Analysis
-
max time kernel
299s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02-12-2024 13:54
Behavioral task
behavioral1
Sample
FDR9876567000.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
FDR9876567000.exe
Resource
win10v2004-20241007-en
General
-
Target
FDR9876567000.exe
-
Size
833KB
-
MD5
c517ecc1d57af03affdd6945e1b618d8
-
SHA1
5c5174ebdf5902ada7c5899b6c0b98f2db363372
-
SHA256
9a32e0821da4466b858ecfd185f3d9bff232d8a3b44983988c248df05ef7c2ef
-
SHA512
355c1f39946662b0c16c6a5fa4c387aad03e1dc1c1dd74d650a784fc9e718b890a877937d8d3a26ab62a22385f03e02e6d0faa6d9e07ea3b16151c909596097a
-
SSDEEP
12288:5quErHF6xC9D6DmR1J98w4oknqOOCyQfY7nPIsUgzp6x0hFxZAXFbuFb7anFbq44:Mrl6kD68JmlotQfgEYpOqFxTlaVXSxz
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
ectosphere.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ectosphere.vbs ectosphere.exe -
Executes dropped EXE 64 IoCs
Processes:
ectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exepid Process 2864 ectosphere.exe 2012 ectosphere.exe 2716 ectosphere.exe 2624 ectosphere.exe 1796 ectosphere.exe 2612 ectosphere.exe 3036 ectosphere.exe 1608 ectosphere.exe 2636 ectosphere.exe 2788 ectosphere.exe 2892 ectosphere.exe 624 ectosphere.exe 848 ectosphere.exe 1624 ectosphere.exe 2352 ectosphere.exe 3044 ectosphere.exe 2236 ectosphere.exe 2088 ectosphere.exe 1136 ectosphere.exe 1852 ectosphere.exe 1476 ectosphere.exe 2032 ectosphere.exe 1592 ectosphere.exe 1528 ectosphere.exe 1320 ectosphere.exe 2996 ectosphere.exe 1524 ectosphere.exe 2868 ectosphere.exe 2860 ectosphere.exe 2596 ectosphere.exe 1372 ectosphere.exe 1620 ectosphere.exe 1724 ectosphere.exe 1044 ectosphere.exe 2120 ectosphere.exe 1428 ectosphere.exe 1216 ectosphere.exe 2920 ectosphere.exe 2448 ectosphere.exe 1780 ectosphere.exe 284 ectosphere.exe 2184 ectosphere.exe 3064 ectosphere.exe 2272 ectosphere.exe 1432 ectosphere.exe 876 ectosphere.exe 1556 ectosphere.exe 1464 ectosphere.exe 1644 ectosphere.exe 3000 ectosphere.exe 1696 ectosphere.exe 2520 ectosphere.exe 1772 ectosphere.exe 2116 ectosphere.exe 1636 ectosphere.exe 3024 ectosphere.exe 2164 ectosphere.exe 2888 ectosphere.exe 1752 ectosphere.exe 2584 ectosphere.exe 2632 ectosphere.exe 2500 ectosphere.exe 3040 ectosphere.exe 1740 ectosphere.exe -
Loads dropped DLL 2 IoCs
Processes:
FDR9876567000.exeectosphere.exepid Process 2268 FDR9876567000.exe 2864 ectosphere.exe -
AutoIT Executable 64 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2716-53-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2012-43-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2012-32-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2864-31-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2268-13-0x0000000000EA0000-0x000000000106E000-memory.dmp autoit_exe behavioral1/memory/2624-64-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1796-74-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2612-85-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/3036-87-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/3036-97-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1608-98-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1608-108-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2636-118-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2788-119-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2788-129-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2892-140-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/624-141-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/624-151-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/848-162-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1624-173-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2352-183-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/3044-184-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/3044-194-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2236-204-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2088-205-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2088-215-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1136-225-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1852-226-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1476-237-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1852-236-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1476-247-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2032-248-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1592-259-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2032-258-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1592-269-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1528-270-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1528-280-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1320-290-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2996-291-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1524-302-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2996-301-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1524-312-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2868-313-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2868-323-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2860-334-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2596-335-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2596-345-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1372-354-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1620-355-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1620-363-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1724-372-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1044-381-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2120-382-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2120-390-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1428-398-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1216-407-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2920-408-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2920-416-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2448-425-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1780-426-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/1780-434-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/284-443-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2184-444-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe behavioral1/memory/2184-452-0x0000000001350000-0x000000000151E000-memory.dmp autoit_exe -
