Analysis
-
max time kernel
46s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 21:37
Behavioral task
behavioral1
Sample
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe
-
Size
333KB
-
MD5
c182ece96d6d9a64a0c0464b22f35371
-
SHA1
4af9dcd8ba229f967a7573a0ca73aa24c5690a98
-
SHA256
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c
-
SHA512
3aebf790625f3cc19f6e56e48b575199f8ff20caaf9480cbf864a9ed22e7178f0378d5254e65893246e177083120796de453ffb3c258446a0c590e28d04b636f
-
SSDEEP
3072:sr85Cn4BN6e7qQ0x6Nvx1p5GnKIL72zgO5+r85C:k9n66e7qR2x1p5GnKIL7P9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule behavioral1/files/0x002b0000000195bb-6.dat family_neshta behavioral1/files/0x00080000000195c6-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x0005000000010351-18.dat family_neshta behavioral1/files/0x0002000000010484-17.dat family_neshta behavioral1/memory/2884-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1896-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2708-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/612-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2412-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1976-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2172-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2332-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1844-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2764-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3036-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2440-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1388-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/428-129-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/932-128-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-145-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-141-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-142.dat family_neshta behavioral1/memory/3056-164-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1768-163-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/904-196-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1624-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1652-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1632-201-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1888-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/996-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1452-237-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2656-238-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-258-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2804-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3032-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2876-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1416-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2200-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3000-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1980-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2184-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2372-313-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2392-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2532-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2952-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2988-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2356-344-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2444-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2440-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2000-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2480-360-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/932-359-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2492-368-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2236-367-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1984-376-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-375-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3056-383-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1392-384-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/936-392-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
Processes:
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exesvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.compid Process 2904 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 2884 svchost.com 1896 36E228~1.EXE 2708 svchost.com 2736 36E228~1.EXE 612 svchost.com 2412 36E228~1.EXE 1976 svchost.com 2172 36E228~1.EXE 1844 svchost.com 2332 36E228~1.EXE 2764 svchost.com 3036 36E228~1.EXE 2440 svchost.com 1388 36E228~1.EXE 428 svchost.com 932 36E228~1.EXE 2380 svchost.com 2620 36E228~1.EXE 3056 svchost.com 1768 36E228~1.EXE 904 svchost.com 1624 36E228~1.EXE 1652 svchost.com 1632 36E228~1.EXE 996 svchost.com 1888 36E228~1.EXE 2656 svchost.com 1452 36E228~1.EXE 2632 svchost.com 2804 36E228~1.EXE 3032 svchost.com 2876 36E228~1.EXE 2676 svchost.com 1416 36E228~1.EXE 2200 svchost.com 3000 36E228~1.EXE 1980 svchost.com 2316 36E228~1.EXE 2184 svchost.com 2372 36E228~1.EXE 2392 svchost.com 2532 36E228~1.EXE 2988 svchost.com 2952 36E228~1.EXE 2444 svchost.com 2356 36E228~1.EXE 2440 svchost.com 2000 36E228~1.EXE 2480 svchost.com 932 36E228~1.EXE 2492 svchost.com 2236 36E228~1.EXE 2620 svchost.com 1984 36E228~1.EXE 1392 svchost.com 3056 36E228~1.EXE 936 svchost.com 692 36E228~1.EXE 1528 svchost.com 2368 36E228~1.EXE 2336 svchost.com 1740 36E228~1.EXE 1204 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid Process 2476 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 2476 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 2884 svchost.com 2884 svchost.com 2708 svchost.com 2708 svchost.com 612 svchost.com 612 svchost.com 1976 svchost.com 1976 