Analysis
-
max time kernel
29s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-01-2025 08:25
Behavioral task
behavioral1
Sample
005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe
-
Size
717KB
-
MD5
d6b5e001f64698d45727381698eea840
-
SHA1
dc00295dd076c771612cbdb8b923aea4dc21bc8d
-
SHA256
005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebf
-
SHA512
bec731a232554e1e23ec5a139f649c16e46d5fbc10b7c4ba03f8cedcbdfeac64d91fbe0ef87019a1fb87f6319ae380b505af94fbcfb839e2982989b35865b78c
-
SSDEEP
6144:k9O0bWLqHxR58GSOEfY1o3eWIdJ20r376dvciiw0CO979:Hsr8HOEfY1ouPJ22376dvx0
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0009000000018f85-2.dat family_neshta behavioral1/files/0x000700000001932a-15.dat family_neshta behavioral1/files/0x0005000000010351-17.dat family_neshta behavioral1/files/0x0002000000010484-16.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/memory/2836-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2104-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2656-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2308-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2520-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1992-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2392-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/600-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1584-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1940-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3060-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1972-113-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7dd-117.dat family_neshta behavioral1/files/0x000100000000f7cf-131.dat family_neshta behavioral1/files/0x000100000000f7eb-134.dat family_neshta behavioral1/memory/1792-141-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/332-140-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2416-162-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2504-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/888-178-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1720-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1744-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/976-196-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1820-208-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1732-207-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2932-216-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2992-215-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1764-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1260-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2272-241-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2984-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1808-262-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2952-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2800-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1276-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2408-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2656-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2000-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1964-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2092-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/264-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2528-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2352-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2176-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2200-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2396-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2260-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1584-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2452-359-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/916-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1508-366-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1520-367-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-374-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2460-375-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2128-383-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2772 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 2104 svchost.com 2836 005E01~1.EXE 2656 svchost.com 2308 005E01~1.EXE 2520 svchost.com 1992 005E01~1.EXE 2392 svchost.com 2168 005E01~1.EXE 600 svchost.com 2608 005E01~1.EXE 1584 svchost.com 1940 005E01~1.EXE 3060 svchost.com 1972 005E01~1.EXE 1792 svchost.com 332 005E01~1.EXE 2416 svchost.com 2504 005E01~1.EXE 1720 svchost.com 888 005E01~1.EXE 976 svchost.com 1744 005E01~1.EXE 1820 svchost.com 1732 005E01~1.EXE 2932 svchost.com 2992 005E01~1.EXE 1260 svchost.com 1764 005E01~1.EXE 2984 svchost.com 2272 005E01~1.EXE 1808 svchost.com 2952 005E01~1.EXE 2800 svchost.com 2832 005E01~1.EXE 1276 svchost.com 2408 005E01~1.EXE 2656 svchost.com 2000 005E01~1.EXE 2092 svchost.com 1964 005E01~1.EXE 2528 svchost.com 264 005E01~1.EXE 2352 svchost.com 2176 005E01~1.EXE 2396 svchost.com 2200 005E01~1.EXE 1584 svchost.com 2260 005E01~1.EXE 2452 svchost.com 916 005E01~1.EXE 1520 svchost.com 1508 005E01~1.EXE 2460 svchost.com 2380 005E01~1.EXE 2128 svchost.com 2580 005E01~1.EXE 2428 svchost.com 2504 005E01~1.EXE 2628 svchost.com 2616 