Processes:
resource yara_rule behavioral1/memory/2624-54-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/files/0x0006000000018718-51.dat upx behavioral1/memory/2716-53-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2012-43-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2012-32-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2864-31-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2864-29-0x0000000002BF0000-0x0000000002DBE000-memory.dmp upx behavioral1/memory/2864-16-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2268-13-0x0000000000EA0000-0x000000000106E000-memory.dmp upx behavioral1/memory/2268-0-0x0000000000EA0000-0x000000000106E000-memory.dmp upx behavioral1/memory/2624-64-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2612-75-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1796-74-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2612-85-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/3036-87-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/3036-97-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1608-98-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1608-108-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2636-118-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2788-119-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2788-129-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2892-130-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2892-140-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/624-141-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/624-151-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/848-152-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1624-163-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/848-162-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1624-173-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2352-183-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/3044-184-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/3044-194-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2236-204-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2088-205-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2088-215-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1136-225-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1852-226-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1476-237-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1852-236-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1476-247-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2032-248-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1592-259-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2032-258-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1592-269-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1528-270-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1528-280-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1320-290-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2996-291-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1524-302-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2996-301-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1524-312-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2868-313-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2868-323-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2860-324-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2860-334-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2596-335-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1372-346-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/2596-345-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1372-354-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1620-355-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1724-364-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1620-363-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1044-373-0x0000000001350000-0x000000000151E000-memory.dmp upx behavioral1/memory/1724-372-0x0000000001350000-0x000000000151E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ectosphere.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
FDR9876567000.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exepid Process 2268 FDR9876567000.exe 2268 FDR9876567000.exe 2864 ectosphere.exe 2864 ectosphere.exe 2012 ectosphere.exe 2012 ectosphere.exe 2716 ectosphere.exe 2716 ectosphere.exe 2624 ectosphere.exe 2624 ectosphere.exe 1796 ectosphere.exe 1796 ectosphere.exe 2612 ectosphere.exe 2612 ectosphere.exe 3036 ectosphere.exe 3036 ectosphere.exe 1608 ectosphere.exe 1608 ectosphere.exe 2636 ectosphere.exe 2636 ectosphere.exe 2788 ectosphere.exe 2788 ectosphere.exe 2892 ectosphere.exe 2892 ectosphere.exe 624 ectosphere.exe 624 ectosphere.exe 848 ectosphere.exe 848 ectosphere.exe 1624 ectosphere.exe 1624 ectosphere.exe 2352 ectosphere.exe 2352 ectosphere.exe 3044 ectosphere.exe 3044 ectosphere.exe 2236 ectosphere.exe 2236 ectosphere.exe 2088 ectosphere.exe 2088 ectosphere.exe 1136 ectosphere.exe 1136 ectosphere.exe 1852 ectosphere.exe 1852 ectosphere.exe 1476 ectosphere.exe 1476 ectosphere.exe 2032 ectosphere.exe 2032 ectosphere.exe 1592 ectosphere.exe 1592 ectosphere.exe 1528 ectosphere.exe 1528 ectosphere.exe 1320 ectosphere.exe 1320 ectosphere.exe 2996 ectosphere.exe 2996 ectosphere.exe 1524 ectosphere.exe 1524 ectosphere.exe 2868 ectosphere.exe 2868 ectosphere.exe 2860 ectosphere.exe 2860 ectosphere.exe 2596 ectosphere.exe 2596 ectosphere.exe 1372 ectosphere.exe 1372 ectosphere.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
