Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-12-2024 19:41
Behavioral task
behavioral1
Sample
0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe
-
Size
179KB
-
MD5
458e8e33ac9c9da78555f94022175df8
-
SHA1
4e7aa7d636d4beffc950d4d1a98cd1afffdf445b
-
SHA256
0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7
-
SHA512
62fd8869853c1016deee0851b074f95c9affd9d95aed56347da01c0118275de47c393855f4eb3714f65502a9c3498caa5a25a1f5fd9dd5f0270c4d36a523ca19
-
SSDEEP
3072:sr85C1IXNLM69x07Jb00PAqPtHr85Cxr85C:k91icJzXFL9N9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000015d07-11.dat family_neshta behavioral1/files/0x0008000000015d19-16.dat family_neshta behavioral1/files/0x0001000000010318-20.dat family_neshta behavioral1/files/0x0001000000010316-19.dat family_neshta behavioral1/files/0x001400000000f842-18.dat family_neshta behavioral1/files/0x005b00000001032b-17.dat family_neshta behavioral1/memory/2824-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2572-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2604-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2080-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2420-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3032-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2760-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2052-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2376-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7dd-99.dat family_neshta behavioral1/files/0x000100000000f7cf-106.dat family_neshta behavioral1/files/0x000100000000f77b-102.dat family_neshta behavioral1/files/0x000100000000f7eb-107.dat family_neshta behavioral1/memory/1884-116-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/780-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f877-132.dat family_neshta behavioral1/files/0x0001000000010b98-134.dat family_neshta behavioral1/memory/1656-141-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1860-140-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2512-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2368-155-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2092-170-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2280-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/688-183-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2448-182-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/864-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2064-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1844-214-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1476-215-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1576-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2320-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1904-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1336-232-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1524-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2696-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-268-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2572-267-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2584-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1592-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1120-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3008-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2796-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1924-305-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1064-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2384-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/332-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1884-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2800-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1572-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/628-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2116-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1656-359-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1888-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/444-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2236-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2828 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 2824 svchost.com 2572 0F131A~1.EXE 2648 svchost.com 2604 0F131A~1.EXE 2080 svchost.com 2420 0F131A~1.EXE 2760 svchost.com 3032 0F131A~1.EXE 2376 svchost.com 2052 0F131A~1.EXE 780 svchost.com 1884 0F131A~1.EXE 1656 svchost.com 1860 0F131A~1.EXE 2512 svchost.com 2368 0F131A~1.EXE 2092 svchost.com 2280 0F131A~1.EXE 688 svchost.com 2448 0F131A~1.EXE 864 svchost.com 2064 0F131A~1.EXE 1476 svchost.com 1844 0F131A~1.EXE 1576 svchost.com 2320 0F131A~1.EXE 1904 svchost.com 1336 0F131A~1.EXE 1524 svchost.com 2696 0F131A~1.EXE 2676 svchost.com 2572 0F131A~1.EXE 2584 svchost.com 1592 0F131A~1.EXE 1120 svchost.com 3008 0F131A~1.EXE 1924 svchost.com 2796 0F131A~1.EXE 2784 svchost.com 1064 0F131A~1.EXE 2384 svchost.com 332 0F131A~1.EXE 2800 svchost.com 1884 0F131A~1.EXE 1572 svchost.com 628 0F131A~1.EXE 2936 svchost.com 2116 0F131A~1.EXE 1656 svchost.com 1888 0F131A~1.EXE 2236 svchost.com 444 0F131A~1.EXE 2120 svchost.com 2744 0F131A~1.EXE 1180 svchost.com 1596 0F131A~1.EXE 1208 svchost.com 1260 0F131A~1.EXE 2216 svchost.com 1916 0F131A~1.EXE 588 svchost.com 2964 0F131A~1.EXE 1668 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2112 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 