Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-01-2025 21:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe
-
Size
257KB
-
MD5
a21a10aa6027254a8d1e38e060215ac3
-
SHA1
58af229abb8ec4fbed29c012f07d4b56e7409433
-
SHA256
258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b
-
SHA512
65d08842968272d2c0c1f01fbd1d6dcb05b6213fc597439a76831b02c2dae2e41a5bc23cf46a0fb918cf5c279a9f4bec0ad0f036f6e9bce3ac5f256bb0907f07
-
SSDEEP
6144:jyH7xOc6H5c6HcT66vlmrEbAMpgY3gTH8DRBUeRUqptyH7xOc6H5c6HcT66vlmrM:ja6+Me7ale0
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x000b000000015d81-10.dat family_neshta behavioral1/files/0x0007000000016031-43.dat family_neshta behavioral1/files/0x0001000000010314-57.dat family_neshta behavioral1/files/0x0001000000010312-56.dat family_neshta behavioral1/files/0x0007000000010348-55.dat family_neshta behavioral1/files/0x0007000000016140-53.dat family_neshta behavioral1/memory/2600-67-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1240-66-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2932-80-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2860-81-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1280-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2728-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1756-109-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1220-108-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f776-121.dat family_neshta behavioral1/files/0x0001000000010370-142.dat family_neshta behavioral1/files/0x000100000000f872-139.dat family_neshta behavioral1/files/0x000100000000f82e-138.dat family_neshta behavioral1/files/0x000100000000f82d-137.dat family_neshta behavioral1/files/0x000100000000f703-136.dat family_neshta behavioral1/memory/692-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2864-154-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000011a18-151.dat family_neshta behavioral1/memory/2424-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2112-168-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/888-183-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/904-182-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/752-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/956-200-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2476-234-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3044-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2448-241-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1716-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2764-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2960-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1512-268-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2732-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2588-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/828-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2008-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1116-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3040-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3048-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2640-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2064-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1428-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1220-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2816-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/316-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1676-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1852-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1212-365-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1900-364-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/900-373-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2388-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1960-381-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2772 svchost.exe 2692 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2844 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2564 svchost.exe 2708 svchost.exe 2596 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2600 svchost.com 1240 258DF3~1.EXE 2860 svchost.com 2932 258DF3~1.EXE 1280 svchost.com 2728 258DF3~1.EXE 1220 svchost.com 1756 258DF3~1.EXE 692 svchost.com 2864 258DF3~1.EXE 2112 svchost.com 2424 258DF3~1.EXE 904 svchost.com 888 258DF3~1.EXE 956 svchost.com 752 258DF3~1.EXE 1712 svchost.com 2476 258DF3~1.EXE 2448 svchost.com 3044 258DF3~1.EXE 1716 svchost.com 2764 258DF3~1.EXE 1512 svchost.com 2960 258DF3~1.EXE 2732 svchost.com 2716 258DF3~1.EXE 2564 svchost.com 2588 258DF3~1.EXE 2620 svchost.com 828 258DF3~1.EXE 2008 svchost.com 2360 258DF3~1.EXE 1116 svchost.com 3040 258DF3~1.EXE 3048 svchost.com 1708 258DF3~1.EXE 2640 svchost.com 2064 258DF3~1.EXE 1428 svchost.com 2432 258DF3~1.EXE 1220 svchost.com 2816 258DF3~1.EXE 2808 svchost.com 316 258DF3~1.EXE 1852 svchost.com 1676 258DF3~1.EXE 1212 svchost.com 1900 258DF3~1.EXE 900 svchost.com 2388 258DF3~1.EXE 392 svchost.com 1960 258DF3~1.EXE 1536 svchost.com 2488 258DF3~1.EXE 824 svchost.com 892 258DF3~1.EXE 1372 svchost.com 752 258DF3~1.EXE -
Loads dropped DLL 64 IoCs
