Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23/08/2024, 22:12
General
-
Target
bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe
-
Size
48KB
-
MD5
bd5b9329dce9d28b3ef8aba91494d54e
-
SHA1
9f3838987cf3636cb555d927829a77da660b9e18
-
SHA256
bd564910525c66d85064008b1b0bd83d0098de2fc3dc61d2ffa49e04195ed842
-
SHA512
75d28683402913fa65bd149aba35124a79fbc091450e05b8d03906c29862702a0363f1c42d410f80e5f5a866542ce63ce16a8631a4fe4bd60ef4e1661ee21a57
-
SSDEEP
768:dbZf4IlYHLIaHR2dXvq50wh5E9g7uUh7986dOXpRo7t845kFEntNOY:dlf4pXHiX+0whSgThZeXpX+ntkY
Score
7/10
Malware Config
Signatures
-
Drops startup file 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0012⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0013⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0014⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0015⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0016⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0017⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0018⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0019⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00110⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00111⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00112⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00113⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00114⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00115⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00116⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00117⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00118⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00120⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00121⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00122⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00123⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00124⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00125⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00126⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00127⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00128⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00129⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00130⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00131⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00132⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00133⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00134⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00135⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00136⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00137⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00138⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00139⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00140⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00141⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00142⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00143⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00144⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00145⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00146⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00147⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00148⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00149⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00150⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00151⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00152⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00153⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00154⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00155⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00156⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00157⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00158⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00159⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00160⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00161⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00162⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00163⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00164⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00165⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00166⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00167⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00168⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00169⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00170⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00171⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00172⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00173⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00174⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00175⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00176⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00177⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00178⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00179⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00180⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00181⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00182⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00183⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00184⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00185⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00186⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00187⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00188⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00189⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00190⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00191⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00192⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00193⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00194⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00195⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00196⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00197⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00198⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00199⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001100⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001101⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001102⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001103⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001104⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001105⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001106⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001107⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001108⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001109⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001110⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001111⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001112⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001113⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001114⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001115⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001116⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001117⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001118⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001119⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001120⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001121⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-