Analysis
-
max time kernel
25s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 02:54
Behavioral task
behavioral1
Sample
84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe
-
Size
393KB
-
MD5
a58fca2c4d0e6453e0d9e1bfb61ab130
-
SHA1
ec12b0634e736388ff42feede7806d8d5b5defc0
-
SHA256
84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bb
-
SHA512
481bb904cf09f6ac2020ea8e9cfc550173032ea87ff715e9b5a31371c225ce6a34c38cc985a3d4810863ff7240a5caf0ea4e16f8931e64c52c7fd3ae7ff36a7b
-
SSDEEP
3072:sr85CFCkxa43VhkK7fi8XKNy6ZWsIn0Bqem7J6R2xQkSrQr85Cxr85C:k93hVhdfi8RnZRem7wRmSrQ9N9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0006000000019223-2.dat family_neshta behavioral1/files/0x000b000000010326-17.dat family_neshta behavioral1/files/0x0007000000019230-16.dat family_neshta behavioral1/files/0x0001000000010319-20.dat family_neshta behavioral1/files/0x0001000000010317-19.dat family_neshta behavioral1/files/0x000100000001064f-18.dat family_neshta behavioral1/memory/2716-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2796-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2820-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2840-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1692-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2652-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1892-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2864-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1916-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2500-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1764-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2668-127-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2596-128-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f77c-145.dat family_neshta behavioral1/files/0x000100000000f7de-144.dat family_neshta behavioral1/files/0x000100000000f7d9-143.dat family_neshta behavioral1/memory/1700-162-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2300-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2428-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/848-175-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1552-188-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2160-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1016-209-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2320-222-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2988-221-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2484-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1996-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3044-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2900-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1168-278-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2080-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2456-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2720-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2684-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3032-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2060-321-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2864-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2044-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2356-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1484-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/780-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1772-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2068-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1888-364-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1952-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/604-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2920-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/408-380-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1572-379-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/940-392-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 1680 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 2796 svchost.com 2716 84841A~1.EXE 2820 svchost.com 2740 84841A~1.EXE 2840 svchost.com 2632 84841A~1.EXE 1692 svchost.com 2652 84841A~1.EXE 2864 svchost.com 1892 84841A~1.EXE 2432 svchost.com 1916 84841A~1.EXE 2500 svchost.com 1764 84841A~1.EXE 2596 svchost.com 2668 84841A~1.EXE 2300 svchost.com 1700 84841A~1.EXE 848 svchost.com 2428 84841A~1.EXE 2160 svchost.com 1552 84841A~1.EXE 1016 svchost.com 2168 84841A~1.EXE 2988 svchost.com 2320 84841A~1.EXE 2484 svchost.com 1996 84841A~1.EXE 3044 svchost.com 2936 84841A~1.EXE 1168 svchost.com 2900 84841A~1.EXE 2080 svchost.com 2456 84841A~1.EXE 2844 svchost.com 2720 84841A~1.EXE 2684 svchost.com 3032 84841A~1.EXE 2060 svchost.com 2864 84841A~1.EXE 2044 svchost.com 2356 84841A~1.EXE 1484 svchost.com 780 84841A~1.EXE 1772 svchost.com 2676 84841A~1.EXE 2648 svchost.com 2068 84841A~1.EXE 1888 svchost.com 1952 84841A~1.EXE 2920 svchost.com 604 84841A~1.EXE 408 svchost.com 1572 84841A~1.EXE 940 svchost.com 2260 84841A~1.EXE 1328 svchost.com 2972 84841A~1.EXE 1564 svchost.com 912 84841A~1.EXE 1944 svchost.com 2240 84841A~1.EXE 1780 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2368 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 2368 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 2796 svchost.com 2796 svchost.com 2820 svchost.com 2820 svchost.com 2840 svchost.com 2840 svchost.com 1692 svchost.com 1692 svchost.com 2864 svchost.com 2864 svchost.com 2432 svchost.com 2432 svchost.com 2500 svchost.com 2500 svchost.com 2596 svchost.com 2596 svchost.com 2300 svchost.com 2300 svchost.com 2368 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 1680 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 848 svchost.com 848 svchost.com 1680 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 2160 svchost.com 2160 svchost.com 1680 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 1016 svchost.com 1016 svchost.com 2368 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 2988 svchost.com 2988 svchost.com 2484 svchost.com 2484 svchost.com 3044 svchost.com 3044 svchost.com 1680 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 1168 svchost.com 1168 svchost.com 2080 svchost.com 2080 svchost.com 2844 svchost.com 2844 svchost.com 2684 svchost.com 2684 svchost.com 2060 svchost.com 2060 svchost.com 2044 svchost.com 2044 svchost.com 1484 svchost.com 1484 svchost.com 1772 svchost.com 1772 svchost.com 2648 svchost.com 2648 svchost.com 1888 svchost.com 1888 svchost.com 2920 svchost.com 2920 svchost.com 408 svchost.com 408 svchost.com 940 svchost.com 940 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 84841A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84841A~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1680 2368 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 30 PID 2368 wrote to memory of 1680 2368 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 30 PID 2368 wrote to memory of 1680 2368 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 30 PID 2368 wrote to memory of 1680 2368 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 30 PID 1680 wrote to memory of 2796 1680 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 31 PID 1680 wrote to memory of 2796 1680 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 31 PID 1680 wrote to memory of 2796 1680 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 31 PID 1680 wrote to memory of 2796 1680 84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe 31 PID 2796 wrote to memory of 2716 2796 svchost.com 32 PID 2796 wrote to memory of 2716 2796 svchost.com 32 PID 2796 wrote to memory of 2716 2796 svchost.com 32 PID 2796 wrote to memory of 2716 2796 svchost.com 32 PID 2716 wrote to memory of 2820 2716 84841A~1.EXE 33 PID 2716 wrote to memory of 2820 2716 84841A~1.EXE 33 PID 2716 wrote