2112 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 2824 svchost.com 2824 svchost.com 2648 svchost.com 2648 svchost.com 2080 svchost.com 2080 svchost.com 2760 svchost.com 2760 svchost.com 2376 svchost.com 2376 svchost.com 780 svchost.com 780 svchost.com 2828 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 2112 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 1656 svchost.com 1656 svchost.com 2512 svchost.com 2512 svchost.com 2092 svchost.com 2092 svchost.com 688 svchost.com 688 svchost.com 864 svchost.com 864 svchost.com 2828 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 1476 svchost.com 1476 svchost.com 1576 svchost.com 1576 svchost.com 1904 svchost.com 1904 svchost.com 1524 svchost.com 1524 svchost.com 2676 svchost.com 2676 svchost.com 2584 svchost.com 2584 svchost.com 1120 svchost.com 1120 svchost.com 1924 svchost.com 1924 svchost.com 2784 svchost.com 2784 svchost.com 2384 svchost.com 2384 svchost.com 2800 svchost.com 2800 svchost.com 1572 svchost.com 1572 svchost.com 2936 svchost.com 2936 svchost.com 1656 svchost.com 1656 svchost.com 2236 svchost.com 2236 svchost.com 2120 svchost.com 2120 svchost.com 1180 svchost.com 1180 svchost.com 1208 svchost.com 1208 svchost.com 2216 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\directx.sys 0F131A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\svchost.com 0F131A~1.EXE File opened for modification C:\Windows\directx.sys 0F131A~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0F131A~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2828 2112 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 31 PID 2112 wrote to memory of 2828 2112 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 31 PID 2112 wrote to memory of 2828 2112 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 31 PID 2112 wrote to memory of 2828 2112 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 31 PID 2828 wrote to memory of 2824 2828 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 32 PID 2828 wrote to memory of 2824 2828 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 32 PID 2828 wrote to memory of 2824 2828 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 32 PID 2828 wrote to memory of 2824 2828 0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe 32 PID 2824 wrote to memory of 2572 2824 svchost.com 33 PID 2824 wrote to memory of 2572 2824 svchost.com 33 PID 2824 wrote to memory of 2572 2824 svchost.com 33 PID 2824 wrote to memory of 2572 2824 svchost.com 33 PID 2572 wrote to memory of 2648 2572 0F131A~1.EXE 34 PID 2572 wrote to memory of 2648 2572 0F131A~1.EXE 34 PID 2572 wrote to memory of 2648 2572 0F131A~1.EXE 34 PID 2572 wrote to memory of 2648 2572 0F131A~1.EXE 34 PID 2648 wrote to memory of 2604 2648 svchost.com 35 PID 2648 wrote to memory of 2604 2648 svchost.com 35 PID 2648 wrote to memory of 2604 2648 svchost.com 35 PID 2648 wrote to memory of 2604 2648 svchost.com 35 PID 2604 wrote to memory of 2080 2604 0F131A~1.EXE 36 PID 2604 wrote to memory of 2080 2604 0F131A~1.EXE 36 PID 2604 wrote to memory of 2080 2604 0F131A~1.EXE 36 PID 2604 wrote to memory of 2080 2604 0F131A~1.EXE 36 PID 2080 wrote to memory of 2420 2080 svchost.com 37 PID 2080 wrote to memory of 2420 2080 svchost.com 37 PID 2080 wrote to memory of 2420 2080 svchost.com 37 PID 2080 wrote to memory of 2420 2080 svchost.com 37 PID 2420 wrote to memory of 2760 2420 0F131A~1.EXE 38 PID 2420 wrote to memory of 2760 2420 0F131A~1.EXE 38 PID 2420 wrote to memory of 2760 2420 0F131A~1.EXE 38 PID 2420 wrote to memory of 2760 2420 0F131A~1.EXE 38 PID 2760 wrote to memory of 3032 2760 svchost.com 39 PID 2760 wrote to memory of 3032 2760 svchost.com 39 PID 2760 wrote to memory of 3032 2760 svchost.com 39 PID 2760 wrote to memory of 3032 2760 svchost.com 39 PID 3032 wrote to memory of 2376 3032 0F131A~1.EXE 40 PID 3032 wrote to memory of 2376 3032 0F131A~1.EXE 40 PID 3032 wrote to memory of 2376 3032 0F131A~1.EXE 40 PID 3032 wrote to memory of 2376 3032 0F131A~1.EXE 40 PID 2376 wrote to memory of 2052 2376 svchost.com 41 PID 2376 wrote to memory of 2052 2376 svchost.com 41 PID 2376 wrote to memory of 2052 2376 svchost.com 41 PID 2376 wrote to memory of 2052 2376 svchost.com 41 PID 2052 wrote to memory of 780 2052 0F131A~1.EXE 42 PID 2052 wrote to memory of 780 2052 0F131A~1.EXE 42 PID 2052 wrote to memory of 780 2052 0F131A~1.EXE 42 PID 2052 wrote to memory of 780 2052 0F131A~1.EXE 42 PID 780 wrote to memory of 1884 780 svchost.com 75 PID 780 wrote to memory of 1884 780 svchost.com 75 PID 780 wrote to memory of 1884 780 svchost.com 75 PID 780 wrote to memory of 1884 780 svchost.com 75 PID 1884 wrote to memory of 1656 1884 0F131A~1.EXE 80 PID 1884 wrote to memory of 1656 1884 0F131A~1.EXE 80 PID 1884 wrote to memory of 1656 1884 0F131A~1.EXE 80 PID 1884 wrote to memory of 1656 1884 0F131A~1.EXE 80 PID 1656 wrote to memory of 1860 1656 svchost.com 45 PID 1656 wrote to memory of 1860 1656 svchost.com 45 PID 1656 wrote to memory of 1860 1656 svchost.com 45 PID 1656 wrote to memory of 1860 1656 svchost.com 45 PID 1860 wrote to memory of 2512 1860 0F131A~1.EXE 46 PID 1860 wrote to memory of 2512 1860 0F131A~1.EXE 46 PID 1860 wrote to memory of 2512 1860 0F131A~1.EXE 46 PID 1860 wrote to memory of 2512 1860 0F131A~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe"C:\Users\Admin\AppData\Local\Temp\0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\0f131a28e891367b93ee90164dc65824cc9aa185851ae8257dd92c79a35e72f7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE18⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE20⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE22⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE24⤵
