956-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4672-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3924-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3168-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3444-271-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3276-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4892-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4120-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4816-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1504-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3004-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3020-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4076-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5096-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4996-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1132-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4088-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 013F90~1.EXE -
Executes dropped EXE 64 IoCs
pid Process 732 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 2624 svchost.com 2712 013F90~1.EXE 4548 svchost.com 4556 013F90~1.EXE 3344 svchost.com 2544 013F90~1.EXE 2776 svchost.com 4948 013F90~1.EXE 2132 svchost.com 3584 013F90~1.EXE 2008 svchost.com 2904 013F90~1.EXE 1184 svchost.com 1348 013F90~1.EXE 3872 svchost.com 3676 013F90~1.EXE 3544 svchost.com 3116 013F90~1.EXE 636 svchost.com 2400 013F90~1.EXE 968 svchost.com 5104 013F90~1.EXE 3412 svchost.com 2956 013F90~1.EXE 4672 svchost.com 3924 013F90~1.EXE 3168 svchost.com 3444 013F90~1.EXE 3276 svchost.com 4892 013F90~1.EXE 4120 svchost.com 4816 013F90~1.EXE 1504 svchost.com 3004 013F90~1.EXE 3020 svchost.com 4076 013F90~1.EXE 5096 svchost.com 4996 013F90~1.EXE 1132 svchost.com 4088 013F90~1.EXE 5060 svchost.com 2904 013F90~1.EXE 5116 svchost.com 3964 013F90~1.EXE 1748 svchost.com 4032 013F90~1.EXE 516 svchost.com 2404 013F90~1.EXE 3676 svchost.com 4744 013F90~1.EXE 4776 svchost.com 4824 013F90~1.EXE 1104 svchost.com 1620 013F90~1.EXE 1660 svchost.com 744 013F90~1.EXE 2204 svchost.com 4448 013F90~1.EXE 3136 svchost.com 636 013F90~1.EXE 2948 svchost.com 2412 013F90~1.EXE 4408 svchost.com -
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 013F90~1.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 013F90~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 013F90~1.EXE File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 013F90~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 013F90~1.EXE File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 013F90~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 013F90~1.EXE File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 013F90~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com 013F90~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 013F90~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 013F90~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 013F90~1.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 013F90~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 732 372 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 82 PID 372 wrote to memory of 732 372 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 82 PID 372 wrote to memory of 732 372 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 82 PID 732 wrote to memory of 2624 732 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 83 PID 732 wrote to memory of 2624 732 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 83 PID 732 wrote to memory of 2624 732 013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe 83 PID 2624 wrote to memory of 2712 2624 svchost.com 84 PID 2624 wrote to memory of 2712 2624 svchost.com 84 PID 2624 wrote to memory of 2712 2624 svchost.com 84 PID 2712 wrote to memory of 4548 2712 013F90~1.EXE 85 PID 2712 wrote to memory of 4548 2712 013F90~1.EXE 85 PID 2712 wrote to memory of 4548 2712 013F90~1.EXE 85 PID 4548 wrote to memory of 4556 4548 svchost.com 86 PID 4548 wrote to memory of 4556 4548 svchost.com 86 PID 4548 wrote to memory of 4556 4548 svchost.com 86 PID 4556 wrote to memory of 3344 4556 013F90~1.EXE 87 PID 4556 wrote to memory of 3344 4556 013F90~1.EXE 87 PID 4556 wrote to memory of 3344 4556 013F90~1.EXE 87 PID 3344 wrote to memory of 2544 3344 svchost.com 88 PID 3344 wrote to memory of 2544 3344 svchost.com 88 PID 3344 wrote to memory of 2544 3344 svchost.com 88 PID 2544 wrote to memory of 2776 2544 013F90~1.EXE 89 PID 2544 wrote to memory of 2776 2544 013F90~1.EXE 89 PID 2544 wrote to memory of 2776 2544 013F90~1.EXE 89 PID 2776 wrote to memory of 4948 2776 svchost.com 90 PID 2776 wrote to memory of 4948 2776 svchost.com 90 PID 2776 wrote to memory of 4948 2776 svchost.com 90 PID 4948 wrote to memory of 2132 4948 013F90~1.EXE 91 PID 4948 wrote to memory of 2132 4948 013F90~1.EXE 91 PID 4948 wrote to memory of 2132 4948 013F90~1.EXE 91 PID 2132 wrote to memory of 3584 2132 svchost.com 92 PID 2132 wrote to memory of 3584 2132 svchost.com 92 PID 2132 wrote to memory of 3584 2132 svchost.com 92 PID 3584 wrote to memory of 2008 3584 013F90~1.EXE 93 PID 3584 wrote to memory of 2008 3584 013F90~1.EXE 93 PID 3584 wrote to memory of 2008 3584 013F90~1.EXE 93 PID 2008 wrote to memory of 2904 2008 svchost.com 124 PID 2008 wrote to memory of 2904 2008 svchost.com 124 PID 2008 wrote to memory of 2904 2008 svchost.com 124 PID 2904 wrote to memory of 1184 2904 013F90~1.EXE 95 PID 2904 wrote to memory of 1184 2904 013F90~1.EXE 95 PID 2904 wrote to memory of 1184 2904 013F90~1.EXE 95 PID 1184 wrote to memory of 1348 1184 svchost.com 96 PID 1184 wrote to memory of 1348 1184 svchost.com 96 PID 1184 wrote to memory of 1348 1184 svchost.com 96 PID 1348 wrote to memory of 3872 1348 013F90~1.EXE 97 PID 1348 wrote to memory of 3872 1348 013F90~1.EXE 97 PID 1348 wrote to memory of 3872 1348 013F90~1.EXE 97 PID 3872 wrote to memory of 3676 3872 svchost.com 173 PID 3872 wrote to memory of 3676 3872 svchost.com 173 PID 3872 wrote to memory of 3676 3872 svchost.com 173 PID 3676 wrote to memory of 3544 3676 013F90~1.EXE 99 PID 3676 wrote to memory of 3544 3676 013F90~1.EXE 99 PID 3676 wrote to memory of 3544 3676 013F90~1.EXE 99 PID 3544 wrote to memory of 3116 3544 svchost.com 100 PID 3544 wrote to memory of 3116 3544 svchost.com 100 PID 3544 wrote to memory of 3116 3544 svchost.com 100 PID 3116 wrote to memory of 636 3116 013F90~1.EXE 142 PID 3116 wrote to memory of 636 3116 013F90~1.EXE 142 PID 3116 wrote to memory of 636 3116 013F90~1.EXE 142 PID 636 wrote to memory of 2400 636 svchost.com 102 PID 636 wrote to memory of 2400 636 svchost.com 102 PID 636 wrote to memory of 2400 636 svchost.com 102 PID 2400 wrote to memory of 968 2400 013F90~1.EXE 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe"C:\Users\Admin\AppData\Local\Temp\013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\013f9003747957f2b9a36dbe16a8d3485db0d29fd69347f298249b51b2aa18b6N.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE12⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"23⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:5104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"25⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE26⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"27⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE28⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"29⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE30⤵
