Analysis
-
max time kernel
26s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 03:47
Behavioral task
behavioral1
Sample
eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe
-
Size
265KB
-
MD5
929bc96cc8deb8a5637e2a8bfa1e30f0
-
SHA1
7f2a6af568cc7b067554444e1708c5081a8fc664
-
SHA256
eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbd
-
SHA512
17e2e116d9d0724756322673818338ad4f5fece1c03c8e79174b3ce4aa987b8d436e858022f94c9d6d6110b3e0e7ba57f017f55bfb1ffe73d260dab77f3eafd1
-
SSDEEP
3072:sr85CVLpp4bVWWwokzaLS+z9R4DJQPk4VsLwJ1JkxMqXyryr85Cxr85C:k9JOw/OLSvY9sLwfTqXj9N9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x00070000000186ee-9.dat family_neshta behavioral1/files/0x0001000000010738-18.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x001400000000f841-17.dat family_neshta behavioral1/files/0x00070000000186fd-16.dat family_neshta behavioral1/memory/2664-38-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2260-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2744-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1628-65-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1044-67-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2892-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2876-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-84.dat family_neshta behavioral1/files/0x000100000000f7e6-103.dat family_neshta behavioral1/files/0x000100000000f7ca-94.dat family_neshta behavioral1/memory/2268-90-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1612-89-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-86.dat family_neshta behavioral1/files/0x000100000000f703-109.dat family_neshta behavioral1/files/0x000100000000f82d-112.dat family_neshta behavioral1/memory/1212-118-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/548-117-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010361-132.dat family_neshta behavioral1/files/0x0001000000010c12-147.dat family_neshta behavioral1/memory/2216-137-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-136-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1728-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/952-172-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2072-173-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1828-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/688-190-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1984-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/744-199-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/600-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1676-221-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2324-240-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/996-238-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1516-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1992-258-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2768-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2684-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2552-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1608-278-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2668-286-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2864-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2888-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2724-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/536-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1416-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1436-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2892-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1660-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/292-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1824-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2956-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2960-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1212-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2356-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2120-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 2664 svchost.com 2260 EB1C2C~1.EXE 2744 svchost.com 2620 EB1C2C~1.EXE 1044 svchost.com 1628 EB1C2C~1.EXE 2876 svchost.com 2892 EB1C2C~1.EXE 2268 svchost.com 1612 EB1C2C~1.EXE 1212 svchost.com 548 EB1C2C~1.EXE 2216 svchost.com 2360 EB1C2C~1.EXE 2380 svchost.com 1728 EB1C2C~1.EXE 952 svchost.com 2072 EB1C2C~1.EXE 1828 svchost.com 688 EB1C2C~1.EXE 744 svchost.com 1984 EB1C2C~1.EXE 600 svchost.com 1676 EB1C2C~1.EXE 2324 svchost.com 996 EB1C2C~1.EXE 1992 svchost.com 1516 EB1C2C~1.EXE 2768 svchost.com 2684 EB1C2C~1.EXE 1608 svchost.com 2552 EB1C2C~1.EXE 2668 svchost.com 2620 EB1C2C~1.EXE 1712 svchost.com 2864 EB1C2C~1.EXE 2888 svchost.com 2724 EB1C2C~1.EXE 536 svchost.com 1416 EB1C2C~1.EXE 2892 svchost.com 1436 EB1C2C~1.EXE 1660 svchost.com 292 EB1C2C~1.EXE 1824 svchost.com 2956 EB1C2C~1.EXE 1212 svchost.com 2960 EB1C2C~1.EXE 2356 svchost.com 2120 EB1C2C~1.EXE 2416 svchost.com 2456 EB1C2C~1.EXE 2200 svchost.com 2192 EB1C2C~1.EXE 620 svchost.com 980 EB1C2C~1.EXE 1544 svchost.com 2056 EB1C2C~1.EXE 2204 svchost.com 1772 EB1C2C~1.EXE 1996 svchost.com 1968 EB1C2C~1.EXE 2296 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2696 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 2696 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 2664 