Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-02-2025 22:03
Behavioral task
behavioral1
Sample
749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe
-
Size
3.3MB
-
MD5
406a35fca4ea0e718ece9de3e2870e20
-
SHA1
73258871f81452b529ae0748f28abbd1fa061ac3
-
SHA256
749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0e
-
SHA512
b7dd2d320b3d817384b5b1fbe236dcda5493cd6a84f311757b8392d846e052102835c686939a728065250ddedfa2aca4ed132110186966538bc2adedc052a68e
-
SSDEEP
49152:oGGDw/cCL2a3j7+kt2y9d/UdMTJVDOZ6LrS0JZE0wb9sMnm:f/2y0ENanm
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0009000000015689-2.dat family_neshta behavioral1/files/0x0008000000015697-15.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x0013000000010321-17.dat family_neshta behavioral1/files/0x000f00000001033a-16.dat family_neshta behavioral1/memory/340-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2812-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2704-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1152-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-63-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2628-61-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82d-84.dat family_neshta behavioral1/files/0x000100000000f703-83.dat family_neshta behavioral1/files/0x000100000000f7e6-81.dat family_neshta behavioral1/files/0x000100000000f7ca-80.dat family_neshta behavioral1/files/0x000100000000f776-79.dat family_neshta behavioral1/files/0x000100000000f7d8-78.dat family_neshta behavioral1/files/0x000100000000f82e-86.dat family_neshta behavioral1/files/0x000100000000f872-89.dat family_neshta behavioral1/files/0x0001000000010361-96.dat family_neshta behavioral1/memory/2892-102-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1484-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010c12-113.dat family_neshta behavioral1/files/0x0001000000011876-135.dat family_neshta behavioral1/files/0x0001000000010f30-134.dat family_neshta behavioral1/files/0x00010000000117fc-133.dat family_neshta behavioral1/memory/2844-129-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2700-126-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1028-146-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2236-155-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2092-154-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1148-190-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-189-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1300-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1580-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2292-206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/908-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2568-181-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1400-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/628-173-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2108-172-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/848-164-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2324-163-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1996-145-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2356-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1040-228-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/800-236-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1576-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/880-251-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2884-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1616-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1880-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2924-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1196-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2916-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1720-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2776-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2284-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 340 svchost.com 2812 749955~1.EXE 2704 svchost.com 1152 749955~1.EXE 2628 svchost.com 2712 749955~1.EXE 2892 svchost.com 1484 749955~1.EXE 2844 svchost.com 2700 749955~1.EXE 1028 svchost.com 1996 749955~1.EXE 2236 svchost.com 2092 749955~1.EXE 848 svchost.com 2324 749955~1.EXE 628 svchost.com 2108 749955~1.EXE 2568 svchost.com 1400 749955~1.EXE 1148 svchost.com 2972 749955~1.EXE 1300 svchost.com 1580 749955~1.EXE 908 svchost.com 2292 749955~1.EXE 1648 svchost.com 2356 749955~1.EXE 1040 svchost.com 800 749955~1.EXE 880 svchost.com 1576 749955~1.EXE 2808 svchost.com 2884 749955~1.EXE 2780 svchost.com 1616 749955~1.EXE 2924 svchost.com 1880 749955~1.EXE 2832 svchost.com 1196 749955~1.EXE 2380 svchost.com 2916 749955~1.EXE 1720 svchost.com 2776 749955~1.EXE 2284 svchost.com 2912 749955~1.EXE 2948 svchost.com 1324 749955~1.EXE 912 svchost.com 2172 749955~1.EXE 1996 svchost.com 2936 749955~1.EXE 2316 svchost.com 1816 749955~1.EXE 2964 svchost.com 1132 749955~1.EXE 628 svchost.com 1240 749955~1.EXE 1948 svchost.com 836 749955~1.EXE 2256 svchost.com 1656 749955~1.EXE 2972 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2508 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2508 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 340 svchost.com 340 