Analysis
-
max time kernel
115s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 15:45
Static task
static1
Behavioral task
behavioral1
Sample
d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe
Resource
win10v2004-20220414-en
General
-
Target
d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe
-
Size
1.1MB
-
MD5
3819a3c01e3c206888e4e8575ec1dba8
-
SHA1
f46fcf2b667384e8ee3f607f134cafd6ad74ef74
-
SHA256
d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4
-
SHA512
5e2e7ec436c1d67e0050d8e6bbc001075d289b9dc65829bd122894e0204ae45bc711130f71f8b3e33b11b897d8e88af670dba643fe7c7f697010b98e37fdafb2
Malware Config
Signatures
-
Detect Neshta Payload 38 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exesvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.compid process 3976 d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe 4196 svchost.com 3080 D8EDEA~1.EXE 1300 svchost.com 4236 D8EDEA~1.EXE 2320 svchost.com 2996 D8EDEA~1.EXE 564 svchost.com 4428 D8EDEA~1.EXE 4508 svchost.com 1800 D8EDEA~1.EXE 2840 svchost.com 944 D8EDEA~1.EXE 4828 svchost.com 2464 D8EDEA~1.EXE 4120 svchost.com 32 D8EDEA~1.EXE 3632 svchost.com 2992 D8EDEA~1.EXE 2328 svchost.com 4456 D8EDEA~1.EXE 5076 svchost.com 5000 D8EDEA~1.EXE 4620 svchost.com 824 D8EDEA~1.EXE 2060 svchost.com 1836 D8EDEA~1.EXE 2548 svchost.com 1044 D8EDEA~1.EXE 2700 svchost.com 832 D8EDEA~1.EXE 1108 svchost.com 4060 D8EDEA~1.EXE 2232 svchost.com 2180 D8EDEA~1.EXE 2728 svchost.com 4908 D8EDEA~1.EXE 2476 D8EDEA~1.EXE 3920 D8EDEA~1.EXE 2644 svchost.com 3604 D8EDEA~1.EXE 444 svchost.com 2360 D8EDEA~1.EXE 3104 svchost.com 1804 D8EDEA~1.EXE 4920 svchost.com 540 D8EDEA~1.EXE 956 svchost.com 4964 D8EDEA~1.EXE 828 svchost.com 1424 D8EDEA~1.EXE 4804 svchost.com 4540 D8EDEA~1.EXE 4392 svchost.com 4500 D8EDEA~1.EXE 3408 svchost.com 4144 D8EDEA~1.EXE 3640 svchost.com 4600 D8EDEA~1.EXE 3112 svchost.com 4032 D8EDEA~1.EXE 4912 svchost.com 2464 D8EDEA~1.EXE 1484 svchost.com -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
D8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation D8EDEA~1.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exed8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exedescription ioc process File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MIA062~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~3.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~2.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI391D~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~2.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe -
Drops file in Windows directory 64 IoCs
Processes:
D8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comsvchost.comD8EDEA~1.EXEsvchost.comsvchost.comD8EDEA~1.EXED8EDEA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comD8EDEA~1.EXED8EDEA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comD8EDEA~1.EXEsvchost.comsvchost.comD8EDEA~1.EXED8EDEA~1.EXEsvchost.comsvchost.comsvchost.comD8EDEA~1.EXED8EDEA~1.EXEsvchost.comD8EDEA~1.EXED8EDEA~1.EXEsvchost.comD8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXEsvchost.comsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXED8EDEA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXEsvchost.comD8EDEA~1.EXED8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\directx.sys D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D8EDEA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
D8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXED8EDEA~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings D8EDEA~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exed8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exesvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEsvchost.comD8EDEA~1.EXEdescription pid process target process PID 548 wrote to memory of 3976 548 d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe PID 548 wrote to memory of 3976 548 d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe PID 548 wrote to memory of 3976 548 d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe PID 3976 wrote to memory of 4196 3976 d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe svchost.com PID 3976 wrote to memory of 4196 3976 d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe svchost.com PID 3976 wrote to memory of 4196 3976 d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe svchost.com PID 4196 wrote to memory of 3080 4196 svchost.com D8EDEA~1.EXE PID 4196 wrote to memory of 3080 4196 svchost.com D8EDEA~1.EXE PID 4196 wrote to memory of 3080 4196 svchost.com D8EDEA~1.EXE PID 3080 wrote to memory of 1300 3080 D8EDEA~1.EXE svchost.com PID 3080 wrote to memory of 1300 3080 D8EDEA~1.EXE svchost.com PID 3080 wrote to memory of 1300 3080 D8EDEA~1.EXE svchost.com PID 1300 wrote to memory of 4236 1300 svchost.com D8EDEA~1.EXE PID 1300 wrote to memory of 4236 1300 svchost.com D8EDEA~1.EXE PID 1300 wrote to memory of 4236 1300 svchost.com D8EDEA~1.EXE PID 4236 wrote to memory of 2320 4236 D8EDEA~1.EXE svchost.com PID 4236 wrote to memory of 2320 4236 D8EDEA~1.EXE svchost.com PID 4236 wrote to memory of 2320 4236 D8EDEA~1.EXE svchost.com PID 2320 wrote to memory of 2996 2320 svchost.com D8EDEA~1.EXE PID 2320 wrote to memory of 2996 2320 svchost.com D8EDEA~1.EXE PID 2320 wrote to memory of 2996 2320 svchost.com D8EDEA~1.EXE PID 2996 wrote to memory of 564 2996 D8EDEA~1.EXE svchost.com PID 2996 wrote to memory of 564 2996 D8EDEA~1.EXE svchost.com PID 2996 wrote to memory