Analysis
-
max time kernel
22s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 20:49
Behavioral task
behavioral1
Sample
2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe
-
Size
1.6MB
-
MD5
e7e5ab552852f2027064ae3e67efe3bc
-
SHA1
c3f2d53a6e22e9420dd13683c34d5501445f4759
-
SHA256
2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae
-
SHA512
369948178e73ab775de6c239aa9e1e0b30789db6bed443047d3a5ac0a06c4a35f762b6de22b0997250332c954ee29b06cb3d9b99aaddd8747fa490e9847bf104
-
SSDEEP
49152:GRJmTQooBKegkLELQq7JJn6FkJfEXwdwAjTqWTy:GRJmTrBecFwll
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x00070000000195d6-4.dat family_neshta behavioral1/files/0x0007000000019605-15.dat family_neshta behavioral1/files/0x0001000000010319-19.dat family_neshta behavioral1/files/0x0001000000010317-18.dat family_neshta behavioral1/files/0x000100000001064f-17.dat family_neshta behavioral1/files/0x000b000000010326-16.dat family_neshta behavioral1/memory/2792-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2944-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2812-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2932-66-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2700-65-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/296-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2108-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2284-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-106-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1584-105-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f709-121.dat family_neshta behavioral1/files/0x000100000000f833-123.dat family_neshta behavioral1/memory/2828-143-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2876-142-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f87a-140.dat family_neshta behavioral1/files/0x0001000000010c16-152.dat family_neshta behavioral1/memory/2220-157-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1124-158-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1228-174-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2112-173-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/496-184-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1040-183-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-200-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/892-201-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2288-210-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-209-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1980-230-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-229-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2596-238-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2480-237-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/856-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2840-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2368-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2988-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2992-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2652-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2684-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2664-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1452-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2320-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3068-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2720-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2852-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/448-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2264-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2996-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/608-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/808-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2104-364-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/348-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2040-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1912-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 2792 svchost.com 2944 2C89EC~1.EXE 2168 svchost.com 2812 2C89EC~1.EXE 2932 svchost.com 2700 2C89EC~1.EXE 2648 svchost.com 296 2C89EC~1.EXE 2108 svchost.com 2284 2C89EC~1.EXE 3016 svchost.com 1584 2C89EC~1.EXE 2876 svchost.com 2828 2C89EC~1.EXE 1124 svchost.com 2220 2C89EC~1.EXE 1228 svchost.com 2112 2C89EC~1.EXE 1040 svchost.com 496 2C89EC~1.EXE 892 svchost.com 2360 2C89EC~1.EXE 2288 svchost.com 2432 2C89EC~1.EXE 1708 svchost.com 1980 2C89EC~1.EXE 2480 svchost.com 2596 2C89EC~1.EXE 856 svchost.com 2316 2C89EC~1.EXE 2840 svchost.com 2368 2C89EC~1.EXE 2988 svchost.com 2688 2C89EC~1.EXE 2992 svchost.com 2676 2C89EC~1.EXE 2684 svchost.com 2652 2C89EC~1.EXE 2716 svchost.com 2664 2C89EC~1.EXE 2320 svchost.com 1452 2C89EC~1.EXE 3068 svchost.com 2720 2C89EC~1.EXE 2852 svchost.com 448 2C89EC~1.EXE 2264 svchost.com 2996 2C89EC~1.EXE 608 svchost.com 808 2C89EC~1.EXE 348 svchost.com 2104 2C89EC~1.EXE 2040 svchost.com 1912 2C89EC~1.EXE 1124 svchost.com 1300 2C89EC~1.EXE 1200 svchost.com 1992 2C89EC~1.EXE 812 svchost.com 1040 2C89EC~1.EXE 1604 svchost.com 1556 2C89EC~1.EXE 2068 