svchost.com 2704 svchost.com 2704 svchost.com 2628 svchost.com 2628 svchost.com 2508 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2892 svchost.com 2892 svchost.com 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2844 svchost.com 2844 svchost.com 1028 svchost.com 1028 svchost.com 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2236 svchost.com 2236 svchost.com 848 svchost.com 848 svchost.com 628 svchost.com 628 svchost.com 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2568 svchost.com 2568 svchost.com 1148 svchost.com 1148 svchost.com 1300 svchost.com 1300 svchost.com 908 svchost.com 908 svchost.com 1648 svchost.com 1648 svchost.com 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 1040 svchost.com 1040 svchost.com 880 svchost.com 880 svchost.com 2808 svchost.com 2808 svchost.com 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 2780 svchost.com 2780 svchost.com 2924 svchost.com 2924 svchost.com 2832 svchost.com 2832 svchost.com 2380 svchost.com 2380 svchost.com 1720 svchost.com 1720 svchost.com 2284 svchost.com 2284 svchost.com 2948 svchost.com 2948 svchost.com 912 svchost.com 912 svchost.com 1996 svchost.com 1996 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 749955~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 749955~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749955~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2484 2508 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 30 PID 2508 wrote to memory of 2484 2508 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 30 PID 2508 wrote to memory of 2484 2508 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 30 PID 2508 wrote to memory of 2484 2508 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 30 PID 2484 wrote to memory of 340 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 31 PID 2484 wrote to memory of 340 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 31 PID 2484 wrote to memory of 340 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 31 PID 2484 wrote to memory of 340 2484 749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe 31 PID 340 wrote to memory of 2812 340 svchost.com 32 PID 340 wrote to memory of 2812 340 svchost.com 32 PID 340 wrote to memory of 2812 340 svchost.com 32 PID 340 wrote to memory of 2812 340 svchost.com 32 PID 2812 wrote to memory of 2704 2812 749955~1.EXE 33 PID 2812 wrote to memory of 2704 2812 749955~1.EXE 33 PID 2812 wrote to memory of 2704 2812 749955~1.EXE 33 PID 2812 wrote to memory of 2704 2812 749955~1.EXE 33 PID 2704 wrote to memory of 1152 2704 svchost.com 34 PID 2704 wrote to memory of 1152 2704 svchost.com 34 PID 2704 wrote to memory of 1152 2704 svchost.com 34 PID 2704 wrote to memory of 1152 2704 svchost.com 34 PID 1152 wrote to memory of 2628 1152 749955~1.EXE 35 PID 1152 wrote to memory of 2628 1152 749955~1.EXE 35 PID 1152 wrote to memory of 2628 1152 749955~1.EXE 35 PID 1152 wrote to memory of 2628 1152 749955~1.EXE 35 PID 2628 wrote to memory of 2712 2628 svchost.com 36 PID 2628 wrote to memory of 2712 2628 svchost.com 36 PID 2628 wrote to memory of 2712 2628 svchost.com 36 PID 2628 wrote to memory of 2712 2628 svchost.com 36 PID 2712 wrote to memory of 2892 2712 749955~1.EXE 37 PID 2712 wrote to memory of 2892 2712 749955~1.EXE 37 PID 2712 wrote to memory of 2892 2712 749955~1.EXE 37 PID 2712 wrote to memory of 2892 2712 749955~1.EXE 37 PID 2892 wrote to memory of 1484 2892 svchost.com 38 PID 2892 wrote to memory of 1484 2892 svchost.com 38 PID 2892 wrote to memory of 1484 2892 svchost.com 38 PID 2892 wrote to memory of 1484 2892 svchost.com 38 PID 1484 wrote to memory of 2844 1484 749955~1.EXE 39 PID 1484 wrote to memory of 2844 1484 749955~1.EXE 39 PID 1484 wrote to memory of 2844 1484 749955~1.EXE 39 PID 1484 wrote to memory of 2844 1484 749955~1.EXE 39 PID 2844 wrote to memory of 2700 2844 svchost.com 40 PID 2844 wrote to memory of 2700 2844 svchost.com 40 PID 2844 wrote to memory of 2700 2844 svchost.com 40 PID 2844 wrote to memory of 2700 2844 svchost.com 40 PID 2700 wrote to memory of 1028 2700 749955~1.EXE 41 PID 2700 wrote to memory of 1028 2700 749955~1.EXE 41 PID 2700 wrote to memory of 1028 2700 749955~1.EXE 41 PID 2700 wrote to memory of 1028 2700 749955~1.EXE 41 PID 1028 wrote to memory of 1996 1028 svchost.com 81 PID 1028 wrote to memory of 1996 1028 svchost.com 81 PID 1028 wrote to memory of 1996 1028 svchost.com 81 PID 1028 wrote to memory of 1996 1028 svchost.com 81 PID 1996 wrote to memory of 2236 1996 749955~1.EXE 43 PID 1996 wrote to memory of 2236 1996 749955~1.EXE 43 PID 1996 wrote to memory of 2236 1996 749955~1.EXE 43 PID 1996 wrote to memory of 2236 1996 749955~1.EXE 43 PID 2236 wrote to memory of 2092 2236 svchost.com 44 PID 2236 wrote to memory of 2092 2236 svchost.com 44 PID 2236 wrote to memory of 2092 2236 svchost.com 44 PID 2236 wrote to memory of 2092 2236 svchost.com 44 PID 2092 wrote to memory of 848 2092 749955~1.EXE 133 PID 2092 wrote to memory of 848 2092 749955~1.EXE 133 PID 2092 wrote to memory of 848 2092 749955~1.EXE 133 PID 2092 wrote to memory of 848 2092 749955~1.EXE 133
Processes
-