to memory of 2820 2716 84841A~1.EXE 33 PID 2716 wrote to memory of 2820 2716 84841A~1.EXE 33 PID 2820 wrote to memory of 2740 2820 svchost.com 34 PID 2820 wrote to memory of 2740 2820 svchost.com 34 PID 2820 wrote to memory of 2740 2820 svchost.com 34 PID 2820 wrote to memory of 2740 2820 svchost.com 34 PID 2740 wrote to memory of 2840 2740 84841A~1.EXE 35 PID 2740 wrote to memory of 2840 2740 84841A~1.EXE 35 PID 2740 wrote to memory of 2840 2740 84841A~1.EXE 35 PID 2740 wrote to memory of 2840 2740 84841A~1.EXE 35 PID 2840 wrote to memory of 2632 2840 svchost.com 36 PID 2840 wrote to memory of 2632 2840 svchost.com 36 PID 2840 wrote to memory of 2632 2840 svchost.com 36 PID 2840 wrote to memory of 2632 2840 svchost.com 36 PID 2632 wrote to memory of 1692 2632 84841A~1.EXE 37 PID 2632 wrote to memory of 1692 2632 84841A~1.EXE 37 PID 2632 wrote to memory of 1692 2632 84841A~1.EXE 37 PID 2632 wrote to memory of 1692 2632 84841A~1.EXE 37 PID 1692 wrote to memory of 2652 1692 svchost.com 38 PID 1692 wrote to memory of 2652 1692 svchost.com 38 PID 1692 wrote to memory of 2652 1692 svchost.com 38 PID 1692 wrote to memory of 2652 1692 svchost.com 38 PID 2652 wrote to memory of 2864 2652 84841A~1.EXE 70 PID 2652 wrote to memory of 2864 2652 84841A~1.EXE 70 PID 2652 wrote to memory of 2864 2652 84841A~1.EXE 70 PID 2652 wrote to memory of 2864 2652 84841A~1.EXE 70 PID 2864 wrote to memory of 1892 2864 svchost.com 40 PID 2864 wrote to memory of 1892 2864 svchost.com 40 PID 2864 wrote to memory of 1892 2864 svchost.com 40 PID 2864 wrote to memory of 1892 2864 svchost.com 40 PID 1892 wrote to memory of 2432 1892 84841A~1.EXE 41 PID 1892 wrote to memory of 2432 1892 84841A~1.EXE 41 PID 1892 wrote to memory of 2432 1892 84841A~1.EXE 41 PID 1892 wrote to memory of 2432 1892 84841A~1.EXE 41 PID 2432 wrote to memory of 1916 2432 svchost.com 42 PID 2432 wrote to memory of 1916 2432 svchost.com 42 PID 2432 wrote to memory of 1916 2432 svchost.com 42 PID 2432 wrote to memory of 1916 2432 svchost.com 42 PID 1916 wrote to memory of 2500 1916 84841A~1.EXE 43 PID 1916 wrote to memory of 2500 1916 84841A~1.EXE 43 PID 1916 wrote to memory of 2500 1916 84841A~1.EXE 43 PID 1916 wrote to memory of 2500 1916 84841A~1.EXE 43 PID 2500 wrote to memory of 1764 2500 svchost.com 120 PID 2500 wrote to memory of 1764 2500 svchost.com 120 PID 2500 wrote to memory of 1764 2500 svchost.com 120 PID 2500 wrote to memory of 1764 2500 svchost.com 120 PID 1764 wrote to memory of 2596 1764 84841A~1.EXE 45 PID 1764 wrote to memory of 2596 1764 84841A~1.EXE 45 PID 1764 wrote to memory of 2596 1764 84841A~1.EXE 45 PID 1764 wrote to memory of 2596 1764 84841A~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe"C:\Users\Admin\AppData\Local\Temp\84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\84841afcdc653d754748cf3f200ad7007d7d9adb01f123924172c407b333f1bbN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE18⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE22⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE26⤵
- Executes dropped EXE
PID:2168 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE30⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE32⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE34⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE36⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE38⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE42⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE44⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE46⤵
- Executes dropped EXE
PID:780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE48⤵
- Executes dropped EXE
PID:2676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE50⤵
- Executes dropped EXE
PID:2068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE52⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE60⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"61⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE62⤵
- Executes dropped EXE
PID:912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"63⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE64⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"65⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE66⤵PID:2980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"67⤵
- Drops file in Windows directory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE68⤵PID:2576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"69⤵
- Drops file in Windows directory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE70⤵PID:2444
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"71⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE72⤵PID:2364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"73⤵
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE74⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE76⤵PID:2960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"77⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE78⤵PID:2892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"79⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE80⤵PID:2776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"81⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE82⤵PID:2612
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"83⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE84⤵PID:3028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"85⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE86⤵PID:1672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"87⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE88⤵PID:1396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"89⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE90⤵PID:2032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"91⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE92⤵
- Drops file in Windows directory
PID:1764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"93⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE94⤵PID:996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"95⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE96⤵PID:1784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"97⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE98⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"99⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE100⤵PID:1724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"101⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE102⤵PID:2280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"103⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE104⤵PID:1000
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"105⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE106⤵PID:2160
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"107⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE108⤵PID:2984
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"109⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE110⤵
- Drops file in Windows directory
PID:3004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"111⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE112⤵PID:2988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"113⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE114⤵
- Drops file in Windows directory
PID:1988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"115⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE116⤵PID:1708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"117⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE118⤵PID:2752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"119⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE120⤵PID:2716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\84841A~1.EXE"121⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-