svchost.com 1844 svchost.com 1844 svchost.com 2764 svchost.com 2764 svchost.com 2440 svchost.com 2440 svchost.com 428 svchost.com 428 svchost.com 2380 svchost.com 2380 svchost.com 3056 svchost.com 3056 svchost.com 2476 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 2904 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 904 svchost.com 904 svchost.com 2904 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 1652 svchost.com 1652 svchost.com 996 svchost.com 996 svchost.com 2656 svchost.com 2656 svchost.com 2632 svchost.com 2632 svchost.com 3032 svchost.com 3032 svchost.com 2904 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 2676 svchost.com 2676 svchost.com 2200 svchost.com 2200 svchost.com 1980 svchost.com 1980 svchost.com 2184 svchost.com 2184 svchost.com 2392 svchost.com 2392 svchost.com 2988 svchost.com 2988 svchost.com 2444 svchost.com 2444 svchost.com 2440 svchost.com 2440 svchost.com 2480 svchost.com 2480 svchost.com 2492 svchost.com 2492 svchost.com 2620 svchost.com 2620 svchost.com 1392 svchost.com 1392 svchost.com 936 svchost.com 936 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exedescription ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe -
Drops file in Windows directory 64 IoCs
Processes:
36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.comsvchost.com36E228~1.EXEsvchost.comsvchost.com36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXEsvchost.comsvchost.com36E228~1.EXEdescription ioc Process File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 36E228~1.EXE File opened for modification C:\Windows\svchost.com 36E228~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 36E228~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.comsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.comsvchost.comsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.comsvchost.com36E228~1.EXE36E228~1.EXEsvchost.comsvchost.com36E228~1.EXEsvchost.com36E228~1.EXE36E228~1.EXE36E228~1.EXEsvchost.comsvchost.comsvchost.comdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E228~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
Processes:
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exesvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEsvchost.com36E228~1.EXEdescription pid Process procid_target PID 2476 wrote to memory of 2904 2476 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 30 PID 2476 wrote to memory of 2904 2476 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 30 PID 2476 wrote to memory of 2904 2476 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 30 PID 2476 wrote to memory of 2904 2476 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 30 PID 2904 wrote to memory of 2884 2904 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 31 PID 2904 wrote to memory of 2884 2904 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 31 PID 2904 wrote to memory of 2884 2904 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 31 PID 2904 wrote to memory of 2884 2904 36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe 31 PID 2884 wrote to memory of 1896 2884 svchost.com 32 PID 2884 wrote to memory of 1896 2884 svchost.com 32 PID 2884 wrote to memory of 1896 2884 svchost.com 32 PID 2884 wrote to memory of 1896 2884 svchost.com 32 PID 1896 wrote to memory of 2708 1896 36E228~1.EXE 33 PID 1896 wrote to memory of 2708 1896 36E228~1.EXE 33 PID 1896 wrote to memory of 2708 1896 36E228~1.EXE 33 PID 1896 wrote to memory of 2708 1896 36E228~1.EXE 33 PID 2708 wrote to memory of 2736 2708 svchost.com 34 PID 2708 wrote to memory of 2736 2708 svchost.com 34 PID 2708 wrote to memory of 2736 2708 svchost.com 34 PID 2708 wrote to memory of 2736 2708 svchost.com 34 PID 2736 wrote to memory of 612 2736 36E228~1.EXE 35 PID 2736 wrote to memory of 612 2736 36E228~1.EXE 35 PID 2736 wrote to memory of 612 2736 36E228~1.EXE 35 PID 2736 wrote to memory of 612 2736 36E228~1.EXE 35 PID 612 wrote to memory of 2412 612 svchost.com 36 PID 612 wrote to memory of 2412 612 svchost.com 36 PID 612 wrote to memory of 2412 612 svchost.com 36 PID 612 wrote to memory of 2412 612 svchost.com 36 PID 2412 wrote to memory of 1976 2412 36E228~1.EXE 37 PID 2412 wrote to memory of 1976 2412 36E228~1.EXE 37 PID 2412 wrote to memory of 1976 2412 36E228~1.EXE 37 PID 2412 wrote to memory of 1976 2412 36E228~1.EXE 37 PID 1976 wrote to memory of 2172 1976 svchost.com 38 PID 1976 wrote to memory of 2172 1976 svchost.com 38 PID 1976 wrote to memory of 2172 1976 svchost.com 38 PID 1976 wrote to memory of 2172 1976 svchost.com 38 PID 2172 wrote to memory of 1844 2172 36E228~1.EXE 39 PID 2172 wrote to memory of 1844 2172 36E228~1.EXE 39 PID 2172 wrote to memory of 1844 2172 36E228~1.EXE 39 PID 2172 wrote to memory of 1844 2172 36E228~1.EXE 39 PID 1844 wrote to memory of 2332 1844 svchost.com 40 PID 1844 wrote to memory of 2332 1844 svchost.com 40 PID 1844 wrote to memory of 2332 1844 svchost.com 40 PID 1844 wrote to memory of 2332 1844 svchost.com 40 PID 2332 wrote to memory of 2764 2332 36E228~1.EXE 41 PID 2332 wrote to memory of 2764 2332 36E228~1.EXE 41 PID 2332 wrote to memory of 2764 2332 36E228~1.EXE 41 PID 2332 wrote to memory of 2764 2332 36E228~1.EXE 41 PID 2764 wrote to memory of 3036 2764 svchost.com 120 PID 2764 wrote to memory of 3036 2764 svchost.com 120 PID 2764 wrote to memory of 3036 2764 svchost.com 120 PID 2764 wrote to memory of 3036 2764 svchost.com 120 PID 3036 wrote to memory of 2440 3036 36E228~1.EXE 77 PID 3036 wrote to memory of 2440 3036 36E228~1.EXE 77 PID 3036 wrote to memory of 2440 3036 36E228~1.EXE 77 PID 3036 wrote to memory of 2440 3036 36E228~1.EXE 77 PID 2440 wrote to memory of 1388 2440 svchost.com 44 PID 2440 wrote to memory of 1388 2440 svchost.com 44 PID 2440 wrote to memory of 1388 2440 svchost.com 44 PID 2440 wrote to memory of 1388 2440 svchost.com 44 PID 1388 wrote to memory of 428 1388 36E228~1.EXE 45 PID 1388 wrote to memory of 428 1388 36E228~1.EXE 45 PID 1388 wrote to memory of 428 1388 36E228~1.EXE 45 PID 1388 wrote to memory of 428 1388 36E228~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe"C:\Users\Admin\AppData\Local\Temp\36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\36e228fa030534a282bb339a538b76d578cd8ac18a2ec90271ac391e6593c02c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE18⤵