- Executes dropped EXE
PID:3444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"31⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE32⤵
- Executes dropped EXE
PID:4892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"33⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE34⤵
- Executes dropped EXE
- Modifies registry class
PID:4816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"37⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE38⤵
- Executes dropped EXE
PID:4076 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"39⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE40⤵
- Executes dropped EXE
PID:4996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"41⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE42⤵
- Executes dropped EXE
PID:4088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"45⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE46⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"47⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE48⤵
- Checks computer location settings
- Executes dropped EXE
PID:4032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"49⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE50⤵
- Executes dropped EXE
- Modifies registry class
PID:2404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"51⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE52⤵
- Executes dropped EXE
PID:4744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"53⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE54⤵
- Executes dropped EXE
- Modifies registry class
PID:4824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE56⤵
- Executes dropped EXE
- Modifies registry class
PID:1620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"57⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE58⤵
- Executes dropped EXE
PID:744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE60⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE62⤵
- Executes dropped EXE
PID:636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"63⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"65⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE66⤵
- Checks computer location settings
- Drops file in Windows directory
PID:1228 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"67⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE68⤵PID:4316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"69⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE70⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3168 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"71⤵
- Drops file in Windows directory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE72⤵
- Modifies registry class
PID:3276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"73⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE74⤵
- Checks computer location settings
- Modifies registry class
PID:4120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"75⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE76⤵
- Checks computer location settings
PID:3980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"77⤵
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE78⤵
- Modifies registry class
PID:3020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"79⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE80⤵
- Checks computer location settings
- Drops file in Windows directory
PID:1472 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"81⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE82⤵
- Checks computer location settings
PID:532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE84⤵
- Checks computer location settings
- Modifies registry class
PID:4768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"85⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE86⤵
- Modifies registry class
PID:4276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"87⤵
- Drops file in Windows directory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE88⤵
- Checks computer location settings
PID:1316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"89⤵
- System Location Discovery: System Language Discovery
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE90⤵
- Drops file in Windows directory
PID:1804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"91⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE92⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"93⤵
- System Location Discovery: System Language Discovery
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE94⤵
- Modifies registry class
PID:1152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"95⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE96⤵
- Drops file in Windows directory
- Modifies registry class
PID:2280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"97⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE98⤵
- Drops file in Windows directory
- Modifies registry class
PID:3464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"99⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE100⤵PID:1416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"101⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE102⤵
- Checks computer location settings
PID:3672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"103⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE104⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"105⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE106⤵PID:4668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"107⤵
- System Location Discovery: System Language Discovery
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE108⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:4852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"109⤵
- System Location Discovery: System Language Discovery
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE110⤵
- Checks computer location settings
- Drops file in Windows directory
PID:1504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"111⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE112⤵PID:1836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"113⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE114⤵
- Checks computer location settings
PID:868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"115⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE116⤵
- Checks computer location settings
PID:4216 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"117⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE118⤵
- Checks computer location settings
PID:4864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"119⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE120⤵
- Checks computer location settings
PID:448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE"121⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\013F90~1.EXE122⤵
- Drops file in Windows directory
PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-