Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2024, 23:50
Behavioral task
behavioral1
Sample
765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe
Resource
win10v2004-20241007-en
General
-
Target
765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe
-
Size
1.1MB
-
MD5
62aaba7a7058dbae72b4952ac3f34cff
-
SHA1
3896accd842339d5c07b96b1a37d1ae67ac93985
-
SHA256
765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd
-
SHA512
4959e54840698622459af79420d9edc7d5c81ff327a0ae51426272a2ab2522344bb40c89929fa3c33a3c8c61d017b27ccf0bcda682e6852be03cedcd3bed5711
-
SSDEEP
12288:vD6KFvbwBwnO6X4RALpe/ZZHfGKlOc8rS5PA6nBR0umt8v7TBBR3OkEYM:vD62b6M5X4Se/ZZHuKh8rStA6B3La
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral2/files/0x000d000000023b7f-4.dat family_neshta behavioral2/files/0x000a000000023b8b-10.dat family_neshta behavioral2/memory/2224-16-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1116-20-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4928-28-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3516-32-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/820-40-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/624-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2952-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1484-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4108-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000400000002034d-77.dat family_neshta behavioral2/memory/668-81-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000600000002021c-86.dat family_neshta behavioral2/files/0x0006000000020228-85.dat family_neshta behavioral2/files/0x0006000000020220-84.dat family_neshta behavioral2/files/0x0007000000020288-83.dat family_neshta behavioral2/files/0x0004000000020313-101.dat family_neshta behavioral2/memory/2656-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4904-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4300-126-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5112-103-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000020299-100.dat family_neshta behavioral2/files/0x0004000000020352-99.dat family_neshta behavioral2/files/0x00010000000202b1-98.dat family_neshta behavioral2/files/0x0004000000020340-97.dat family_neshta behavioral2/files/0x000100000002029e-96.dat family_neshta behavioral2/files/0x000100000002022f-95.dat family_neshta behavioral2/memory/3180-127-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1552-138-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000214e5-153.dat family_neshta behavioral2/files/0x00010000000214e4-155.dat family_neshta behavioral2/files/0x00010000000214e3-151.dat family_neshta behavioral2/memory/1596-157-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000022f3d-169.dat family_neshta behavioral2/files/0x0001000000022f41-168.dat family_neshta behavioral2/files/0x0001000000022f80-180.dat family_neshta behavioral2/files/0x00010000000167cb-189.dat family_neshta behavioral2/memory/932-182-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4632-192-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4124-213-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000167cd-188.dat family_neshta behavioral2/files/0x00010000000167b2-187.dat family_neshta behavioral2/files/0x0001000000016804-186.dat family_neshta behavioral2/memory/3004-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1340-227-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4084-237-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4364-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2592-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2804-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2004-271-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2752-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4928-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2208-286-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2404-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2740-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3636-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2396-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2020-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4956-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1316-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/928-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1620-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4404-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 765AAE~1.EXE -
Executes dropped EXE 64 IoCs
pid Process 4288 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe 2224 svchost.com 1116 765AAE~1.EXE 4928 svchost.com 3516 765AAE~1.EXE 820 svchost.com 624 765AAE~1.EXE 2952 svchost.com 1484 765AAE~1.EXE 4108 svchost.com 668 765AAE~1.EXE 5112 svchost.com 2656 765AAE~1.EXE 4904 svchost.com 4300 765AAE~1.EXE 3180 svchost.com 1552 765AAE~1.EXE 1596 svchost.com 932 765AAE~1.EXE 4632 svchost.com 4124 765AAE~1.EXE 3004 svchost.com 1340 765AAE~1.EXE 4084 svchost.com 4364 765AAE~1.EXE 2592 svchost.com 2804 765AAE~1.EXE 2004 svchost.com 2752 765AAE~1.EXE 4928 svchost.com 2208 765AAE~1.EXE 2404 svchost.com 2740 765AAE~1.EXE 3636 svchost.com 2396 765AAE~1.EXE 2020 svchost.com 4956 765AAE~1.EXE 1316 svchost.com 928 765AAE~1.EXE 1620 svchost.com 4404 765AAE~1.EXE 5004 svchost.com 4556 765AAE~1.EXE 4924 svchost.com 632 765AAE~1.EXE 4740 svchost.com 3180 765AAE~1.EXE 2324 svchost.com 3696 765AAE~1.EXE 4648 svchost.com 3496 765AAE~1.EXE 2164 svchost.com 4988 765AAE~1.EXE 4996 svchost.com 1312 765AAE~1.EXE 3316 svchost.com 3200 765AAE~1.EXE 4808 svchost.com 3540 765AAE~1.EXE 3528 svchost.com 2644 765AAE~1.EXE 4084 svchost.com 536 765AAE~1.EXE 4584 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\directx.sys 765AAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 765AAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765AAE~1.