- Executes dropped EXE
PID:932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE20⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE22⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE24⤵
- Executes dropped EXE
PID:1624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE26⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE28⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE34⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE36⤵
- Executes dropped EXE
PID:1416 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE38⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE40⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2372 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE44⤵
- Executes dropped EXE
PID:2532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE46⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE50⤵
- Executes dropped EXE
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE52⤵
- Executes dropped EXE
PID:932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE54⤵
- Executes dropped EXE
PID:2236 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE56⤵
- Executes dropped EXE
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE58⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"61⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE64⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"65⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE66⤵PID:568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"67⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE68⤵PID:2124
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"69⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE70⤵PID:3068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"71⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE72⤵PID:1452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"73⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE74⤵PID:2788
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"75⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE76⤵
- Drops file in Windows directory
PID:2804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"77⤵
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE78⤵PID:2868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"79⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE80⤵PID:2784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"81⤵
- System Location Discovery: System Language Discovery
PID:560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE82⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"83⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE84⤵PID:2412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"85⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE86⤵PID:2364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"87⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE88⤵
- Drops file in Windows directory
PID:2976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"89⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE90⤵PID:1696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"91⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE92⤵
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"93⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE94⤵
- Drops file in Windows directory
PID:2448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"95⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE96⤵
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"97⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE98⤵PID:2488
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"99⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE100⤵
- Drops file in Windows directory
PID:2404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"101⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE102⤵PID:672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"103⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE104⤵
- Drops file in Windows directory
PID:1520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"105⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE106⤵PID:2272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"107⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE108⤵PID:2368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"109⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE110⤵PID:2336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"111⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE112⤵PID:568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"113⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE114⤵PID:536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"115⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE116⤵PID:1092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"117⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE118⤵PID:3064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"119⤵
- Drops file in Windows directory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE120⤵PID:2936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\36E228~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-