Analysis
-
max time kernel
37s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 04:25
Behavioral task
behavioral1
Sample
f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe
-
Size
6.9MB
-
MD5
18719c6cbf0bd5fa2c6a1db3da4259f0
-
SHA1
5def71b31ede252620c75a40fb308d4a4a1d448f
-
SHA256
f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8
-
SHA512
8a16809d454b5d6e90fc9b4a13b4418996d16518e55019ac7665ed9ddc277724b1e9859c17210df34fa659d0e72041fd5c882b2eaacfafb8f5bbe1ce5d14ba9c
-
SSDEEP
196608:S9OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:Nz5x7jLXkmkU4cFe
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x00080000000162e4-2.dat family_neshta behavioral1/files/0x0013000000010321-17.dat family_neshta behavioral1/files/0x0008000000016399-20.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x000f00000001033a-16.dat family_neshta behavioral1/memory/2328-38-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2880-37-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2240-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2660-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2636-81-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2500-80-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-84.dat family_neshta behavioral1/memory/1824-97-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7e6-107.dat family_neshta behavioral1/files/0x000100000000f7ca-106.dat family_neshta behavioral1/files/0x000100000000f703-125.dat family_neshta behavioral1/files/0x000100000000f82d-128.dat family_neshta behavioral1/memory/584-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1992-121-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f776-105.dat family_neshta behavioral1/files/0x000100000000f7d8-104.dat family_neshta behavioral1/memory/1108-96-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2424-163-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1988-162-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82e-130.dat family_neshta behavioral1/memory/1924-177-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/772-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-187-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2028-188-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3044-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1788-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1104-192-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1236-211-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1828-212-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2268-237-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-236-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-245-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2988-244-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1704-252-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/812-266-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2872-265-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2328-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2836-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2908-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2772-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2744-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1864-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2228-306-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1876-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1756-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/588-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2820-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2928-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/264-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1628-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2188-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2948-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 2328 svchost.com 2880 F3F038~1.EXE 2712 svchost.com 2240 F3F038~1.EXE 2972 svchost.com 2660 F3F038~1.EXE 2636 svchost.com 2500 F3F038~1.EXE 1824 svchost.com 1108 F3F038~1.EXE 584 svchost.com 1992 F3F038~1.EXE 2424 svchost.com 1988 F3F038~1.EXE 1788 svchost.com 1924 F3F038~1.EXE 2784 svchost.com 2028 F3F038~1.EXE 1104 svchost.com 2844 F3F038~1.EXE 1828 svchost.com 1236 F3F038~1.EXE 2268 svchost.com 2224 F3F038~1.EXE 2988 svchost.com 1712 F3F038~1.EXE 2688 svchost.com 1704 F3F038~1.EXE 812 svchost.com 2872 F3F038~1.EXE 2328 svchost.com 2836 F3F038~1.EXE 2908 svchost.com 2772 F3F038~1.EXE 2744 svchost.com 2972 F3F038~1.EXE 2228 svchost.com 1864 F3F038~1.EXE 1756 svchost.com 1876 F3F038~1.EXE 2820 svchost.com 588 F3F038~1.EXE 264 svchost.com 2928 F3F038~1.EXE 1628 svchost.com 2808 F3F038~1.EXE 2948 svchost.com 2188 F3F038~1.EXE 2432 svchost.com 2084 F3F038~1.EXE 2384 svchost.com 2152 F3F038~1.EXE 2036 svchost.com 1980 F3F038~1.EXE 1520 svchost.com 1364 F3F038~1.EXE 2136 svchost.com 2192 F3F038~1.EXE 2184 svchost.com 956 F3F038~1.EXE 1912 svchost.com 2576 F3F038~1.EXE 2320 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 3044 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 3044 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 2328 svchost.com 2328 svchost.com 2712 svchost.com 2712 svchost.com 2972 