Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-01-2025 21:44
Behavioral task
behavioral1
Sample
3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe
-
Size
3.3MB
-
MD5
70aa341fcacbabd0dd857f91b23b5649
-
SHA1
f5ac5b932c9730579d8cea4edeb47d66220d6299
-
SHA256
3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236
-
SHA512
1be761410c91fb1e5d4d635a6cdbadb68c8fd30d63e9486889655351ac0feb1224fd2a12e4e70f256162da6fb0ee49be3cff39e2a58cc688f1db147f3dd67d97
-
SSDEEP
49152:nglZ4ThD+gGTZbqZK95S4pTiX2EUqMzADxulO7Udq+KqOuBk7bVnU7woM2JtY:bs6Gwxul1EE4wJ
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016c4a-2.dat family_neshta behavioral1/files/0x0007000000016c9d-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x0001000000010738-18.dat family_neshta behavioral1/files/0x001400000000f841-17.dat family_neshta behavioral1/memory/2848-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2580-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-56.dat family_neshta behavioral1/memory/2672-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-63-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7ca-77.dat family_neshta behavioral1/files/0x000100000000f776-76.dat family_neshta behavioral1/files/0x000100000000f7d8-75.dat family_neshta behavioral1/files/0x000100000000f7e6-79.dat family_neshta behavioral1/memory/1716-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2956-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1640-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82d-101.dat family_neshta behavioral1/memory/2536-140-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82e-131.dat family_neshta behavioral1/memory/1880-150-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1488-159-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1860-158-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2364-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1084-178-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-187-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1372-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1720-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2320-210-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2332-211-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1092-227-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/900-235-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1600-243-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2752-244-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2840-265-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2680-272-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2672-282-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2144-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/336-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2928-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1488-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2388-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1980-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1628-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1780-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2212-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2372-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2376-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1964-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1100-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2356-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2948-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/864-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2612-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2932-254-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1888-234-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2640-226-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 2848 svchost.com 2580 3C8953~1.EXE 2672 svchost.com 2632 3C8953~1.EXE 2608 svchost.com 1716 3C8953~1.EXE 2956 svchost.com 1640 3C8953~1.EXE 1104 svchost.com 2036 3C8953~1.EXE 2648 svchost.com 1740 3C8953~1.EXE 280 svchost.com 2536 3C8953~1.EXE 2384 svchost.com 1880 3C8953~1.EXE 1488 svchost.com 1860 3C8953~1.EXE 2364 svchost.com 2496 3C8953~1.EXE 1084 svchost.com 1820 3C8953~1.EXE 2808 svchost.com 2128 3C8953~1.EXE 1372 svchost.com 2656 3C8953~1.EXE 1720 svchost.com 620 3C8953~1.EXE 2332 svchost.com 2320 3C8953~1.EXE 3016 svchost.com 1768 3C8953~1.EXE 1092 svchost.com 2640 3C8953~1.EXE 900 svchost.com 1888 3C8953~1.EXE 2752 svchost.com 1600 3C8953~1.EXE 2564 svchost.com 2932 3C8953~1.EXE 2840 svchost.com 2612 3C8953~1.EXE 2832 svchost.com 2680 3C8953~1.EXE 2672 svchost.com 864 3C8953~1.EXE 2736 svchost.com 2948 3C8953~1.EXE 2144 svchost.com 2356 3C8953~1.EXE 2360 svchost.com 1648 3C8953~1.EXE 336 svchost.com 1100 3C8953~1.EXE 2928 svchost.com 1964 3C8953~1.EXE 2372 svchost.com 2376 3C8953~1.EXE 1780 svchost.com 2212 3C8953~1.EXE 1628 svchost.com 1488 3C8953~1.EXE 2388 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2404 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 2404 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 2848 svchost.com 