FDR9876567000.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exepid Process 2268 FDR9876567000.exe 2268 FDR9876567000.exe 2864 ectosphere.exe 2864 ectosphere.exe 2012 ectosphere.exe 2012 ectosphere.exe 2716 ectosphere.exe 2716 ectosphere.exe 2624 ectosphere.exe 2624 ectosphere.exe 1796 ectosphere.exe 1796 ectosphere.exe 2612 ectosphere.exe 2612 ectosphere.exe 3036 ectosphere.exe 3036 ectosphere.exe 1608 ectosphere.exe 1608 ectosphere.exe 2636 ectosphere.exe 2636 ectosphere.exe 2788 ectosphere.exe 2788 ectosphere.exe 2892 ectosphere.exe 2892 ectosphere.exe 624 ectosphere.exe 624 ectosphere.exe 848 ectosphere.exe 848 ectosphere.exe 1624 ectosphere.exe 1624 ectosphere.exe 2352 ectosphere.exe 2352 ectosphere.exe 3044 ectosphere.exe 3044 ectosphere.exe 2236 ectosphere.exe 2236 ectosphere.exe 2088 ectosphere.exe 2088 ectosphere.exe 1136 ectosphere.exe 1136 ectosphere.exe 1852 ectosphere.exe 1852 ectosphere.exe 1476 ectosphere.exe 1476 ectosphere.exe 2032 ectosphere.exe 2032 ectosphere.exe 1592 ectosphere.exe 1592 ectosphere.exe 1528 ectosphere.exe 1528 ectosphere.exe 1320 ectosphere.exe 1320 ectosphere.exe 2996 ectosphere.exe 2996 ectosphere.exe 1524 ectosphere.exe 1524 ectosphere.exe 2868 ectosphere.exe 2868 ectosphere.exe 2860 ectosphere.exe 2860 ectosphere.exe 2596 ectosphere.exe 2596 ectosphere.exe 1372 ectosphere.exe 1372 ectosphere.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
FDR9876567000.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exeectosphere.exedescription pid Process procid_target PID 2268 wrote to memory of 2864 2268 FDR9876567000.exe 30 PID 2268 wrote to memory of 2864 2268 FDR9876567000.exe 30 PID 2268 wrote to memory of 2864 2268 FDR9876567000.exe 30 PID 2268 wrote to memory of 2864 2268 FDR9876567000.exe 30 PID 2864 wrote to memory of 2012 2864 ectosphere.exe 31 PID 2864 wrote to memory of 2012 2864 ectosphere.exe 31 PID 2864 wrote to memory of 2012 2864 ectosphere.exe 31 PID 2864 wrote to memory of 2012 2864 ectosphere.exe 31 PID 2012 wrote to memory of 2716 2012 ectosphere.exe 32 PID 2012 wrote to memory of 2716 2012 ectosphere.exe 32 PID 2012 wrote to memory of 2716 2012 ectosphere.exe 32 PID 2012 wrote to memory of 2716 2012 ectosphere.exe 32 PID 2716 wrote to memory of 2624 2716 ectosphere.exe 33 PID 2716 wrote to memory of 2624 2716 ectosphere.exe 33 PID 2716 wrote to memory of 2624 2716 ectosphere.exe 33 PID 2716 wrote to memory of 2624 2716 ectosphere.exe 33 PID 2624 wrote to memory of 1796 2624 ectosphere.exe 34 PID 2624 wrote to memory of 1796 2624 ectosphere.exe 34 PID 2624 wrote to memory of 1796 2624 ectosphere.exe 34 PID 2624 wrote to memory of 1796 2624 ectosphere.exe 34 PID 1796 wrote to memory of 2612 1796 ectosphere.exe 35 PID 1796 wrote to memory of 2612 1796 ectosphere.exe 35 PID 1796 wrote to memory of 2612 1796 ectosphere.exe 35 PID 1796 wrote to memory of 2612 1796 ectosphere.exe 35 PID 2612 wrote to memory of 3036 2612 ectosphere.exe 36 PID 2612 wrote to memory of 3036 2612 ectosphere.exe 36 PID 2612 wrote to memory of 3036 2612 ectosphere.exe 36 PID 2612 wrote to memory of 3036 2612 ectosphere.exe 36 PID 3036 wrote to memory of 1608 3036 ectosphere.exe 37 PID 3036 wrote to memory of 1608 3036 ectosphere.exe 37 PID 3036 wrote to memory of 1608 3036 ectosphere.exe 37 PID 3036 wrote to memory of 1608 3036 ectosphere.exe 37 PID 1608 wrote to memory of 2636 1608 ectosphere.exe 38 PID 1608 wrote to memory of 2636 1608 ectosphere.exe 38 PID 1608 wrote to memory of 2636 1608 ectosphere.exe 38 PID 1608 wrote to memory of 2636 1608 ectosphere.exe 38 PID 2636 wrote to memory of 2788 2636 ectosphere.exe 39 PID 2636 wrote to memory of 2788 2636 ectosphere.exe 39 PID 2636 wrote to memory of 2788 2636 ectosphere.exe 39 PID 2636 wrote to memory of 2788 2636 ectosphere.exe 39 PID 2788 wrote to memory of 2892 2788 ectosphere.exe 40 PID 2788 wrote to memory of 2892 2788 ectosphere.exe 40 PID 2788 wrote to memory of 2892 2788 ectosphere.exe 40 PID 2788 wrote to memory of 2892 2788 ectosphere.exe 40 PID 2892 wrote to memory of 624 2892 ectosphere.exe 41 PID 2892 wrote to memory of 624 2892 ectosphere.exe 41 PID 2892 wrote to memory of 624 2892 ectosphere.exe 41 PID 2892 wrote to memory of 624 2892 ectosphere.exe 41 PID 624 wrote to memory of 848 624 ectosphere.exe 42 PID 624 wrote to memory of 848 624 ectosphere.exe 42 PID 624 wrote to memory of 848 624 ectosphere.exe 42 PID 624 wrote to memory of 848 624 ectosphere.exe 42 PID 848 wrote to memory of 1624 848 ectosphere.exe 43 PID 848 wrote to memory of 1624 848 ectosphere.exe 43 PID 848 wrote to memory of 1624 848 ectosphere.exe 43 PID 848 wrote to memory of 1624 848 ectosphere.exe 43 PID 1624 wrote to memory of 2352 1624 ectosphere.exe 44 PID 1624 wrote to memory of 2352 1624 ectosphere.exe 44 PID 1624 wrote to memory of 2352 1624 ectosphere.exe 44 PID 1624 wrote to memory of 2352 1624 ectosphere.exe 44 PID 2352 wrote to memory of 3044 2352 ectosphere.exe 45 PID 2352 wrote to memory of 3044 2352 ectosphere.exe 45 PID 2352 wrote to memory of 3044 2352 ectosphere.exe 45 PID 2352 wrote to memory of 3044 2352 ectosphere.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\FDR9876567000.exe"C:\Users\Admin\AppData\Local\Temp\FDR9876567000.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\Temp\FDR9876567000.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"6⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"10⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"11⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"12⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"14⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"16⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3044 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"18⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2236 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"19⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2088 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"20⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1136 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"21⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1852 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1476 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"23⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2032 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"24⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1592 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1528 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"26⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1320 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"27⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2996 