Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-01-2025 03:07
Behavioral task
behavioral1
Sample
ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe
-
Size
1.4MB
-
MD5
548c6df1a5d12caf303c5dc03d014ccf
-
SHA1
37d51126cd8d7c4ddc2a152cc58bd66d9be8d5fc
-
SHA256
ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da
-
SHA512
558cdb5379525fb1e03a9b66cdf733ffa5478981415b58225374a93e815cd3fdcb34cb88310e16fb8065c7d1fcb12444f28196ac6c33b18be38fe3448489f403
-
SSDEEP
24576:ZKzcVkyEq9DRho1jFP8ltPP01Ws7+wFPEl9ix4fpUzoQDt+egElxdqFWVCGCdJ:ZKzcCyEq9DRho/ctH01Ws74rA4RUBDHo
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x000c000000014afa-2.dat family_neshta behavioral1/files/0x0008000000014b28-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x0013000000010321-18.dat family_neshta behavioral1/files/0x005e000000010323-16.dat family_neshta behavioral1/memory/2644-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2764-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1996-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2368-168-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2100-159-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1096-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1984-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1740-142-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2340-141-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2160-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1640-175-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2136-184-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1632-192-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1576-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1300-183-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2092-200-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1528-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2260-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1940-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2896-239-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2748-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2536-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2060-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2764-283-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2672-282-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2196-254-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2500-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/532-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1092-322-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/968-199-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1488-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-128-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2460-127-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2404-353-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1028-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2812-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2860-113-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/576-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1604-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1156-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2524-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2756-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1996-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1964-370-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/444-381-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2460-382-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2040-390-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2804-389-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-398-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3036-397-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe GoogleUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0" GoogleUpdate.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2644 svchost.com 2780 CA57E9~1.EXE 2632 svchost.com 2764 CA57E9~1.EXE 2524 svchost.com 2756 CA57E9~1.EXE 2564 svchost.com 2380 CA57E9~1.EXE 1604 svchost.com 1156 CA57E9~1.EXE 576 svchost.com 2736 CA57E9~1.EXE 2812 svchost.com 2860 CA57E9~1.EXE 2868 svchost.com 2460 CA57E9~1.EXE 1740 svchost.com 2340 CA57E9~1.EXE 1096 svchost.com 1984 CA57E9~1.EXE 1996 svchost.com 2100 CA57E9~1.EXE 2368 svchost.com 1708 CA57E9~1.EXE 1640 svchost.com 2160 CA57E9~1.EXE 2136 svchost.com 1300 CA57E9~1.EXE 1632 svchost.com 1576 CA57E9~1.EXE 2092 svchost.com 968 CA57E9~1.EXE 2260 svchost.com 1528 CA57E9~1.EXE 1940 svchost.com 2896 CA57E9~1.EXE 2060 svchost.com 2196 CA57E9~1.EXE 2748 svchost.com 2536 CA57E9~1.EXE 2764 svchost.com 2672 CA57E9~1.EXE 2500 svchost.com 2784 CA57E9~1.EXE 532 svchost.com 1092 CA57E9~1.EXE 2844 svchost.com 1488 CA57E9~1.EXE 1028 svchost.com 2404 CA57E9~1.EXE 1996 svchost.com 1964 CA57E9~1.EXE 2460 svchost.com 444 CA57E9~1.EXE 2040 svchost.com 2804 CA57E9~1.EXE 2360 svchost.com 3036 CA57E9~1.EXE 1156 svchost.com 2860 CA57E9~1.EXE 2076 svchost.com 1760 CA57E9~1.EXE 1624 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2284 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2284 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2644 svchost.com 2644 svchost.com 2632 svchost.com 2632 svchost.com 2524 svchost.com 2524 svchost.com 2564 svchost.com 2564 svchost.com 1604 svchost.com 1604 svchost.com 576 svchost.com 576 svchost.com 2812 svchost.com 2812 svchost.com 2868 svchost.com 2868 svchost.com 1740 svchost.com 1740 svchost.com 1096 svchost.com 1096 svchost.com 1996 svchost.com 1996 svchost.com 2368 svchost.com 2368 svchost.com 1640 svchost.com 1640 svchost.com 2136 svchost.com 2136 svchost.com 1632 svchost.com 1632 svchost.com 2092 svchost.com 2092 svchost.com 2260 svchost.com 2260 svchost.com 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2284 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 1940 svchost.com 1940 svchost.com 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2060 svchost.com 2060 svchost.com 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2748 svchost.com 2748 svchost.com 2764 svchost.com 2764 svchost.com 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2500 svchost.com 2500 svchost.com 532 svchost.com 532 svchost.com 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2844 svchost.com 2844 svchost.com 1028 svchost.com 1028 svchost.com 1996 svchost.com 1996 svchost.com 2460 svchost.com 2460 svchost.com 2040 svchost.com 2040 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdate.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_ca.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_iw.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\GoogleUpdate.exe GoogleUpdate.