005E01~1.EXE 960 svchost.com 3016 005E01~1.EXE 1568 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2892 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 2892 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 2104 svchost.com 2104 svchost.com 2656 svchost.com 2656 svchost.com 2520 svchost.com 2520 svchost.com 2392 svchost.com 2392 svchost.com 600 svchost.com 600 svchost.com 1584 svchost.com 1584 svchost.com 3060 svchost.com 3060 svchost.com 1792 svchost.com 1792 svchost.com 2892 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 2772 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 2416 svchost.com 2416 svchost.com 1720 svchost.com 1720 svchost.com 976 svchost.com 976 svchost.com 2772 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 1820 svchost.com 1820 svchost.com 2932 svchost.com 2932 svchost.com 1260 svchost.com 1260 svchost.com 2984 svchost.com 2892 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 2984 svchost.com 1808 svchost.com 1808 svchost.com 2800 svchost.com 2800 svchost.com 1276 svchost.com 1276 svchost.com 2656 svchost.com 2656 svchost.com 2092 svchost.com 2092 svchost.com 2528 svchost.com 2528 svchost.com 2352 svchost.com 2352 svchost.com 2396 svchost.com 2396 svchost.com 1584 svchost.com 1584 svchost.com 2452 svchost.com 2452 svchost.com 1520 svchost.com 1520 svchost.com 2460 svchost.com 2460 svchost.com 2128 svchost.com 2128 svchost.com 2428 svchost.com 2428 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\svchost.com 005E01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 005E01~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2772 2892 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 30 PID 2892 wrote to memory of 2772 2892 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 30 PID 2892 wrote to memory of 2772 2892 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 30 PID 2892 wrote to memory of 2772 2892 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 30 PID 2772 wrote to memory of 2104 2772 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 31 PID 2772 wrote to memory of 2104 2772 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 31 PID 2772 wrote to memory of 2104 2772 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 31 PID 2772 wrote to memory of 2104 2772 005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe 31 PID 2104 wrote to memory of 2836 2104 svchost.com 32 PID 2104 wrote to memory of 2836 2104 svchost.com 32 PID 2104 wrote to memory of 2836 2104 svchost.com 32 PID 2104 wrote to memory of 2836 2104 svchost.com 32 PID 2836 wrote to memory of 2656 2836 005E01~1.EXE 67 PID 2836 wrote to memory of 2656 2836 005E01~1.EXE 67 PID 2836 wrote to memory of 2656 2836 005E01~1.EXE 67 PID 2836 wrote to memory of 2656 2836 005E01~1.EXE 67 PID 2656 wrote to memory of 2308 2656 svchost.com 34 PID 2656 wrote to memory of 2308 2656 svchost.com 34 PID 2656 wrote to memory of 2308 2656 svchost.com 34 PID 2656 wrote to memory of 2308 2656 svchost.com 34 PID 2308 wrote to memory of 2520 2308 005E01~1.EXE 35 PID 2308 wrote to memory of 2520 2308 005E01~1.EXE 35 PID 2308 wrote to memory of 2520 2308 005E01~1.EXE 35 PID 2308 wrote to memory of 2520 2308 005E01~1.EXE 35 PID 2520 wrote to memory of 1992 2520 svchost.com 36 PID 2520 wrote to memory of 1992 2520 svchost.com 36 PID 2520 wrote to memory of 1992 2520 svchost.com 36 PID 2520 wrote to memory of 1992 2520 svchost.com 36 PID 1992 wrote to memory of 2392 1992 005E01~1.EXE 37 PID 1992 wrote to memory of 2392 1992 005E01~1.EXE 37 PID 1992 wrote to memory of 2392 1992 005E01~1.EXE 37 PID 1992 wrote to memory of 2392 1992 005E01~1.EXE 37 PID 2392 wrote to memory of 2168 2392 svchost.com 38 PID 2392 wrote to memory of 2168 2392 svchost.com 38 PID 2392 wrote to memory of 2168 2392 svchost.com 38 PID 2392 wrote to memory of 2168 2392 svchost.com 38 PID 2168 wrote to memory of 600 2168 005E01~1.EXE 39 PID 2168 wrote to memory of 600 2168 005E01~1.EXE 39 PID 2168 wrote to memory of 600 2168 005E01~1.EXE 39 PID 2168 wrote to memory of 600 2168 005E01~1.EXE 39 PID 600 wrote to memory of 2608 600 svchost.com 123 PID 600 wrote to memory of 2608 600 svchost.com 123 PID 600 wrote to memory of 2608 600 svchost.com 123 PID 600 wrote to memory of 2608 600 svchost.com 123 PID 2608 wrote to memory of 1584 2608 005E01~1.EXE 77 PID 2608 wrote to memory of 1584 2608 005E01~1.EXE 77 PID 2608 wrote to memory of 1584 2608 005E01~1.EXE 77 PID 2608 wrote to memory of 1584 2608 005E01~1.EXE 77 PID 1584 wrote to memory of 1940 1584 svchost.com 42 PID 1584 wrote to memory of 1940 1584 svchost.com 42 PID 1584 wrote to memory of 1940 1584 svchost.com 42 PID 1584 wrote to memory of 1940 1584 svchost.com 42 PID 1940 wrote to memory of 3060 1940 005E01~1.EXE 43 PID 1940 wrote to memory of 3060 1940 005E01~1.EXE 43 PID 1940 wrote to memory of 3060 1940 005E01~1.EXE 43 PID 1940 wrote to memory of 3060 1940 005E01~1.EXE 43 PID 3060 wrote to memory of 1972 3060 svchost.com 44 PID 3060 wrote to memory of 1972 3060 svchost.com 44 PID 3060 wrote to memory of 1972 3060 svchost.com 44 PID 3060 wrote to memory of 1972 3060 svchost.com 44 PID 1972 wrote to memory of 1792 1972 005E01~1.EXE 45 PID 1972 wrote to memory of 1792 1972 005E01~1.EXE 45 PID 1972 wrote to memory of 1792 1972 005E01~1.EXE 45 PID 1972 wrote to memory of 1792 1972 005E01~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe"C:\Users\Admin\AppData\Local\Temp\005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\005e013db1522fe8f97efc49b738188429d2b8c098d586bc150b85c362e40ebfN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE18⤵