of 564 2996 D8EDEA~1.EXE svchost.com PID 564 wrote to memory of 4428 564 svchost.com D8EDEA~1.EXE PID 564 wrote to memory of 4428 564 svchost.com D8EDEA~1.EXE PID 564 wrote to memory of 4428 564 svchost.com D8EDEA~1.EXE PID 4428 wrote to memory of 4508 4428 D8EDEA~1.EXE svchost.com PID 4428 wrote to memory of 4508 4428 D8EDEA~1.EXE svchost.com PID 4428 wrote to memory of 4508 4428 D8EDEA~1.EXE svchost.com PID 4508 wrote to memory of 1800 4508 svchost.com D8EDEA~1.EXE PID 4508 wrote to memory of 1800 4508 svchost.com D8EDEA~1.EXE PID 4508 wrote to memory of 1800 4508 svchost.com D8EDEA~1.EXE PID 1800 wrote to memory of 2840 1800 D8EDEA~1.EXE svchost.com PID 1800 wrote to memory of 2840 1800 D8EDEA~1.EXE svchost.com PID 1800 wrote to memory of 2840 1800 D8EDEA~1.EXE svchost.com PID 2840 wrote to memory of 944 2840 svchost.com D8EDEA~1.EXE PID 2840 wrote to memory of 944 2840 svchost.com D8EDEA~1.EXE PID 2840 wrote to memory of 944 2840 svchost.com D8EDEA~1.EXE PID 944 wrote to memory of 4828 944 D8EDEA~1.EXE svchost.com PID 944 wrote to memory of 4828 944 D8EDEA~1.EXE svchost.com PID 944 wrote to memory of 4828 944 D8EDEA~1.EXE svchost.com PID 4828 wrote to memory of 2464 4828 svchost.com D8EDEA~1.EXE PID 4828 wrote to memory of 2464 4828 svchost.com D8EDEA~1.EXE PID 4828 wrote to memory of 2464 4828 svchost.com D8EDEA~1.EXE PID 2464 wrote to memory of 4120 2464 D8EDEA~1.EXE svchost.com PID 2464 wrote to memory of 4120 2464 D8EDEA~1.EXE svchost.com PID 2464 wrote to memory of 4120 2464 D8EDEA~1.EXE svchost.com PID 4120 wrote to memory of 32 4120 svchost.com D8EDEA~1.EXE PID 4120 wrote to memory of 32 4120 svchost.com D8EDEA~1.EXE PID 4120 wrote to memory of 32 4120 svchost.com D8EDEA~1.EXE PID 32 wrote to memory of 3632 32 D8EDEA~1.EXE svchost.com PID 32 wrote to memory of 3632 32 D8EDEA~1.EXE svchost.com PID 32 wrote to memory of 3632 32 D8EDEA~1.EXE svchost.com PID 3632 wrote to memory of 2992 3632 svchost.com D8EDEA~1.EXE PID 3632 wrote to memory of 2992 3632 svchost.com D8EDEA~1.EXE PID 3632 wrote to memory of 2992 3632 svchost.com D8EDEA~1.EXE PID 2992 wrote to memory of 2328 2992 D8EDEA~1.EXE svchost.com PID 2992 wrote to memory of 2328 2992 D8EDEA~1.EXE svchost.com PID 2992 wrote to memory of 2328 2992 D8EDEA~1.EXE svchost.com PID 2328 wrote to memory of 4456 2328 svchost.com D8EDEA~1.EXE PID 2328 wrote to memory of 4456 2328 svchost.com D8EDEA~1.EXE PID 2328 wrote to memory of 4456 2328 svchost.com D8EDEA~1.EXE PID 4456 wrote to memory of 5076 4456 D8EDEA~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe"C:\Users\Admin\AppData\Local\Temp\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\d8edea5e5351b2d98c588c4aa059283f75381c0c0707aba8776032d2c3441ef4.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE8⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"12⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE13⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"14⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE15⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"16⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE17⤵
- Executes dropped EXE
- Checks computer location settings
PID:1836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"18⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE19⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE21⤵
- Executes dropped EXE
PID:832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"22⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE23⤵
- Executes dropped EXE
- Modifies registry class
PID:4060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE25⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:2180 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"26⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE27⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"28⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE29⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:3920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"30⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE31⤵
- Executes dropped EXE
- Checks computer location settings
PID:3604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"32⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE33⤵
- Executes dropped EXE
- Modifies registry class
PID:2360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"34⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE35⤵PID:1804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"36⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE37⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
PID:540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"38⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE39⤵
- Executes dropped EXE
- Modifies registry class
PID:4964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"40⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE41⤵
- Executes dropped EXE
- Modifies registry class
PID:1424 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:4540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"44⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE45⤵PID:4500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"46⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE47⤵PID:4144