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings 765AAE~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 4288 2772 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe 83 PID 2772 wrote to memory of 4288 2772 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe 83 PID 2772 wrote to memory of 4288 2772 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe 83 PID 4288 wrote to memory of 2224 4288 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe 84 PID 4288 wrote to memory of 2224 4288 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe 84 PID 4288 wrote to memory of 2224 4288 765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe 84 PID 2224 wrote to memory of 1116 2224 svchost.com 85 PID 2224 wrote to memory of 1116 2224 svchost.com 85 PID 2224 wrote to memory of 1116 2224 svchost.com 85 PID 1116 wrote to memory of 4928 1116 765AAE~1.EXE 112 PID 1116 wrote to memory of 4928 1116 765AAE~1.EXE 112 PID 1116 wrote to memory of 4928 1116 765AAE~1.EXE 112 PID 4928 wrote to memory of 3516 4928 svchost.com 87 PID 4928 wrote to memory of 3516 4928 svchost.com 87 PID 4928 wrote to memory of 3516 4928 svchost.com 87 PID 3516 wrote to memory of 820 3516 765AAE~1.EXE 88 PID 3516 wrote to memory of 820 3516 765AAE~1.EXE 88 PID 3516 wrote to memory of 820 3516 765AAE~1.EXE 88 PID 820 wrote to memory of 624 820 svchost.com 89 PID 820 wrote to memory of 624 820 svchost.com 89 PID 820 wrote to memory of 624 820 svchost.com 89 PID 624 wrote to memory of 2952 624 765AAE~1.EXE 90 PID 624 wrote to memory of 2952 624 765AAE~1.EXE 90 PID 624 wrote to memory of 2952 624 765AAE~1.EXE 90 PID 2952 wrote to memory of 1484 2952 svchost.com 91 PID 2952 wrote to memory of 1484 2952 svchost.com 91 PID 2952 wrote to memory of 1484 2952 svchost.com 91 PID 1484 wrote to memory of 4108 1484 765AAE~1.EXE 92 PID 1484 wrote to memory of 4108 1484 765AAE~1.EXE 92 PID 1484 wrote to memory of 4108 1484 765AAE~1.EXE 92 PID 4108 wrote to memory of 668 4108 svchost.com 93 PID 4108 wrote to memory of 668 4108 svchost.com 93 PID 4108 wrote to memory of 668 4108 svchost.com 93 PID 668 wrote to memory of 5112 668 765AAE~1.EXE 94 PID 668 wrote to memory of 5112 668 765AAE~1.EXE 94 PID 668 wrote to memory of 5112 668 765AAE~1.EXE 94 PID 5112 wrote to memory of 2656 5112 svchost.com 95 PID 5112 wrote to memory of 2656 5112 svchost.com 95 PID 5112 wrote to memory of 2656 5112 svchost.com 95 PID 2656 wrote to memory of 4904 2656 765AAE~1.EXE 96 PID 2656 wrote to memory of 4904 2656 765AAE~1.EXE 96 PID 2656 wrote to memory of 4904 2656 765AAE~1.EXE 96 PID 4904 wrote to memory of 4300 4904 svchost.com 97 PID 4904 wrote to memory of 4300 4904 svchost.com 97 PID 4904 wrote to memory of 4300 4904 svchost.com 97 PID 4300 wrote to memory of 3180 4300 765AAE~1.EXE 129 PID 4300 wrote to memory of 3180 4300 765AAE~1.EXE 129 PID 4300 wrote to memory of 3180 4300 765AAE~1.EXE 129 PID 3180 wrote to memory of 1552 3180 svchost.com 99 PID 3180 wrote to memory of 1552 3180 svchost.com 99 PID 3180 wrote to memory of 1552 3180 svchost.com 99 PID 1552 wrote to memory of 1596 1552 765AAE~1.EXE 100 PID 1552 wrote to memory of 1596 1552 765AAE~1.EXE 100 PID 1552 wrote to memory of 1596 1552 765AAE~1.EXE 100 PID 1596 wrote to memory of 932 1596 svchost.com 101 PID 1596 wrote to memory of 932 1596 svchost.com 101 PID 1596 wrote to memory of 932 1596 svchost.com 101 PID 932 wrote to memory of 4632 932 765AAE~1.EXE 102 PID 932 wrote to memory of 4632 932 765AAE~1.EXE 102 PID 932 wrote to memory of 4632 932 765AAE~1.EXE 102 PID 4632 wrote to memory of 4124 4632 svchost.com 103 PID 4632 wrote to memory of 4124 4632 svchost.com 103 PID 4632 wrote to memory of 4124 4632 svchost.com 103 PID 4124 wrote to memory of 3004 4124 765AAE~1.EXE 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe"C:\Users\Admin\AppData\Local\Temp\765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\765aaec5d55ec5d3654d2ad7c6acc12f33348c2ff894978efc050a8b919c09fd.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"23⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE24⤵
- Executes dropped EXE
PID:1340 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"25⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:4364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"27⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
PID:2804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"29⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"31⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE32⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"33⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE34⤵
- Executes dropped EXE
- Modifies registry class
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"35⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE36⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"37⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE38⤵
- Executes dropped EXE
PID:4956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"39⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE40⤵
- Executes dropped EXE
PID:928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"41⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
PID:4404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"43⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"45⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE46⤵
- Executes dropped EXE