C:\Users\Admin\AppData\Local\Temp\749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe"C:\Users\Admin\AppData\Local\Temp\749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\749955af0110cffec78794d8130865911cf51c59e64b04302fd0aef98bdcba0eN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE18⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE22⤵
- Executes dropped EXE
PID:1400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE30⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE34⤵
- Executes dropped EXE
PID:1576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE36⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE38⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE40⤵
- Executes dropped EXE
PID:1880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE42⤵
- Executes dropped EXE
PID:1196 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE44⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE46⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE48⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE52⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"55⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"57⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"59⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"61⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE62⤵
- Executes dropped EXE
PID:836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"63⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE64⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"65⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE66⤵
- Drops file in Windows directory
PID:1776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"67⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE68⤵PID:1668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"69⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE70⤵PID:856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"71⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE72⤵PID:2356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"73⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE74⤵PID:1040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"75⤵
- Drops file in Windows directory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE76⤵PID:1824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"77⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE78⤵PID:880
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"79⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE80⤵PID:2880
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"81⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE82⤵PID:2824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"83⤵
- Drops file in Windows directory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE84⤵PID:2816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"85⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE86⤵
- Drops file in Windows directory
PID:2624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"87⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE88⤵PID:2056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"89⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE90⤵PID:2660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"91⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE92⤵PID:2688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"93⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE94⤵
- Drops file in Windows directory
PID:1048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"95⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE96⤵PID:1052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"97⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE98⤵PID:2028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"99⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE100⤵PID:2172
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"101⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE102⤵PID:2128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"103⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE104⤵PID:1272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"105⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE106⤵PID:2200
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"107⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE108⤵
- System Location Discovery: System Language Discovery
PID:1800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"109⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE110⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"111⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE112⤵
- Drops file in Windows directory
PID:344 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"113⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE114⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"115⤵
- Drops file in Windows directory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE116⤵PID:1668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"117⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE118⤵PID:1652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"119⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE120⤵PID:2544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\749955~1.EXE"121⤵PID:348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-