svchost.com 2664 svchost.com 2744 svchost.com 2744 svchost.com 1044 svchost.com 1044 svchost.com 2876 svchost.com 2876 svchost.com 2268 svchost.com 2268 svchost.com 1212 svchost.com 2696 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 1212 svchost.com 2216 svchost.com 2216 svchost.com 2380 svchost.com 2380 svchost.com 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 952 svchost.com 952 svchost.com 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 1828 svchost.com 1828 svchost.com 744 svchost.com 744 svchost.com 600 svchost.com 600 svchost.com 2696 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 2324 svchost.com 2324 svchost.com 1992 svchost.com 1992 svchost.com 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 2768 svchost.com 2768 svchost.com 1608 svchost.com 1608 svchost.com 2668 svchost.com 2668 svchost.com 1712 svchost.com 1712 svchost.com 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 2888 svchost.com 2888 svchost.com 536 svchost.com 536 svchost.com 2892 svchost.com 2892 svchost.com 1660 svchost.com 1660 svchost.com 1824 svchost.com 1824 svchost.com 1212 svchost.com 1212 svchost.com 2356 svchost.com 2356 svchost.com 2416 svchost.com 2416 svchost.com 2200 svchost.com 2200 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com EB1C2C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys EB1C2C~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1C2C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2816 2696 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 30 PID 2696 wrote to memory of 2816 2696 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 30 PID 2696 wrote to memory of 2816 2696 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 30 PID 2696 wrote to memory of 2816 2696 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 30 PID 2816 wrote to memory of 2664 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 31 PID 2816 wrote to memory of 2664 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 31 PID 2816 wrote to memory of 2664 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 31 PID 2816 wrote to memory of 2664 2816 eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe 31 PID 2664 wrote to memory of 2260 2664 svchost.com 32 PID 2664 wrote to memory of 2260 2664 svchost.com 32 PID 2664 wrote to memory of 2260 2664 svchost.com 32 PID 2664 wrote to memory of 2260 2664 svchost.com 32 PID 2260 wrote to memory of 2744 2260 EB1C2C~1.EXE 33 PID 2260 wrote to memory of 2744 2260 EB1C2C~1.EXE 33 PID 2260 wrote to memory of 2744 2260 EB1C2C~1.EXE 33 PID 2260 wrote to memory of 2744 2260 EB1C2C~1.EXE 33 PID 2744 wrote to memory of 2620 2744 svchost.com 64 PID 2744 wrote to memory of 2620 2744 svchost.com 64 PID 2744 wrote to memory of 2620 2744 svchost.com 64 PID 2744 wrote to memory of 2620 2744 svchost.com 64 PID 2620 wrote to memory of 1044 2620 EB1C2C~1.EXE 35 PID 2620 wrote to memory of 1044 2620 EB1C2C~1.EXE 35 PID 2620 wrote to memory of 1044 2620 EB1C2C~1.EXE 35 PID 2620 wrote to memory of 1044 2620 EB1C2C~1.EXE 35 PID 1044 wrote to memory of 1628 1044 svchost.com 36 PID 1044 wrote to memory of 1628 1044 svchost.com 36 PID 1044 wrote to memory of 1628 1044 svchost.com 36 PID 1044 wrote to memory of 1628 1044 svchost.com 36 PID 1628 wrote to memory of 2876 1628 EB1C2C~1.EXE 37 PID 1628 wrote to memory of 2876 1628 EB1C2C~1.EXE 37 PID 1628 wrote to memory of 2876 1628 EB1C2C~1.EXE 37 PID 1628 wrote to memory of 2876 1628 EB1C2C~1.EXE 37 PID 2876 wrote to memory of 2892 2876 svchost.com 71 PID 2876 wrote to memory of 2892 2876 svchost.com 71 PID 2876 wrote to memory of 2892 2876 svchost.com 71 PID 2876 wrote to memory of 2892 2876 svchost.com 71 PID 2892 wrote to memory of 2268 2892 EB1C2C~1.EXE 39 PID 2892 wrote to memory of 2268 2892 EB1C2C~1.EXE 39 PID 2892 wrote to memory of 2268 2892 EB1C2C~1.EXE 39 PID 2892 wrote to memory of 2268 2892 EB1C2C~1.EXE 39 PID 2268 wrote to memory of 1612 2268 svchost.com 40 PID 2268 wrote to memory of 1612 2268 svchost.com 40 PID 2268 wrote to memory of 1612 2268 svchost.com 40 PID 2268 wrote to memory of 1612 2268 svchost.com 40 PID 1612 wrote to memory of 1212 1612 EB1C2C~1.EXE 77 PID 1612 wrote to memory of 1212 1612 EB1C2C~1.EXE 77 PID 1612 wrote to memory of 1212 1612 EB1C2C~1.EXE 77 PID 1612 wrote to memory of 1212 1612 EB1C2C~1.EXE 77 PID 1212 wrote to memory of 548 1212 svchost.com 42 PID 1212 wrote to memory of 548 1212 svchost.com 42 PID 1212 wrote to memory of 548 1212 svchost.com 42 PID 1212 wrote to memory of 548 1212 svchost.com 42 PID 548 wrote to memory of 2216 548 EB1C2C~1.EXE 43 PID 548 wrote to memory of 2216 548 EB1C2C~1.EXE 43 PID 548 wrote to memory of 2216 548 EB1C2C~1.EXE 43 PID 548 wrote to memory of 2216 548 EB1C2C~1.EXE 43 PID 2216 wrote to memory of 2360 2216 svchost.com 44 PID 2216 wrote to memory of 2360 2216 svchost.com 44 PID 2216 wrote to memory of 2360 2216 svchost.com 44 PID 2216 wrote to memory of 2360 2216 svchost.com 44 PID 2360 wrote to memory of 2380 2360 EB1C2C~1.EXE 45 PID 2360 wrote to memory of 2380 2360 EB1C2C~1.EXE 45 PID 2360 wrote to memory of 2380 2360 EB1C2C~1.EXE 45 PID 2360 wrote to memory of 2380 2360 EB1C2C~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe"C:\Users\Admin\AppData\Local\Temp\eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\eb1c2cd4e28ee72651f2c9d76cdf18dc4c3e55efa97d921b36909b89df1f1cbdN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE12⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE18⤵
