Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 10:01
Behavioral task
behavioral1
Sample
25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe
-
Size
6.0MB
-
MD5
174f775dd87640662954782a36a2ef10
-
SHA1
69dd7f4349caf7fbd4c3d1217af3b2a672a8f24c
-
SHA256
25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fc
-
SHA512
354eb11b0f9e457b701943767ecedfeb59bed1451f5b8614ea8810a2cf655ee2c8b4c9add98793df648c12ae451b2917b8ed1253524e845e4559b71806e09d6b
-
SSDEEP
98304:ln2pTIB5ICr7WUrkTj+vsW/Lzmma7CLP+LZU:R2p88IrvsW/LzJa7CT+LZU
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016d06-9.dat family_neshta behavioral1/files/0x0008000000016d0e-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x0001000000010738-18.dat family_neshta behavioral1/files/0x001400000000f841-17.dat family_neshta behavioral1/memory/2716-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2484-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-56.dat family_neshta behavioral1/files/0x000100000000f776-61.dat family_neshta behavioral1/files/0x000100000000f7d8-60.dat family_neshta behavioral1/files/0x000100000000f7ca-62.dat family_neshta behavioral1/files/0x000100000000f7e6-65.dat family_neshta behavioral1/files/0x000100000000f703-72.dat family_neshta behavioral1/files/0x000100000000f82d-73.dat family_neshta behavioral1/memory/2916-81-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-80-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010361-91.dat family_neshta behavioral1/memory/1932-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/296-98-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010c12-110.dat family_neshta behavioral1/files/0x0001000000010f30-129.dat family_neshta behavioral1/files/0x0001000000011876-131.dat family_neshta behavioral1/memory/1564-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1444-162-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/884-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1984-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1004-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2848-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2840-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1012-254-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1632-246-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2372-239-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1804-238-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1436-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1112-230-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2184-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/280-222-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1276-214-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2364-213-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/900-206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2104-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1964-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1608-196-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1296-189-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1968-188-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2160-178-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2420-170-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/264-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2392-278-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2904-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/808-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2424-153-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2880-144-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2992-143-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x00010000000117fc-128.dat family_neshta behavioral1/memory/2100-125-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2948-124-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2636-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2748-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2200-313-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2192-312-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 2716 svchost.com 2484 250292~1.EXE 2828 svchost.com 2784 250292~1.EXE 2916 svchost.com 2676 250292~1.EXE 1932 svchost.com 296 250292~1.EXE 2100 svchost.com 2948 250292~1.EXE 2992 svchost.com 2880 250292~1.EXE 1564 svchost.com 2424 250292~1.EXE 808 svchost.com 1444 250292~1.EXE 264 svchost.com 2420 250292~1.EXE 884 svchost.com 2160 250292~1.EXE 1968 svchost.com 1296 250292~1.EXE 1964 svchost.com 1608 250292~1.EXE 2104 svchost.com 900 250292~1.EXE 1276 svchost.com 2364 250292~1.EXE 280 svchost.com 2184 250292~1.EXE 1112 svchost.com 1436 250292~1.EXE 1804 svchost.com 2372 250292~1.EXE 1632 svchost.com 1984 250292~1.EXE 1004 svchost.com 1012 250292~1.EXE 2848 svchost.com 2840 250292~1.EXE 2392 svchost.com 2904 250292~1.EXE 2748 svchost.com 2636 250292~1.EXE 2200 svchost.com 2192 250292~1.EXE 2984 svchost.com 2812 250292~1.EXE 3048 svchost.com 2028 250292~1.EXE 1564 svchost.com 2428 250292~1.EXE 808 svchost.com 2088 250292~1.EXE 448 svchost.com 2108 250292~1.EXE 1968 svchost.com 2604 250292~1.EXE 1572 svchost.com 1596 250292~1.EXE 2056 svchost.com 1552 250292~1.EXE 1488 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 1640 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 1640 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 2716 svchost.com 2716 svchost.com 