- Executes dropped EXE
PID:332 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE20⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE22⤵
- Executes dropped EXE
PID:888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE24⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE26⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE30⤵
- Executes dropped EXE
PID:1764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE34⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE36⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE42⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE44⤵
- Executes dropped EXE
PID:264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE48⤵
- Executes dropped EXE
PID:2200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE54⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE56⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"61⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE62⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE66⤵PID:1492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"67⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE68⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"69⤵
- System Location Discovery: System Language Discovery
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE70⤵PID:1596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"71⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE72⤵
- Drops file in Windows directory
PID:1936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"73⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE74⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"75⤵
- Drops file in Windows directory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE76⤵PID:2272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"77⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE78⤵
- Drops file in Windows directory
PID:1608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"79⤵
- Drops file in Windows directory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE80⤵
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"81⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE82⤵
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"83⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE84⤵PID:2696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"85⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE86⤵PID:1056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE88⤵PID:3020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"89⤵
- Drops file in Windows directory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE90⤵
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"91⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE92⤵
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"93⤵
- Drops file in Windows directory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE94⤵
- Drops file in Windows directory
PID:2132 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"95⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE96⤵
- Drops file in Windows directory
PID:2456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"97⤵
- Drops file in Windows directory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE98⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"99⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE100⤵PID:2296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"101⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE102⤵
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"103⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE104⤵PID:1944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"105⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE106⤵
- Drops file in Windows directory
PID:2580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"107⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE108⤵
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"109⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE110⤵
- Drops file in Windows directory
PID:2616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"111⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE112⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"113⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE114⤵
- System Location Discovery: System Language Discovery
PID:976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:1388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"117⤵
- Drops file in Windows directory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE118⤵PID:2340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"119⤵
- Drops file in Windows directory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE120⤵PID:1672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\005E01~1.EXE"121⤵
- Drops file in Windows directory
PID:1696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-