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"48⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE49⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:4032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"52⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE53⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"54⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE55⤵PID:260
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"56⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE57⤵PID:4660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"58⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE59⤵
- Checks computer location settings
PID:692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"60⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE61⤵PID:3788
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"62⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE63⤵
- Checks computer location settings
PID:1456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"64⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE65⤵
- Drops file in Windows directory
PID:1364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"66⤵
- Drops file in Windows directory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE67⤵
- Checks computer location settings
PID:1168 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"68⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE69⤵
- Checks computer location settings
- Modifies registry class
PID:872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"70⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE71⤵
- Modifies registry class
PID:2396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"72⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE73⤵PID:2152
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"74⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE75⤵
- Checks computer location settings
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"76⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE77⤵PID:3348
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"78⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE79⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"80⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE81⤵PID:4896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"82⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE83⤵PID:3108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"84⤵
- Drops file in Windows directory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE85⤵PID:3076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"86⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"88⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE89⤵
- Checks computer location settings
PID:1252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"90⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE91⤵
- Modifies registry class
PID:4744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"92⤵
- Drops file in Windows directory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE93⤵
- Modifies registry class
PID:892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"94⤵
- Drops file in Windows directory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE95⤵PID:3476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"96⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE97⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:4500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"98⤵
- Drops file in Windows directory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE99⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
PID:4144 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"100⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE101⤵
- Checks computer location settings
PID:640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"102⤵
- Drops file in Windows directory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE103⤵
- Drops file in Windows directory
PID:256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"104⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE105⤵PID:4720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"106⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE107⤵
- Checks computer location settings
- Modifies registry class
PID:4588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"108⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE109⤵
- Modifies registry class
PID:1536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"110⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE111⤵
- Checks computer location settings
- Modifies registry class
PID:3456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"112⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE113⤵
- Drops file in Windows directory
- Modifies registry class
PID:404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"114⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE115⤵
- Drops file in Windows directory
- Modifies registry class
PID:2112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"116⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE117⤵PID:1184
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"118⤵
- Drops file in Windows directory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE119⤵
- Checks computer location settings
- Modifies registry class
PID:1520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"120⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE121⤵
- Modifies registry class
PID:2392 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D8EDEA~1.EXE"122⤵PID:4372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-