2848 svchost.com 2672 svchost.com 2672 svchost.com 2608 svchost.com 2608 svchost.com 2956 svchost.com 2956 svchost.com 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 2404 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 1104 svchost.com 1104 svchost.com 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 2648 svchost.com 2648 svchost.com 280 svchost.com 280 svchost.com 2384 svchost.com 2384 svchost.com 1488 svchost.com 1488 svchost.com 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 2364 svchost.com 2364 svchost.com 1084 svchost.com 1084 svchost.com 2808 svchost.com 2808 svchost.com 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 1372 svchost.com 1372 svchost.com 1720 svchost.com 1720 svchost.com 2332 svchost.com 2332 svchost.com 3016 svchost.com 3016 svchost.com 1092 svchost.com 1092 svchost.com 900 svchost.com 900 svchost.com 2752 svchost.com 2752 svchost.com 2564 svchost.com 2564 svchost.com 2840 svchost.com 2840 svchost.com 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 2832 svchost.com 2832 svchost.com 2672 svchost.com 2672 svchost.com 2736 svchost.com 2736 svchost.com 2144 svchost.com 2144 svchost.com 2360 svchost.com 2360 svchost.com 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 336 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\svchost.com 3C8953~1.EXE File opened for modification C:\Windows\directx.sys 3C8953~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8953~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2772 2404 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 31 PID 2404 wrote to memory of 2772 2404 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 31 PID 2404 wrote to memory of 2772 2404 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 31 PID 2404 wrote to memory of 2772 2404 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 31 PID 2772 wrote to memory of 2848 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 32 PID 2772 wrote to memory of 2848 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 32 PID 2772 wrote to memory of 2848 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 32 PID 2772 wrote to memory of 2848 2772 3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe 32 PID 2848 wrote to memory of 2580 2848 svchost.com 33 PID 2848 wrote to memory of 2580 2848 svchost.com 33 PID 2848 wrote to memory of 2580 2848 svchost.com 33 PID 2848 wrote to memory of 2580 2848 svchost.com 33 PID 2580 wrote to memory of 2672 2580 3C8953~1.EXE 76 PID 2580 wrote to memory of 2672 2580 3C8953~1.EXE 76 PID 2580 wrote to memory of 2672 2580 3C8953~1.EXE 76 PID 2580 wrote to memory of 2672 2580 3C8953~1.EXE 76 PID 2672 wrote to memory of 2632 2672 svchost.com 35 PID 2672 wrote to memory of 2632 2672 svchost.com 35 PID 2672 wrote to memory of 2632 2672 svchost.com 35 PID 2672 wrote to memory of 2632 2672 svchost.com 35 PID 2632 wrote to memory of 2608 2632 3C8953~1.EXE 36 PID 2632 wrote to memory of 2608 2632 3C8953~1.EXE 36 PID 2632 wrote to memory of 2608 2632 3C8953~1.EXE 36 PID 2632 wrote to memory of 2608 2632 3C8953~1.EXE 36 PID 2608 wrote to memory of 1716 2608 svchost.com 37 PID 2608 wrote to memory of 1716 2608 svchost.com 37 PID 2608 wrote to memory of 1716 2608 svchost.com 37 PID 2608 wrote to memory of 1716 2608 svchost.com 37 PID 1716 wrote to memory of 2956 1716 3C8953~1.EXE 38 PID 1716 wrote to memory of 2956 1716 3C8953~1.EXE 38 PID 1716 wrote to memory of 2956 1716 3C8953~1.EXE 38 PID 1716 wrote to memory of 2956 1716 3C8953~1.EXE 38 PID 2956 wrote to memory of 1640 2956 svchost.com 39 PID 2956 wrote to memory of 1640 2956 svchost.com 39 PID 2956 wrote to memory of 1640 2956 svchost.com 39 PID 2956 wrote to memory of 1640 2956 svchost.com 39 PID 1640 wrote to memory of 1104 1640 3C8953~1.EXE 40 PID 1640 wrote to memory of 1104 1640 3C8953~1.EXE 40 PID 1640 wrote to memory of 1104 1640 3C8953~1.EXE 40 PID 1640 wrote to memory of 1104 1640 3C8953~1.EXE 40 PID 1104 wrote to memory of 2036 1104 svchost.com 41 PID 1104 wrote to memory of 2036 1104 svchost.com 41 PID 1104 wrote to memory of 2036 1104 svchost.com 41 PID 1104 wrote to memory of 2036 1104 svchost.com 41 PID 2036 wrote to memory of 2648 2036 3C8953~1.EXE 171 PID 2036 wrote to memory of 2648 2036 3C8953~1.EXE 171 PID 2036 wrote to memory of 2648 2036 3C8953~1.EXE 171 PID 2036 wrote to memory of 2648 2036 3C8953~1.EXE 171 PID 2648 wrote to memory of 1740 2648 svchost.com 117 PID 2648 wrote to memory of 1740 2648 svchost.com 117 PID 2648 wrote to memory of 1740 2648 svchost.com 117 PID 2648 wrote to memory of 1740 2648 svchost.com 117 PID 1740 wrote to memory of 280 1740 3C8953~1.EXE 44 PID 1740 wrote to memory of 280 1740 3C8953~1.EXE 44 PID 1740 wrote to memory of 280 1740 3C8953~1.EXE 44 PID 1740 wrote to memory of 280 1740 3C8953~1.EXE 44 PID 280 wrote to memory of 2536 280 svchost.com 45 PID 280 wrote to memory of 2536 280 svchost.com 45 PID 280 wrote to memory of 2536 280 svchost.com 45 PID 280 wrote to memory of 2536 280 svchost.com 45 PID 2536 wrote to memory of 2384 2536 3C8953~1.EXE 46 PID 2536 wrote to memory of 2384 2536 3C8953~1.EXE 46 PID 2536 wrote to memory of 2384 2536 3C8953~1.EXE 46 PID 2536 wrote to memory of 2384 2536 3C8953~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe"C:\Users\Admin\AppData\Local\Temp\3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\3c89537f3f78c9943a03ecba118fa6434a92e992ffeef8b70a6966272ea96236.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE18⤵
