Analysis
-
max time kernel
21s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 21:02
Behavioral task
behavioral1
Sample
d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
120 seconds
General
-
Target
d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe
-
Size
719KB
-
MD5
d5fa75ad1ce07b13a32b8b5acd7c29f0
-
SHA1
e92121b871b9bc85fdc2d871909a33bc02e46420
-
SHA256
d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bc
-
SHA512
3dacc8ac1dc09298e211799f276487e72a4acf49b3781db41f0485d5451f06daf1ad9da2a55c8e421ce7a1c863bd33d46f31eec96ef2f720e68ee9b6858b6ebb
-
SSDEEP
6144:k972+Mq9zntr0sfGxhfLyYB4AYB4ruJqLOuDUm6QglV5MxqZ1zSAzSnUE4kwIz+Y:g2FqPz4UmTAV5MczzSAzStZz+p1k5
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016dd0-2.dat family_neshta behavioral1/files/0x0008000000016de4-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x000700000001033a-18.dat family_neshta behavioral1/files/0x0022000000010678-17.dat family_neshta behavioral1/memory/2160-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2680-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2800-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2664-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1960-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2600-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1488-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2760-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1780-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/664-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1816-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2128-130-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-133.dat family_neshta behavioral1/memory/2872-131-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-147-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/448-157-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2092-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1820-146-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/964-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3024-168-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2228-188-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2248-187-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1536-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2252-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2408-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2448-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2076-232-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2312-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2304-246-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2340-245-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2400-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2732-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2824-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2532-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/760-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2164-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1640-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2856-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/988-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1612-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1948-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1448-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1936-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1924-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/468-360-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2180-370-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1672-369-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2728-378-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2148-377-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1624-385-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2916-386-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1208-393-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1956-394-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 824 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 2160 svchost.com 2680 D04B73~1.EXE 2664 svchost.com 2800 D04B73~1.EXE 2808 svchost.com 2784 D04B73~1.EXE 2600 svchost.com 1960 D04B73~1.EXE 1488 svchost.com 2760 D04B73~1.EXE 1780 svchost.com 664 D04B73~1.EXE 2844 svchost.com 1816 D04B73~1.EXE 2872 svchost.com 2128 D04B73~1.EXE 2972 svchost.com 1820 D04B73~1.EXE 2092 svchost.com 448 D04B73~1.EXE 3024 svchost.com 964 D04B73~1.EXE 2228 svchost.com 2248 D04B73~1.EXE 2252 svchost.com 1536 D04B73~1.EXE 2448 svchost.com 2408 D04B73~1.EXE 2076 svchost.com 2312 D04B73~1.EXE 2340 svchost.com 2304 D04B73~1.EXE 2400 svchost.com 2732 D04B73~1.EXE 2688 svchost.com 2824 D04B73~1.EXE 2828 svchost.com 2532 D04B73~1.EXE 2164 svchost.com 760 D04B73~1.EXE 1640 svchost.com 2856 D04B73~1.EXE 1404 svchost.com 988 D04B73~1.EXE 1612 svchost.com 1948 D04B73~1.EXE 1448 svchost.com 1936 D04B73~1.EXE 1924 svchost.com 468 D04B73~1.EXE 2180 svchost.com 1672 D04B73~1.EXE 2148 svchost.com 2728 D04B73~1.EXE 2916 svchost.com 1624 D04B73~1.EXE 1208 svchost.com 1956 D04B73~1.EXE 3040 svchost.com 1184 D04B73~1.EXE 2228 svchost.com 1384 D04B73~1.EXE 1080 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 