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_tr.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateCore.exe GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler64.exe GoogleUpdate.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_ms.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_no.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_de.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_en.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_et.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_id.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler.exe GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_ar.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_sw.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_vi.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\psuser.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_sv.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_ur.dll CA57E9~1.EXE File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_et.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_zh-CN.dll CA57E9~1.EXE File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_fr.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_es.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_fa.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\psuser.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_hr.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_kn.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUTA4BA.tmp CA57E9~1.EXE File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUMA4B9.tmp\goopdateres_kn.dll CA57E9~1.EXE -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOOGLE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1972 GoogleUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\LocalService = "gupdatem" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods\ = "23" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\GoogleUpdateBroker.exe\"" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods\ = "10" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver" GoogleUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\ELEVATION GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32\ThreadingModel = "Both" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\ = "41" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\ = "11" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoCreateAsync.1.0\CLSID\ = "{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods\ = "23" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ProgID\ = "GoogleUpdate.CoreMachineClass.1" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\goopdate.dll,-3000" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32 GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4C0B6D8C-1ECE-47E8-8C92-4CD88C0274DA}\InprocHandler32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\NumMethods GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods GoogleUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C0B6D8C-1ECE-47E8-8C92-4CD88C0274DA}\InprocHandler32 GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback\CurVer\ = "GoogleUpdate.Update3WebMachineFallback.1.0" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\VersionIndependentProgID\ = "GoogleUpdate.Update3WebMachine" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\GoogleUpdateOnDemand.exe\"" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\VersionIndependentProgID GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "GoogleUpdate.OnDemandCOMClassMachineFallback.1.0" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VersionIndependentProgID\ = "GoogleUpdate.ProcessLauncher" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\GoogleUpdateBroker.exe\"" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82} GoogleUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910} GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine.dll" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C0B6D8C-1ECE-47E8-8C92-4CD88C0274DA}\InprocHandler32 GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CurVer\ = "GoogleUpdate.Update3WebMachine.1.0" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4} GoogleUpdate.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1980 GoogleUpdate.exe 1980 GoogleUpdate.exe 1980 GoogleUpdate.exe 1980 GoogleUpdate.exe 1980 GoogleUpdate.exe 1980 GoogleUpdate.exe 1980 GoogleUpdate.exe 1980 GoogleUpdate.exe 1980 GoogleUpdate.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1980 GoogleUpdate.exe Token: SeDebugPrivilege 1980 GoogleUpdate.exe Token: SeDebugPrivilege 1980 GoogleUpdate.exe Token: SeDebugPrivilege 1980 GoogleUpdate.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2444 2284 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 28 PID 2284 wrote to memory of 2444 2284 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 28 PID 2284 wrote to memory of 2444 2284 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 28 PID 2284 wrote to memory of 2444 2284 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 28 PID 2444 wrote to memory of 2644 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 29 PID 2444 wrote to memory of 2644 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 29 PID 2444 wrote to memory of 2644 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 29 PID 2444 wrote to memory of 2644 2444 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 29 PID 2644 wrote to memory of 2780 2644 svchost.com 30 PID 2644 wrote to memory of 2780 2644 svchost.com 30 PID 2644 wrote to memory of 2780 2644 svchost.com 30 PID 2644 wrote to memory of 2780 2644 svchost.com 30 PID 2780 wrote to memory of 2632 2780 CA57E9~1.EXE 108 PID 2780 wrote to memory of 2632 2780 CA57E9~1.EXE 108 PID 2780 wrote to memory of 2632 2780 CA57E9~1.EXE 108 PID 2780 wrote to memory of 2632 2780 CA57E9~1.EXE 108 PID 2632 wrote to memory of 2764 2632 svchost.com 69 PID 2632 wrote to memory of 2764 2632 svchost.com 69 PID 2632 wrote to memory of 2764 2632 svchost.com 69 PID 2632 wrote to memory of 2764 2632 svchost.com 69 PID 2764 wrote to memory of 2524 2764 CA57E9~1.EXE 33 PID 2764 wrote to memory of 2524 2764 CA57E9~1.EXE 33 PID 2764 wrote to memory of 2524 2764 CA57E9~1.EXE 33 PID 2764 wrote to memory of 2524 2764 CA57E9~1.EXE 33 PID 2524 wrote to memory of 2756 2524 svchost.com 112 PID 2524 wrote to memory of 2756 2524 svchost.com 112 PID 2524 wrote to memory of 2756 2524 svchost.com 112 PID 2524 wrote to memory of 2756 2524 svchost.com 112 PID 2756 wrote to memory of 2564 2756 CA57E9~1.EXE 35 PID 2756 wrote to memory of 2564 2756 CA57E9~1.EXE 35 PID 2756 wrote to memory of 2564 2756 CA57E9~1.EXE 35 PID 2756 wrote to memory of 2564 2756 CA57E9~1.EXE 35 PID 2564 wrote to