pid Process 2772 svchost.exe 2772 svchost.exe 2692 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2692 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2564 svchost.exe 2564 svchost.exe 2596 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2600 svchost.com 2600 svchost.com 2860 svchost.com 2860 svchost.com 1280 svchost.com 1280 svchost.com 1220 svchost.com 1220 svchost.com 692 svchost.com 692 svchost.com 2596 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2692 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2112 svchost.com 2112 svchost.com 904 svchost.com 904 svchost.com 956 svchost.com 956 svchost.com 2596 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 1712 svchost.com 1712 svchost.com 2448 svchost.com 2448 svchost.com 1716 svchost.com 1716 svchost.com 1512 svchost.com 1512 svchost.com 2732 svchost.com 2732 svchost.com 2564 svchost.com 2564 svchost.com 2620 svchost.com 2620 svchost.com 2008 svchost.com 2008 svchost.com 1116 svchost.com 1116 svchost.com 3048 svchost.com 3048 svchost.com 2640 svchost.com 2640 svchost.com 1428 svchost.com 1428 svchost.com 1220 svchost.com 1220 svchost.com 2808 svchost.com 2808 svchost.com 1852 svchost.com 1852 svchost.com 1212 svchost.com 1212 svchost.com 900 svchost.com 900 svchost.com 392 svchost.com 392 svchost.com 1536 svchost.com 1536 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2772 2672 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 31 PID 2672 wrote to memory of 2772 2672 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 31 PID 2672 wrote to memory of 2772 2672 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 31 PID 2672 wrote to memory of 2772 2672 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 31 PID 2772 wrote to memory of 2692 2772 svchost.exe 32 PID 2772 wrote to memory of 2692 2772 svchost.exe 32 PID 2772 wrote to memory of 2692 2772 svchost.exe 32 PID 2772 wrote to memory of 2692 2772 svchost.exe 32 PID 2692 wrote to memory of 2844 2692 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 33 PID 2692 wrote to memory of 2844 2692 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 33 PID 2692 wrote to memory of 2844 2692 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 33 PID 2692 wrote to memory of 2844 2692 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 33 PID 2844 wrote to memory of 2564 2844 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 34 PID 2844 wrote to memory of 2564 2844 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 34 PID 2844 wrote to memory of 2564 2844 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 34 PID 2844 wrote to memory of 2564 2844 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 34 PID 2564 wrote to memory of 2596 2564 svchost.exe 36 PID 2564 wrote to memory of 2596 2564 svchost.exe 36 PID 2564 wrote to memory of 2596 2564 svchost.exe 36 PID 2564 wrote to memory of 2596 2564 svchost.exe 36 PID 2596 wrote to memory of 2600 2596 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 37 PID 2596 wrote to memory of 2600 2596 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 37 PID 2596 wrote to memory of 2600 2596 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 37 PID 2596 wrote to memory of 2600 2596 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 37 PID 2600 wrote to memory of 1240 2600 svchost.com 38 PID 2600 wrote to memory of 1240 2600 svchost.com 38 PID 2600 wrote to memory of 1240 2600 svchost.com 38 PID 2600 wrote to memory of 1240 2600 svchost.com 38 PID 1240 wrote to memory of 2860 1240 258DF3~1.EXE 39 PID 1240 wrote to memory of 2860 1240 258DF3~1.EXE 39 PID 1240 wrote to memory of 2860 1240 258DF3~1.EXE 39 PID 1240 wrote to memory of 2860 1240 258DF3~1.EXE 39 PID 2860 wrote to memory of 2932 2860 svchost.com 40 PID 2860 wrote to memory of 2932 2860 svchost.com 40 PID 2860 wrote to memory of 2932 2860 svchost.com 40 PID 2860 wrote to memory of 2932 2860 svchost.com 40 PID 2932 wrote to memory of 1280 2932 258DF3~1.EXE 41 PID 2932 wrote to memory of 1280 2932 258DF3~1.EXE 41 PID 2932 wrote to memory of 1280 2932 258DF3~1.EXE 41 PID 2932 wrote to memory of 1280 2932 258DF3~1.EXE 41 PID 1280 wrote to memory of 2728 1280 svchost.com 42 PID 1280 wrote to memory of 2728 1280 svchost.com 42 PID 1280 wrote to memory of 2728 1280 svchost.com 42 PID 1280 wrote to memory of 2728 1280 svchost.com 42 PID 2728 wrote to memory of 1220 2728 258DF3~1.EXE 77 PID 2728 wrote to memory of 1220 2728 258DF3~1.EXE 77 PID 2728 wrote to memory of 1220 2728 258DF3~1.EXE 77 PID 2728 wrote to memory of 1220 2728 258DF3~1.EXE 77 PID 1220 wrote to memory of 1756 1220 svchost.com 44 PID 1220 wrote to memory of 1756 1220 svchost.com 44 PID 1220 wrote to memory of 1756 1220 svchost.com 44 PID 1220 wrote to memory of 1756 1220 svchost.com 44 PID 1756 wrote to memory of 692 1756 258DF3~1.EXE 45 PID 1756 wrote to memory of 692 1756 258DF3~1.EXE 45 PID 1756 wrote to memory of 692 1756 258DF3~1.EXE 45 PID 1756 wrote to memory of 692 1756 258DF3~1.EXE 45 PID 692 wrote to memory of 2864 692 svchost.com 46 PID 692 wrote to memory of 2864 692 svchost.com 46 PID 692 wrote to memory of 2864 692 svchost.com 46 PID 692 wrote to memory of 2864 692 svchost.com 46 PID 2864 wrote to memory of 2112 2864 258DF3~1.EXE 47 PID 2864 wrote to memory of 2112 2864 258DF3~1.EXE 47 PID 2864 wrote to memory of 2112 2864 258DF3~1.EXE 47 PID 2864 wrote to memory of 2112 2864 258DF3~1.EXE 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2424 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE20⤵