1800 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 1800 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 2160 svchost.com 2160 svchost.com 2664 svchost.com 2664 svchost.com 2808 svchost.com 2808 svchost.com 2600 svchost.com 2600 svchost.com 1488 svchost.com 1488 svchost.com 1780 svchost.com 1780 svchost.com 2844 svchost.com 2844 svchost.com 2872 svchost.com 2872 svchost.com 2972 svchost.com 2972 svchost.com 2092 svchost.com 2092 svchost.com 3024 svchost.com 3024 svchost.com 1800 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 824 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 1800 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 2228 svchost.com 2228 svchost.com 2252 svchost.com 2252 svchost.com 2448 svchost.com 2448 svchost.com 2076 svchost.com 2076 svchost.com 2340 svchost.com 2340 svchost.com 2400 svchost.com 2400 svchost.com 2688 svchost.com 2688 svchost.com 1800 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 2828 svchost.com 2828 svchost.com 2164 svchost.com 2164 svchost.com 1640 svchost.com 1640 svchost.com 1404 svchost.com 1404 svchost.com 1612 svchost.com 1612 svchost.com 1448 svchost.com 1448 svchost.com 1924 svchost.com 1924 svchost.com 2180 svchost.com 2180 svchost.com 2148 svchost.com 2148 svchost.com 2916 svchost.com 2916 svchost.com 1208 svchost.com 1208 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\directx.sys D04B73~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\svchost.com D04B73~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B73~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 824 1800 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 31 PID 1800 wrote to memory of 824 1800 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 31 PID 1800 wrote to memory of 824 1800 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 31 PID 1800 wrote to memory of 824 1800 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 31 PID 824 wrote to memory of 2160 824 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 32 PID 824 wrote to memory of 2160 824 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 32 PID 824 wrote to memory of 2160 824 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 32 PID 824 wrote to memory of 2160 824 d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe 32 PID 2160 wrote to memory of 2680 2160 svchost.com 33 PID 2160 wrote to memory of 2680 2160 svchost.com 33 PID 2160 wrote to memory of 2680 2160 svchost.com 33 PID 2160 wrote to memory of 2680 2160 svchost.com 33 PID 2680 wrote to memory of 2664 2680 D04B73~1.EXE 34 PID 2680 wrote to memory of 2664 2680 D04B73~1.EXE 34 PID 2680 wrote to memory of 2664 2680 D04B73~1.EXE 34 PID 2680 wrote to memory of 2664 2680 D04B73~1.EXE 34 PID 2664 wrote to memory of 2800 2664 svchost.com 35 PID 2664 wrote to memory of 2800 2664 svchost.com 35 PID 2664 wrote to memory of 2800 2664 svchost.com 35 PID 2664 wrote to memory of 2800 2664 svchost.com 35 PID 2800 wrote to memory of 2808 2800 D04B73~1.EXE 36 PID 2800 wrote to memory of 2808 2800 D04B73~1.EXE 36 PID 2800 wrote to memory of 2808 2800 D04B73~1.EXE 36 PID 2800 wrote to memory of 2808 2800 D04B73~1.EXE 36 PID 2808 wrote to memory of 2784 2808 svchost.com 37 PID 2808 wrote to memory of 2784 2808 svchost.com 37 PID 2808 wrote to memory of 2784 2808 svchost.com 37 PID 2808 wrote to memory of 2784 2808 svchost.com 37 PID 2784 wrote to memory of 2600 2784 D04B73~1.EXE 38 PID 2784 wrote to memory of 2600 2784 D04B73~1.EXE 38 PID 2784 wrote to memory of 2600 2784 D04B73~1.EXE 38 PID 2784 wrote to memory of 2600 2784 D04B73~1.EXE 38 PID 2600 wrote to memory of 1960 2600 svchost.com 160 PID 2600 wrote to memory of 1960 2600 svchost.com 160 PID 2600 wrote to memory of 1960 2600 svchost.com 160 PID 2600 wrote to memory of 1960 2600 svchost.com 160 PID 1960 wrote to memory of 1488 1960 D04B73~1.EXE 40 PID 1960 wrote to memory of 1488 1960 D04B73~1.EXE 40 PID 1960 wrote to memory of 1488 1960 D04B73~1.EXE 40 PID 1960 wrote to memory of 1488 1960 D04B73~1.EXE 40 PID 1488 wrote to memory of 2760 1488 svchost.com 41 PID 1488 wrote to memory of 2760 1488 svchost.com 41 PID 1488 wrote to memory of 2760 1488 svchost.com 41 PID 1488 wrote to memory of 2760 1488 svchost.com 41 PID 2760 wrote to memory of 1780 2760 D04B73~1.EXE 42 PID 2760 wrote to memory of 1780 2760 D04B73~1.EXE 42 PID 2760 wrote to memory of 1780 2760 D04B73~1.EXE 42 PID 2760 wrote to memory of 1780 2760 D04B73~1.EXE 42 PID 1780 wrote to memory of 664 1780 svchost.com 43 PID 1780 wrote to memory of 664 1780 svchost.com 43 PID 1780 wrote to memory of 664 1780 svchost.com 43 PID 1780 wrote to memory of 664 1780 svchost.com 43 PID 664 wrote to memory of 2844 664 D04B73~1.EXE 44 PID 664 wrote to memory of 2844 664 D04B73~1.EXE 44 PID 664 wrote to memory of 2844 664 D04B73~1.EXE 44 PID 664 wrote to memory of 2844 664 D04B73~1.EXE 44 PID 2844 wrote to memory of 1816 2844 svchost.com 45 PID 2844 wrote to memory of 1816 2844 svchost.com 45 PID 2844 wrote to memory of 1816 2844 svchost.com 45 PID 2844 wrote to memory of 1816 2844 svchost.com 45 PID 1816 wrote to memory of 2872 1816 D04B73~1.EXE 46 PID 1816 wrote to memory of 2872 1816 D04B73~1.EXE 46 PID 1816 wrote to memory of 2872 1816 D04B73~1.EXE 46 PID 1816 wrote to memory of 2872 1816 D04B73~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe"C:\Users\Admin\AppData\Local\Temp\d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\d04b73d07b61680bda170eb86a5a65ad62e0e3b122ff577251449e5d58bb19bcN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE20⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE22⤵