2828 svchost.com 2828 svchost.com 2916 svchost.com 2916 svchost.com 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 1640 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 1932 svchost.com 1932 svchost.com 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 2100 svchost.com 2100 svchost.com 2992 svchost.com 2992 svchost.com 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 1564 svchost.com 1564 svchost.com 808 svchost.com 808 svchost.com 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 264 svchost.com 264 svchost.com 884 svchost.com 884 svchost.com 1968 svchost.com 1968 svchost.com 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 1964 svchost.com 1964 svchost.com 2104 svchost.com 2104 svchost.com 1276 svchost.com 1276 svchost.com 280 svchost.com 280 svchost.com 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 1112 svchost.com 1112 svchost.com 1804 svchost.com 1804 svchost.com 1632 svchost.com 1632 svchost.com 1004 svchost.com 1004 svchost.com 2848 svchost.com 2848 svchost.com 2392 svchost.com 2392 svchost.com 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 2748 svchost.com 2748 svchost.com 2200 svchost.com 2200 svchost.com 2984 svchost.com 2984 svchost.com 3048 svchost.com 3048 svchost.com 1564 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\directx.sys 250292~1.EXE File opened for modification C:\Windows\svchost.com 250292~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250292~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1740 1640 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 30 PID 1640 wrote to memory of 1740 1640 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 30 PID 1640 wrote to memory of 1740 1640 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 30 PID 1640 wrote to memory of 1740 1640 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 30 PID 1740 wrote to memory of 2716 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 31 PID 1740 wrote to memory of 2716 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 31 PID 1740 wrote to memory of 2716 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 31 PID 1740 wrote to memory of 2716 1740 25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe 31 PID 2716 wrote to memory of 2484 2716 svchost.com 32 PID 2716 wrote to memory of 2484 2716 svchost.com 32 PID 2716 wrote to memory of 2484 2716 svchost.com 32 PID 2716 wrote to memory of 2484 2716 svchost.com 32 PID 2484 wrote to memory of 2828 2484 250292~1.EXE 33 PID 2484 wrote to memory of 2828 2484 250292~1.EXE 33 PID 2484 wrote to memory of 2828 2484 250292~1.EXE 33 PID 2484 wrote to memory of 2828 2484 250292~1.EXE 33 PID 2828 wrote to memory of 2784 2828 svchost.com 34 PID 2828 wrote to memory of 2784 2828 svchost.com 34 PID 2828 wrote to memory of 2784 2828 svchost.com 34 PID 2828 wrote to memory of 2784 2828 svchost.com 34 PID 2784 wrote to memory of 2916 2784 250292~1.EXE 115 PID 2784 wrote to memory of 2916 2784 250292~1.EXE 115 PID 2784 wrote to memory of 2916 2784 250292~1.EXE 115 PID 2784 wrote to memory of 2916 2784 250292~1.EXE 115 PID 2916 wrote to memory of 2676 2916 svchost.com 36 PID 2916 wrote to memory of 2676 2916 svchost.com 36 PID 2916 wrote to memory of 2676 2916 svchost.com 36 PID 2916 wrote to memory of 2676 2916 svchost.com 36 PID 2676 wrote to memory of 1932 2676 250292~1.EXE 118 PID 2676 wrote to memory of 1932 2676 250292~1.EXE 118 PID 2676 wrote to memory of 1932 2676 250292~1.EXE 118 PID 2676 wrote to memory of 1932 2676 250292~1.EXE 118 PID 1932 wrote to memory of 296 1932 svchost.com 38 PID 1932 wrote to memory of 296 1932 svchost.com 38 PID 1932 wrote to memory of 296 1932 svchost.com 38 PID 1932 wrote to memory of 296 1932 svchost.com 38 PID 296 wrote to memory of 2100 296 250292~1.EXE 39 PID 296 wrote to memory of 2100 296 250292~1.EXE 39 PID 296 wrote to memory of 2100 296 250292~1.EXE 39 PID 296 wrote to memory of 2100 296 250292~1.EXE 39 PID 2100 wrote to memory of 2948 2100 svchost.com 40 PID 2100 wrote to memory of 2948 2100 svchost.com 40 PID 2100 wrote to memory of 2948 2100 svchost.com 40 PID 2100 wrote to memory of 2948 2100 svchost.com 40 PID 2948 wrote to memory of 2992 2948 250292~1.EXE 41 PID 2948 wrote to memory of 2992 2948 250292~1.EXE 41 PID 2948 wrote to memory of 2992 2948 250292~1.EXE 41 PID 2948 wrote to memory of 2992 2948 250292~1.EXE 41 PID 2992 wrote to memory of 2880 2992 svchost.com 42 PID 2992 wrote to memory of 2880 2992 svchost.com 42 PID 2992 wrote to memory of 2880 2992 svchost.com 42 PID 2992 wrote to memory of 2880 2992 svchost.com 42 PID 2880 wrote to memory of 1564 2880 250292~1.EXE 81 PID 2880 wrote to memory of 1564 2880 250292~1.EXE 81 PID 2880 wrote to memory of 1564 2880 250292~1.EXE 81 PID 2880 wrote to memory of 1564 2880 250292~1.EXE 81 PID 1564 wrote to memory of 2424 1564 svchost.com 44 PID 1564 wrote to memory of 2424 1564 svchost.com 44 PID 1564 wrote to memory of 2424 1564 svchost.com 44 PID 1564 wrote to memory of 2424 1564 svchost.com 44 PID 2424 wrote to memory of 808 2424 250292~1.EXE 83 PID 2424 wrote to memory of 808 2424 250292~1.EXE 83 PID 2424 wrote to memory of 808 2424 250292~1.EXE 83 PID 2424 wrote to memory of 808 2424 250292~1.EXE 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe"C:\Users\Admin\AppData\Local\Temp\25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\25029227bd78160534f9662e402690a90741824dbe6bcda1c5935a4e83b1e4fcN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE18⤵