memory of 2380 2564 svchost.com 36 PID 2564 wrote to memory of 2380 2564 svchost.com 36 PID 2564 wrote to memory of 2380 2564 svchost.com 36 PID 2564 wrote to memory of 2380 2564 svchost.com 36 PID 2380 wrote to memory of 1604 2380 CA57E9~1.EXE 37 PID 2380 wrote to memory of 1604 2380 CA57E9~1.EXE 37 PID 2380 wrote to memory of 1604 2380 CA57E9~1.EXE 37 PID 2380 wrote to memory of 1604 2380 CA57E9~1.EXE 37 PID 1604 wrote to memory of 1156 1604 svchost.com 87 PID 1604 wrote to memory of 1156 1604 svchost.com 87 PID 1604 wrote to memory of 1156 1604 svchost.com 87 PID 1604 wrote to memory of 1156 1604 svchost.com 87 PID 1156 wrote to memory of 576 1156 CA57E9~1.EXE 39 PID 1156 wrote to memory of 576 1156 CA57E9~1.EXE 39 PID 1156 wrote to memory of 576 1156 CA57E9~1.EXE 39 PID 1156 wrote to memory of 576 1156 CA57E9~1.EXE 39 PID 576 wrote to memory of 2736 576 svchost.com 40 PID 576 wrote to memory of 2736 576 svchost.com 40 PID 576 wrote to memory of 2736 576 svchost.com 40 PID 576 wrote to memory of 2736 576 svchost.com 40 PID 2736 wrote to memory of 2812 2736 CA57E9~1.EXE 41 PID 2736 wrote to memory of 2812 2736 CA57E9~1.EXE 41 PID 2736 wrote to memory of 2812 2736 CA57E9~1.EXE 41 PID 2736 wrote to memory of 2812 2736 CA57E9~1.EXE 41 PID 2812 wrote to memory of 2860 2812 svchost.com 88 PID 2812 wrote to memory of 2860 2812 svchost.com 88 PID 2812 wrote to memory of 2860 2812 svchost.com 88 PID 2812 wrote to memory of 2860 2812 svchost.com 88 PID 2860 wrote to memory of 2868 2860 CA57E9~1.EXE 43 PID 2860 wrote to memory of 2868 2860 CA57E9~1.EXE 43 PID 2860 wrote to memory of 2868 2860 CA57E9~1.EXE 43 PID 2860 wrote to memory of 2868 2860 CA57E9~1.EXE 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe"C:\Users\Admin\AppData\Local\Temp\ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3582-490\ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE18⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE20⤵
- Executes dropped EXE
PID:2340 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE24⤵
- Executes dropped EXE
PID:2100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE26⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2160 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE34⤵
- Executes dropped EXE
PID:968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE36⤵
- Executes dropped EXE
PID:1528 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE38⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE40⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE42⤵
- Executes dropped EXE
PID:2536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE44⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE46⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE48⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE52⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE54⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE56⤵
- Executes dropped EXE
PID:444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE58⤵
- Executes dropped EXE
PID:2804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"59⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE60⤵
- Executes dropped EXE
PID:3036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"61⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE62⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"63⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"65⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE66⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"67⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE68⤵PID:2092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"69⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE70⤵PID:1036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"71⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE72⤵PID:3032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"73⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE74⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE76⤵PID:2316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE78⤵
- Drops file in Windows directory
PID:2720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"79⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE80⤵PID:2712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"81⤵
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE82⤵PID:2632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"83⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE84⤵PID:2556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"85⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE86⤵
- Drops file in Windows directory
PID:2756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"87⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE88⤵PID:320
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"89⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE90⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"91⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE92⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"93⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE94⤵PID:1348
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"95⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE96⤵PID:2684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"97⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE98⤵PID:2336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"99⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE100⤵PID:2872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE102⤵PID:1996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"103⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE104⤵PID:1140
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"105⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE106⤵PID:1500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"107⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE108⤵PID:2188
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"109⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE110⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"111⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE112⤵PID:704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE114⤵PID:1368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"115⤵
- Drops file in Windows directory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE116⤵PID:1444
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"117⤵
- Drops file in Windows directory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE118⤵PID:1652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"119⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE120⤵PID:2260
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"121⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-