- Executes dropped EXE
PID:448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE24⤵
- Executes dropped EXE
PID:964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE28⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE30⤵
- Executes dropped EXE
PID:2408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2312 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE34⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE38⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE42⤵
- Executes dropped EXE
PID:760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE44⤵
- Executes dropped EXE
PID:2856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE46⤵
- Executes dropped EXE
PID:988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE52⤵
- Executes dropped EXE
PID:468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE54⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE56⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE58⤵
- Executes dropped EXE
PID:1624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE60⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"61⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1184 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE64⤵
- Executes dropped EXE
PID:1384 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE66⤵PID:2168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"67⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE68⤵PID:2292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"69⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE70⤵PID:1752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"71⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE72⤵PID:1572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"73⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE74⤵
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"75⤵
- Drops file in Windows directory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE76⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"77⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE78⤵PID:1920
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"79⤵
- Drops file in Windows directory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE80⤵
- Drops file in Windows directory
PID:2628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"81⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE82⤵PID:2552
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"83⤵
- Drops file in Windows directory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE84⤵
- Drops file in Windows directory
PID:576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"85⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE86⤵PID:2612
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"87⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE88⤵PID:2856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"89⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE90⤵
- Drops file in Windows directory
PID:1112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"91⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE92⤵PID:2624
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"93⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE94⤵PID:1824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"95⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE96⤵PID:1860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"97⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE98⤵PID:2472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"99⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE100⤵PID:2092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"101⤵
- Drops file in Windows directory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE102⤵PID:316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE104⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"105⤵
- Drops file in Windows directory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE106⤵PID:1300
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"107⤵
- System Location Discovery: System Language Discovery
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE108⤵
- Drops file in Windows directory
PID:2368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"109⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE110⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"111⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE112⤵PID:2200
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE114⤵PID:2896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE116⤵PID:2052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"117⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE118⤵PID:2876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"119⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE120⤵PID:2072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D04B73~1.EXE"121⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-