Malware Analysis Report

2025-08-11 00:26

Sample ID 221001-wkbfzsaeen
Target 88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8
SHA256 88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8
Tags
neshta ramnit banker persistence spyware stealer trojan upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8

Threat Level: Known bad

The file 88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8 was found to be: Known bad.

Malicious Activity Summary

neshta ramnit banker persistence spyware stealer trojan upx worm

Detect Neshta payload

Ramnit

Neshta

Modifies system executable filetype association

Neshta family

UPX packed file

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-01 17:58

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-01 17:58

Reported

2022-10-01 18:11

Platform

win10v2004-20220812-en

Max time kernel

178s

Max time network

209s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe"

Signatures

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A

Neshta

persistence spyware neshta

Ramnit

trojan spyware stealer worm banker ramnit

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\px7D7D.tmp C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987729" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3404042442" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EB21AF0F-41C4-11ED-B696-4A8324823CC0} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371419934" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987729" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3404042442" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3644 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe
PID 3644 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe
PID 3644 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe
PID 2180 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe
PID 2180 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe
PID 2180 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe
PID 3392 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 3392 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 3392 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 3564 wrote to memory of 260 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3564 wrote to memory of 260 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 260 wrote to memory of 5116 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 260 wrote to memory of 5116 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 260 wrote to memory of 5116 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe

"C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:260 CREDAT:17410 /prefetch:2

Network

Country Destination Domain Proto
NL 178.79.208.1:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
AU 104.46.162.224:443 tcp
US 93.184.220.29:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
NL 104.80.225.205:443 tcp
US 8.8.8.8:53 15.89.54.20.in-addr.arpa udp
US 8.8.8.8:53 106.89.54.20.in-addr.arpa udp
US 8.8.8.8:53 a.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2180-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe

MD5 9237c86ce60ef2b1ea06d2c99ad38527
SHA1 2886b24cbb94183290e4f134a95384112665b5a5
SHA256 8582603f884b11652950c7648cd07a23642b70cd3b1e970e97ca538d1312e3cf
SHA512 1db714d4ad89702f29998cd945d2831dfab651dd03819889278c56284e14ebcdfdbda73f92e383fc814ea7eb6ca35c3d017305f048277a7da5bc0a8a50e0b5e6

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe

MD5 9237c86ce60ef2b1ea06d2c99ad38527
SHA1 2886b24cbb94183290e4f134a95384112665b5a5
SHA256 8582603f884b11652950c7648cd07a23642b70cd3b1e970e97ca538d1312e3cf
SHA512 1db714d4ad89702f29998cd945d2831dfab651dd03819889278c56284e14ebcdfdbda73f92e383fc814ea7eb6ca35c3d017305f048277a7da5bc0a8a50e0b5e6

memory/3392-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/3564-138-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/3392-140-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/3564-142-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2180-143-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2180-144-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2180-145-0x0000000000400000-0x000000000042A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-01 17:58

Reported

2022-10-01 18:10

Platform

win7-20220901-en

Max time kernel

142s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe"

Signatures

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A

Neshta

persistence spyware neshta

Ramnit

trojan spyware stealer worm banker ramnit

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MIE74D~1\DESKTO~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\px2CEB.tmp C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F94BC7F1-41B3-11ED-9FD0-D6EA6736E294} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371412652" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1816 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe
PID 1816 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe
PID 1816 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe
PID 1816 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe
PID 1068 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe
PID 1068 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe
PID 1068 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe
PID 1068 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe
PID 1476 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1476 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1476 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1476 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1864 wrote to memory of 1212 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1864 wrote to memory of 1212 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1864 wrote to memory of 1212 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1864 wrote to memory of 1212 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1212 wrote to memory of 1064 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1212 wrote to memory of 1064 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1212 wrote to memory of 1064 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1212 wrote to memory of 1064 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe

"C:\Users\Admin\AppData\Local\Temp\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1212 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.bing.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/1816-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

memory/1068-57-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe

MD5 9237c86ce60ef2b1ea06d2c99ad38527
SHA1 2886b24cbb94183290e4f134a95384112665b5a5
SHA256 8582603f884b11652950c7648cd07a23642b70cd3b1e970e97ca538d1312e3cf
SHA512 1db714d4ad89702f29998cd945d2831dfab651dd03819889278c56284e14ebcdfdbda73f92e383fc814ea7eb6ca35c3d017305f048277a7da5bc0a8a50e0b5e6

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe

MD5 9237c86ce60ef2b1ea06d2c99ad38527
SHA1 2886b24cbb94183290e4f134a95384112665b5a5
SHA256 8582603f884b11652950c7648cd07a23642b70cd3b1e970e97ca538d1312e3cf
SHA512 1db714d4ad89702f29998cd945d2831dfab651dd03819889278c56284e14ebcdfdbda73f92e383fc814ea7eb6ca35c3d017305f048277a7da5bc0a8a50e0b5e6

\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8.exe

MD5 9237c86ce60ef2b1ea06d2c99ad38527
SHA1 2886b24cbb94183290e4f134a95384112665b5a5
SHA256 8582603f884b11652950c7648cd07a23642b70cd3b1e970e97ca538d1312e3cf
SHA512 1db714d4ad89702f29998cd945d2831dfab651dd03819889278c56284e14ebcdfdbda73f92e383fc814ea7eb6ca35c3d017305f048277a7da5bc0a8a50e0b5e6

\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/1476-61-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

C:\Users\Admin\AppData\Local\Temp\3582-490\88ebdfa85953abe08bfa3c876312a40a220f8606ebadcae0c5f05f4a9b0c7fd8Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

\Program Files (x86)\Microsoft\DesktopLayer.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/1864-66-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/1476-68-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1864-71-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1816-72-0x00000000025F0000-0x000000000261A000-memory.dmp

memory/1068-73-0x0000000000400000-0x000000000042A000-memory.dmp

memory/1068-74-0x00000000003A0000-0x00000000003CE000-memory.dmp

memory/1068-75-0x0000000000400000-0x000000000042A000-memory.dmp

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

\Program Files (x86)\Microsoft\DesktopLayer.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/1816-78-0x00000000025F0000-0x000000000261E000-memory.dmp

memory/1816-79-0x00000000025F0000-0x000000000261E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EK0J850L.txt

MD5 ce10248e58c41df809bb8155f06e8ed1
SHA1 6f38e0e884c3f13268d94da2b4f547a82f46cfc8
SHA256 ccbbe9146f69b7e4b483a7c1e63edc9f6c9db0976515cd35059c4abddec7bd39
SHA512 fcd6a2fcb5462a61ce3526d5cf481bfc83d741af6cd467dc3cc5325e454edc204644c9af1730be02f187e7373468554e09ca1b2b84c3a8e1198d051c237811a8