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2300 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 2300 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 2792 svchost.com 2792 svchost.com 2168 svchost.com 2168 svchost.com 2932 svchost.com 2932 svchost.com 2648 svchost.com 2648 svchost.com 2108 svchost.com 2108 svchost.com 3016 svchost.com 3016 svchost.com 2876 svchost.com 2300 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 2876 svchost.com 1124 svchost.com 1124 svchost.com 2300 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 1228 svchost.com 1228 svchost.com 1040 svchost.com 1040 svchost.com 892 svchost.com 892 svchost.com 2288 svchost.com 2288 svchost.com 1708 svchost.com 1708 svchost.com 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 2480 svchost.com 2480 svchost.com 856 svchost.com 856 svchost.com 2840 svchost.com 2840 svchost.com 2300 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 2988 svchost.com 2988 svchost.com 2992 svchost.com 2992 svchost.com 2684 svchost.com 2684 svchost.com 2716 svchost.com 2716 svchost.com 2320 svchost.com 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 2320 svchost.com 3068 svchost.com 3068 svchost.com 2852 svchost.com 2852 svchost.com 2264 svchost.com 2264 svchost.com 608 svchost.com 608 svchost.com 348 svchost.com 348 svchost.com 2040 svchost.com 2040 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C89EC~1.EXE File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C89EC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89EC~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 1724 2300 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 30 PID 2300 wrote to memory of 1724 2300 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 30 PID 2300 wrote to memory of 1724 2300 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 30 PID 2300 wrote to memory of 1724 2300 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 30 PID 1724 wrote to memory of 2792 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 31 PID 1724 wrote to memory of 2792 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 31 PID 1724 wrote to memory of 2792 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 31 PID 1724 wrote to memory of 2792 1724 2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe 31 PID 2792 wrote to memory of 2944 2792 svchost.com 32 PID 2792 wrote to memory of 2944 2792 svchost.com 32 PID 2792 wrote to memory of 2944 2792 svchost.com 32 PID 2792 wrote to memory of 2944 2792 svchost.com 32 PID 2944 wrote to memory of 2168 2944 2C89EC~1.EXE 33 PID 2944 wrote to memory of 2168 2944 2C89EC~1.EXE 33 PID 2944 wrote to memory of 2168 2944 2C89EC~1.EXE 33 PID 2944 wrote to memory of 2168 2944 2C89EC~1.EXE 33 PID 2168 wrote to memory of 2812 2168 svchost.com 34 PID 2168 wrote to memory of 2812 2168 svchost.com 34 PID 2168 wrote to memory of 2812 2168 svchost.com 34 PID 2168 wrote to memory of 2812 2168 svchost.com 34 PID 2812 wrote to memory of 2932 2812 2C89EC~1.EXE 35 PID 2812 wrote to memory of 2932 2812 2C89EC~1.EXE 35 PID 2812 wrote to memory of 2932 2812 2C89EC~1.EXE 35 PID 2812 wrote to memory of 2932 2812 2C89EC~1.EXE 35 PID 2932 wrote to memory of 2700 2932 svchost.com 36 PID 2932 wrote to memory of 2700 2932 svchost.com 36 PID 2932 wrote to memory of 2700 2932 svchost.com 36 PID 2932 wrote to memory of 2700 2932 svchost.com 36 PID 2700 wrote to memory of 2648 2700 2C89EC~1.EXE 37 PID 2700 wrote to memory of 2648 2700 2C89EC~1.EXE 37 PID 2700 wrote to memory of 2648 2700 2C89EC~1.EXE 37 PID 2700 wrote to memory of 2648 2700 2C89EC~1.EXE 37 PID 2648 wrote to memory of 296 2648 svchost.com 38 PID 2648 wrote to memory of 296 2648 svchost.com 38 PID 2648 wrote to memory of 296 2648 svchost.com 38 PID 2648 wrote to memory of 296 2648 svchost.com 38 PID 296 wrote to memory of 2108 296 2C89EC~1.EXE 39 PID 296 wrote to memory of 2108 296 2C89EC~1.EXE 39 PID 296 wrote to memory of 2108 296 2C89EC~1.EXE 39 PID 296 wrote to memory of 2108 296 2C89EC~1.EXE 39 PID 2108 wrote to memory of 2284 2108 svchost.com 40 PID 2108 wrote to memory of 2284 2108 svchost.com 40 PID 2108 wrote to memory of 2284 2108 svchost.com 40 PID 2108 wrote to memory of 2284 2108 svchost.com 40 PID 2284 wrote to memory of 3016 2284 2C89EC~1.EXE 41 PID 2284 wrote to memory of 3016 2284 2C89EC~1.EXE 41 PID 2284 wrote to memory of 3016 2284 2C89EC~1.EXE 41 PID 2284 wrote to memory of 3016 2284 2C89EC~1.EXE 41 PID 3016 wrote to memory of 1584 3016 svchost.com 121 PID 3016 wrote to memory of 1584 3016 svchost.com 121 PID 3016 wrote to memory of 1584 3016 svchost.com 121 PID 3016 wrote to memory of 1584 3016 svchost.com 121 PID 1584 wrote to memory of 2876 1584 2C89EC~1.EXE 125 PID 1584 wrote to memory of 2876 1584 2C89EC~1.EXE 125 PID 1584 wrote to memory of 2876 1584 2C89EC~1.EXE 125 PID 1584 wrote to memory of 2876 1584 2C89EC~1.EXE 125 PID 2876 wrote to memory of 2828 2876 svchost.com 44 PID 2876 wrote to memory of 2828 2876 svchost.com 44 PID 2876 wrote to memory of 2828 2876 svchost.com 44 PID 2876 wrote to memory of 2828 2876 svchost.com 44 PID 2828 wrote to memory of 1124 2828 2C89EC~1.EXE 85 PID 2828 wrote to memory of 1124 2828 2C89EC~1.EXE 85 PID 2828 wrote to memory of 1124 2828 2C89EC~1.EXE 85 PID 2828 wrote to memory of 1124 2828 2C89EC~1.EXE 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe"C:\Users\Admin\AppData\Local\Temp\2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2c89ecb78073b823c7d466390f5bdb371d2fc77ff3ff2a8c66ee5c9eedd09aae.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE18⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE22⤵