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"28⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1524 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"29⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2868 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"30⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2860 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2596 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"32⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1372 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"34⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"35⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"36⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"37⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1216 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"39⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"40⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"41⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"42⤵
- Executes dropped EXE
PID:284 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"43⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"44⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"45⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"46⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:876 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"48⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"49⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"50⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"51⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"53⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"54⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"55⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"57⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"58⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"59⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"60⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"61⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"62⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"63⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"64⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"65⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"66⤵PID:2928
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"67⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"68⤵PID:1436
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"69⤵PID:2040
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"70⤵PID:2224
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"71⤵
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"72⤵PID:2388
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"73⤵
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"74⤵
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"75⤵PID:824
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"76⤵PID:292
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"77⤵PID:2080
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"78⤵PID:1204
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"79⤵PID:2308
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"80⤵PID:2148
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"81⤵PID:844
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"82⤵PID:1684
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"83⤵PID:1152
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"84⤵PID:1012
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"85⤵PID:2732
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"86⤵PID:2580
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"87⤵
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"88⤵PID:1452
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"89⤵PID:2808
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"90⤵PID:3020
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"91⤵PID:1892
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"92⤵PID:868
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"93⤵PID:1124
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"94⤵PID:856
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"95⤵PID:976
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"96⤵PID:1964
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"97⤵PID:2396
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"98⤵
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"99⤵PID:1280
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"100⤵
- System Location Discovery: System Language Discovery
PID:560 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"101⤵
- System Location Discovery: System Language Discovery
PID:1288 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"102⤵PID:1656
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"103⤵PID:1744
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"104⤵PID:656
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"105⤵PID:884
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"106⤵PID:1496
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"107⤵PID:2876
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"108⤵PID:1988
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"109⤵PID:2620
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"110⤵PID:2240
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"111⤵PID:2552
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"112⤵PID:2924
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"113⤵PID:2496
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"114⤵PID:1356
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"115⤵PID:2004
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"116⤵PID:2376
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"117⤵PID:2668
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"118⤵PID:2428
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"119⤵PID:2932
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"120⤵
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"121⤵PID:2284
-
C:\Users\Admin\AppData\Local\snails\ectosphere.exe"C:\Users\Admin\AppData\Local\snails\ectosphere.exe"122⤵PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-