- Executes dropped EXE
PID:2064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE30⤵
- Executes dropped EXE
PID:1336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE32⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE34⤵
- Executes dropped EXE
PID:2572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE36⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE38⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE40⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE44⤵
- Executes dropped EXE
PID:332 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE46⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE48⤵
- Executes dropped EXE
PID:628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE50⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE54⤵
- Executes dropped EXE
PID:444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE56⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE58⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE60⤵
- Executes dropped EXE
PID:1260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE62⤵
- Executes dropped EXE
PID:1916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"65⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE66⤵
- Drops file in Windows directory
PID:1556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"67⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE68⤵PID:1436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"69⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE70⤵PID:2344
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"71⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE72⤵PID:1524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"73⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE74⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"75⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE76⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"77⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE78⤵PID:1472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"79⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE80⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"81⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE82⤵PID:1432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"83⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE84⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"85⤵
- Drops file in Windows directory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE86⤵
- Drops file in Windows directory
PID:760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"87⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE88⤵
- Drops file in Windows directory
PID:1636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"89⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE90⤵
- Drops file in Windows directory
PID:1880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"91⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE92⤵PID:1968
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"93⤵
- Drops file in Windows directory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE94⤵PID:1380
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"95⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE96⤵PID:1888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"97⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE98⤵PID:2340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"99⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE100⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"101⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE102⤵PID:1180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"103⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE104⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"105⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE106⤵
- Drops file in Windows directory
PID:2336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"107⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE108⤵
- Drops file in Windows directory
PID:3036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"109⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE110⤵PID:1500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"111⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE112⤵PID:1632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"113⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE114⤵PID:2556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"115⤵
- Drops file in Windows directory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE116⤵PID:1648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"117⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE118⤵PID:2532
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"119⤵
- System Location Discovery: System Language Discovery
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE120⤵
- Drops file in Windows directory
PID:2196 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F131A~1.EXE"121⤵PID:1872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-