svchost.com 2972 svchost.com 2636 svchost.com 2636 svchost.com 1824 svchost.com 1824 svchost.com 584 svchost.com 584 svchost.com 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 3044 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 2424 svchost.com 2424 svchost.com 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 1788 svchost.com 1788 svchost.com 2784 svchost.com 2784 svchost.com 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 1104 svchost.com 1104 svchost.com 1828 svchost.com 1828 svchost.com 2268 svchost.com 2268 svchost.com 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 2988 svchost.com 2988 svchost.com 2688 svchost.com 2688 svchost.com 812 svchost.com 812 svchost.com 2328 svchost.com 2328 svchost.com 2908 svchost.com 2908 svchost.com 2744 svchost.com 2744 svchost.com 2228 svchost.com 2228 svchost.com 1756 svchost.com 1756 svchost.com 2820 svchost.com 2820 svchost.com 264 svchost.com 264 svchost.com 1628 svchost.com 1628 svchost.com 2948 svchost.com 2948 svchost.com 2432 svchost.com 2432 svchost.com 2384 svchost.com 2384 svchost.com 2036 svchost.com 2036 svchost.com 1520 svchost.com 1520 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com F3F038~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\directx.sys F3F038~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F3F038~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F038~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 772 3044 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 30 PID 3044 wrote to memory of 772 3044 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 30 PID 3044 wrote to memory of 772 3044 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 30 PID 3044 wrote to memory of 772 3044 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 30 PID 772 wrote to memory of 2328 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 61 PID 772 wrote to memory of 2328 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 61 PID 772 wrote to memory of 2328 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 61 PID 772 wrote to memory of 2328 772 f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe 61 PID 2328 wrote to memory of 2880 2328 svchost.com 32 PID 2328 wrote to memory of 2880 2328 svchost.com 32 PID 2328 wrote to memory of 2880 2328 svchost.com 32 PID 2328 wrote to memory of 2880 2328 svchost.com 32 PID 2880 wrote to memory of 2712 2880 F3F038~1.EXE 33 PID 2880 wrote to memory of 2712 2880 F3F038~1.EXE 33 PID 2880 wrote to memory of 2712 2880 F3F038~1.EXE 33 PID 2880 wrote to memory of 2712 2880 F3F038~1.EXE 33 PID 2712 wrote to memory of 2240 2712 svchost.com 34 PID 2712 wrote to memory of 2240 2712 svchost.com 34 PID 2712 wrote to memory of 2240 2712 svchost.com 34 PID 2712 wrote to memory of 2240 2712 svchost.com 34 PID 2240 wrote to memory of 2972 2240 F3F038~1.EXE 66 PID 2240 wrote to memory of 2972 2240 F3F038~1.EXE 66 PID 2240 wrote to memory of 2972 2240 F3F038~1.EXE 66 PID 2240 wrote to memory of 2972 2240 F3F038~1.EXE 66 PID 2972 wrote to memory of 2660 2972 svchost.com 36 PID 2972 wrote to memory of 2660 2972 svchost.com 36 PID 2972 wrote to memory of 2660 2972 svchost.com 36 PID 2972 wrote to memory of 2660 2972 svchost.com 36 PID 2660 wrote to memory of 2636 2660 F3F038~1.EXE 37 PID 2660 wrote to memory of 2636 2660 F3F038~1.EXE 37 PID 2660 wrote to memory of 2636 2660 F3F038~1.EXE 37 PID 2660 wrote to memory of 2636 2660 F3F038~1.EXE 37 PID 2636 wrote to memory of 2500 2636 svchost.com 38 PID 2636 wrote to memory of 2500 2636 svchost.com 38 PID 2636 wrote to memory of 2500 2636 svchost.com 38 PID 2636 wrote to memory of 2500 2636 svchost.com 38 PID 2500 wrote to memory of 1824 2500 F3F038~1.EXE 39 PID 2500 wrote to memory of 1824 2500 F3F038~1.EXE 39 PID 2500 wrote to memory of 1824 2500 F3F038~1.EXE 39 PID 2500 wrote to memory of 1824 2500 F3F038~1.EXE 39 PID 1824 wrote to memory of 1108 1824 svchost.com 40 PID 1824 wrote to memory of 1108 1824 svchost.com 40 PID 1824 wrote to memory of 1108 1824 svchost.com 40 PID 1824 wrote to memory of 1108 1824 svchost.com 40 PID 1108 wrote to memory of 584 1108 F3F038~1.EXE 41 PID 1108 wrote to memory of 584 1108 F3F038~1.EXE 41 PID 1108 wrote to memory of 584 1108 F3F038~1.EXE 41 PID 1108 wrote to memory of 584 1108 F3F038~1.EXE 41 PID 584 wrote to memory of 1992 584 svchost.com 42 PID 584 wrote to memory of 1992 584 svchost.com 42 PID 584 wrote to memory of 1992 584 svchost.com 42 PID 584 wrote to memory of 1992 584 svchost.com 42 PID 1992 wrote to memory of 2424 1992 F3F038~1.EXE 43 PID 1992 wrote to memory of 2424 1992 F3F038~1.EXE 43 PID 1992 wrote to memory of 2424 1992 F3F038~1.EXE 43 PID 1992 wrote to memory of 2424 1992 F3F038~1.EXE 43 PID 2424 wrote to memory of 1988 2424 svchost.com 44 PID 2424 wrote to memory of 1988 2424 svchost.com 44 PID 2424 wrote to memory of 1988 2424 svchost.com 44 PID 2424 wrote to memory of 1988 2424 svchost.com 44 PID 1988 wrote to memory of 1788 1988 F3F038~1.EXE 45 PID 1988 wrote to memory of 1788 1988 F3F038~1.EXE 45 PID 1988 wrote to memory of 1788 1988 F3F038~1.EXE 45 PID 1988 wrote to memory of 1788 1988 F3F038~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe"C:\Users\Admin\AppData\Local\Temp\f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\f3f0383273316e88023ceccf908bf0ae1043f4d789b99b19b22da3508695ded8N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE20⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE22⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1236 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE26⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE30⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE32⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE34⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE36⤵