- Executes dropped EXE
PID:888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE22⤵
- Executes dropped EXE
PID:752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE24⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE26⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE30⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE32⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE34⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE36⤵
- Executes dropped EXE
PID:828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE38⤵
- Executes dropped EXE
PID:2360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE40⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE42⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE48⤵
- Executes dropped EXE
PID:2816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE52⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE54⤵
- Executes dropped EXE
PID:1900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE56⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE58⤵
- Executes dropped EXE
PID:1960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"61⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE62⤵
- Executes dropped EXE
PID:892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE64⤵
- Executes dropped EXE
PID:752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"65⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE66⤵
- Drops file in Windows directory
PID:1624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"67⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE68⤵PID:280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"69⤵
- Drops file in Windows directory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE70⤵
- Drops file in Windows directory
PID:2152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"71⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE72⤵
- Drops file in Windows directory
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"73⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE74⤵PID:2828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"75⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE76⤵
- Drops file in Windows directory
PID:2764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"77⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE78⤵PID:2804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"79⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE80⤵
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"81⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE82⤵PID:2664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"83⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE84⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"85⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE86⤵PID:2360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"87⤵
- Drops file in Windows directory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE88⤵
- System Location Discovery: System Language Discovery
PID:3040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"89⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE90⤵
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE92⤵PID:2064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"93⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE94⤵PID:1428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"95⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE96⤵PID:2816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"97⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE98⤵PID:2072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"99⤵
- Drops file in Windows directory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE100⤵PID:2904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"101⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE102⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"103⤵
- Drops file in Windows directory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE104⤵
- System Location Discovery: System Language Discovery
PID:2424 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"105⤵
- Drops file in Windows directory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE106⤵PID:2268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"107⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE108⤵PID:1320
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"109⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE110⤵PID:2040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"111⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE112⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE114⤵PID:1624
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"115⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE116⤵PID:280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"117⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE118⤵PID:1664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"119⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-