- Executes dropped EXE
PID:1444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE20⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE22⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE24⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE28⤵
- Executes dropped EXE
PID:900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE30⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE32⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE34⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE36⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE38⤵
- Executes dropped EXE
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE42⤵
- Executes dropped EXE
PID:2840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE44⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE46⤵
- Executes dropped EXE
PID:2636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE50⤵
- Executes dropped EXE
PID:2812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE52⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE54⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"55⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE56⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"57⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE58⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"59⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE60⤵
- Executes dropped EXE
PID:2604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"61⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE62⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"63⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE64⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"65⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE66⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"67⤵
- Drops file in Windows directory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE68⤵PID:2076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"69⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE70⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"71⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE72⤵PID:1144
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"73⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE74⤵PID:2788
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"75⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE76⤵PID:2836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"77⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE78⤵PID:2900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"79⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE80⤵PID:748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"81⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE82⤵PID:1536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"83⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE84⤵
- Drops file in Windows directory
PID:2656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"85⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE86⤵PID:1924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"87⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE88⤵PID:668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"89⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE90⤵PID:1932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"91⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE92⤵PID:2452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"93⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE94⤵PID:3036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"95⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE96⤵
- Drops file in Windows directory
PID:2116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"97⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE98⤵
- System Location Discovery: System Language Discovery
PID:484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"99⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE100⤵PID:2944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"101⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE102⤵
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE104⤵
- Drops file in Windows directory
PID:1856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"105⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE106⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"107⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE108⤵
- Drops file in Windows directory
PID:2104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"109⤵
- Drops file in Windows directory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE110⤵PID:1596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"111⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"113⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE114⤵PID:1620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"115⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE116⤵PID:2160
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"117⤵
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE118⤵PID:2928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"119⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE120⤵
- Drops file in Windows directory
PID:1148 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\250292~1.EXE"121⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-