- Modifies registry class
PID:632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"47⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE48⤵
- Executes dropped EXE
PID:3180 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE50⤵
- Checks computer location settings
- Executes dropped EXE
PID:3696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"51⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE52⤵
- Executes dropped EXE
- Modifies registry class
PID:3496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"53⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE54⤵
- Executes dropped EXE
PID:4988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"55⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE56⤵
- Checks computer location settings
- Executes dropped EXE
PID:1312 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"57⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"59⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE60⤵
- Executes dropped EXE
- Modifies registry class
PID:3540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"61⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE62⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"63⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE64⤵
- Executes dropped EXE
PID:536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE66⤵PID:3140
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"67⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE68⤵PID:1852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"69⤵
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE70⤵
- Modifies registry class
PID:2752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"71⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE72⤵
- Checks computer location settings
PID:3544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"73⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE74⤵
- Modifies registry class
PID:4052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"75⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE76⤵
- Checks computer location settings
- Modifies registry class
PID:5100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"77⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE78⤵
- Drops file in Windows directory
- Modifies registry class
PID:3728 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"79⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE80⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"81⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE82⤵PID:3440
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"83⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE84⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"85⤵
- Drops file in Windows directory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE86⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"87⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE88⤵
- Checks computer location settings
- Drops file in Windows directory
PID:612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"89⤵
- Drops file in Windows directory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE90⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"91⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE92⤵
- Checks computer location settings
- Modifies registry class
PID:4272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"93⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE94⤵
- Checks computer location settings
- Modifies registry class
PID:1624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"95⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE96⤵
- Modifies registry class
PID:1160 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"97⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE98⤵
- Modifies registry class
PID:2308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"99⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE100⤵
- Checks computer location settings
PID:1588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE102⤵PID:3488
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"103⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE104⤵
- System Location Discovery: System Language Discovery
PID:780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"105⤵
- Drops file in Windows directory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE106⤵PID:4348
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"107⤵
- Drops file in Windows directory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE108⤵PID:2196
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"109⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE110⤵
- Modifies registry class
PID:976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"111⤵
- System Location Discovery: System Language Discovery
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE112⤵PID:3204
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"113⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE114⤵
- Checks computer location settings
- Modifies registry class
PID:3692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:452 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE116⤵
- Modifies registry class
PID:5076 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"117⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE118⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"119⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE120⤵
- Modifies registry class
PID:4476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\765AAE~1.EXE122⤵
- Drops file in Windows directory
PID:1876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-