Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/10/2024, 15:54
General
-
Target
066ab0936561ad4dfa2fae261e88c9f8_JaffaCakes118.exe
-
Size
44KB
-
MD5
066ab0936561ad4dfa2fae261e88c9f8
-
SHA1
7744b1527f945a003aecb8fd13152900e3e841ff
-
SHA256
f11ce451be90b7384aa7d1171e12fe0542751904c3af7be7af0641be3457b898
-
SHA512
2527baed6050f6c16caedd94ebdb7909ad16d25498762b39bc00d14caa0d4d4800242ae57814a0c12f6dbf4765409ca9023f3d1849bd7fbad3b312ff48b66a79
-
SSDEEP
768:ZXZfQIti1+IyHp2dXX4ssh5E9g72Uh7986dO9pRo7t8L5ZFEntNO0:ZJfQ/WHKXIsshSgbhZe9pt+ntk0
Score
7/10
Malware Config
Signatures
-
Drops startup file 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\066ab0936561ad4dfa2fae261e88c9f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\066ab0936561ad4dfa2fae261e88c9f8_JaffaCakes118.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID0022⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID0023⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID0024⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID0025⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID0026⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID0027⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID0028⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID0029⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00210⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00211⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00212⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00213⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00214⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00215⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00216⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00217⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00218⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00219⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00220⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00221⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00222⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00223⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00224⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00225⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00226⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00227⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00228⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00229⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00230⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00231⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00232⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00233⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00234⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00235⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00236⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00237⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00238⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00239⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00240⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00241⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00242⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00243⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00244⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00245⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00246⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00247⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00248⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00249⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00250⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00251⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00252⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00253⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00254⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00255⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00256⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00257⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00258⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00259⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00260⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00261⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00262⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00263⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00264⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00265⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00266⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00267⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00268⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00269⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00270⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00271⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00272⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00273⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00274⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00275⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00276⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00277⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00278⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00279⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00280⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00281⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00282⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00283⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00284⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00285⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00286⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00287⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00288⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00289⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00290⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00291⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00292⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00293⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00294⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00295⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00296⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00297⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00298⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID00299⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002100⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002101⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002102⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002103⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002104⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002105⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002106⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002107⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002108⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002109⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002110⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002111⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002112⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002113⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002114⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002115⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002116⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002117⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002118⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002119⤵
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002120⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe GID002121⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-