- Executes dropped EXE
PID:1728 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2072 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE22⤵
- Executes dropped EXE
PID:688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE24⤵
- Executes dropped EXE
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE26⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE34⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE36⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE38⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE40⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1416 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE44⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE46⤵
- Executes dropped EXE
PID:292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE48⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE50⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE52⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE54⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE56⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"57⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE58⤵
- Executes dropped EXE
PID:980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"59⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE60⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"61⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"63⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE64⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"65⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE66⤵
- Drops file in Windows directory
PID:2328 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"67⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE68⤵PID:1464
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"69⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE70⤵PID:880
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"71⤵
- System Location Discovery: System Language Discovery
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE72⤵PID:2992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"73⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE74⤵
- Drops file in Windows directory
PID:2476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"75⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE76⤵PID:2872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"77⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE78⤵PID:1224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"79⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE80⤵PID:2744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"81⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE82⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"83⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE84⤵PID:1712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"85⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE86⤵PID:2876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"87⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE88⤵
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"89⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE90⤵PID:2836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"91⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE92⤵PID:1448
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"93⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE94⤵PID:328
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"95⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE96⤵PID:2140
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"97⤵
- Drops file in Windows directory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE98⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"99⤵
- Drops file in Windows directory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE100⤵PID:2212
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"101⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE102⤵PID:668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"103⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE104⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"105⤵
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE106⤵
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"107⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE108⤵PID:1184
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"109⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE110⤵PID:1708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"111⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE112⤵PID:3064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"113⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE114⤵PID:1652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"115⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE116⤵PID:2324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"117⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE118⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"119⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\EB1C2C~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-