- Executes dropped EXE
PID:496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE24⤵
- Executes dropped EXE
PID:2360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE26⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE30⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE32⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE34⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE40⤵
- Executes dropped EXE
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE42⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE48⤵
- Executes dropped EXE
PID:448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE50⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE56⤵
- Executes dropped EXE
PID:1912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"57⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE58⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE60⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"61⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"63⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"65⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE66⤵PID:2580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"67⤵
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"69⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE70⤵
- Drops file in Windows directory
PID:1036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"71⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE72⤵
- Drops file in Windows directory
PID:2200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"73⤵
- Drops file in Windows directory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE74⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE76⤵
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"77⤵
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE78⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"79⤵
- Drops file in Windows directory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE80⤵PID:2964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"81⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE82⤵PID:2344
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE84⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"85⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE86⤵
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"87⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE88⤵PID:2420
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"89⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE90⤵PID:2628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"91⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE92⤵PID:1072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"93⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"95⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE96⤵PID:1848
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"97⤵
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE98⤵PID:2128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"99⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE100⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"101⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE102⤵PID:864
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"103⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE104⤵PID:1192
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"105⤵
- Drops file in Windows directory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE106⤵
- Drops file in Windows directory
PID:1052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"107⤵
- Drops file in Windows directory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE108⤵PID:1492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"109⤵
- System Location Discovery: System Language Discovery
PID:696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE110⤵
- Drops file in Windows directory
PID:2360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"111⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE112⤵PID:2432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE114⤵PID:332
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"115⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE116⤵PID:2476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"117⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE118⤵
- Drops file in Windows directory
PID:804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"119⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE120⤵PID:2392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C89EC~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-