- Executes dropped EXE
PID:2772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE38⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE40⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE42⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE44⤵
- Executes dropped EXE
PID:588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE46⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE50⤵
- Executes dropped EXE
PID:2188 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE54⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE56⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE58⤵
- Executes dropped EXE
PID:1364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"59⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE60⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"61⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE62⤵
- Executes dropped EXE
PID:956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"63⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE64⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"65⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE66⤵PID:908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"67⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE68⤵PID:1236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"69⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE70⤵
- Drops file in Windows directory
PID:1588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"71⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE72⤵PID:2472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"73⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE74⤵PID:884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"75⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE76⤵
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"77⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE78⤵PID:2344
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"79⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE80⤵PID:2876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"81⤵
- Drops file in Windows directory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE82⤵PID:2232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"83⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE84⤵
- System Location Discovery: System Language Discovery
PID:488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"85⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE86⤵PID:2620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"87⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE88⤵PID:2680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"89⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE90⤵PID:1864
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"91⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE92⤵PID:592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"93⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE94⤵PID:588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"95⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE96⤵PID:2932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"97⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE98⤵PID:2720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"99⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE100⤵
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"101⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE102⤵PID:2248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE104⤵PID:1664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"105⤵
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE106⤵PID:1384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"107⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE108⤵
- Drops file in Windows directory
PID:3020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"109⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE110⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"111⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE112⤵PID:1872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"113⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE114⤵PID:2320
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"115⤵
- Drops file in Windows directory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE116⤵PID:1828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"117⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE118⤵PID:1352
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"119⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE120⤵PID:3028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F3F038~1.EXE"121⤵PID:2268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-