- Executes dropped EXE
PID:1880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE22⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE26⤵
- Executes dropped EXE
PID:2128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE28⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE30⤵
- Executes dropped EXE
PID:620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE34⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE38⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE42⤵
- Executes dropped EXE
PID:2932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE44⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE48⤵
- Executes dropped EXE
PID:864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE52⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE56⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"57⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE58⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE60⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"61⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE62⤵
- Executes dropped EXE
PID:2212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"63⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE64⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"65⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE66⤵
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"67⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE68⤵PID:2540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"69⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE70⤵
- Drops file in Windows directory
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"71⤵
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE72⤵PID:2064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"73⤵
- Drops file in Windows directory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE74⤵PID:2332
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"75⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE76⤵
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"77⤵
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE78⤵PID:2760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"79⤵
- System Location Discovery: System Language Discovery
PID:640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE80⤵PID:2700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"81⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE82⤵PID:2696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE84⤵PID:1000
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"85⤵
- Drops file in Windows directory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE86⤵PID:2892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"87⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE88⤵
- Drops file in Windows directory
PID:1740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"89⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE90⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"91⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE92⤵
- Drops file in Windows directory
PID:1500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"93⤵
- Drops file in Windows directory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE94⤵PID:2068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"95⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE96⤵PID:548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"97⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE98⤵PID:1792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"99⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE100⤵PID:112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"101⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE102⤵PID:2616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE104⤵PID:1548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"105⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE106⤵PID:2472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"107⤵
- Drops file in Windows directory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE108⤵PID:2084
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"109⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE110⤵PID:772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"111⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"113⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE114⤵PID:916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"115⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"117⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE118⤵PID:816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"119⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE120⤵PID:2752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\3C8953~1.EXE"121⤵PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-