Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-01-2025 03:15
Behavioral task
behavioral1
Sample
ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe
-
Size
1.4MB
-
MD5
548c6df1a5d12caf303c5dc03d014ccf
-
SHA1
37d51126cd8d7c4ddc2a152cc58bd66d9be8d5fc
-
SHA256
ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da
-
SHA512
558cdb5379525fb1e03a9b66cdf733ffa5478981415b58225374a93e815cd3fdcb34cb88310e16fb8065c7d1fcb12444f28196ac6c33b18be38fe3448489f403
-
SSDEEP
24576:ZKzcVkyEq9DRho1jFP8ltPP01Ws7+wFPEl9ix4fpUzoQDt+egElxdqFWVCGCdJ:ZKzcCyEq9DRho/ctH01Ws74rA4RUBDHo
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016dd0-2.dat family_neshta behavioral1/files/0x0008000000016de4-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x000700000001033a-18.dat family_neshta behavioral1/files/0x0022000000010678-17.dat family_neshta behavioral1/memory/2732-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2072-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2652-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2900-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2704-66-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-69.dat family_neshta behavioral1/files/0x000100000000f7d8-72.dat family_neshta behavioral1/files/0x000100000000f776-75.dat family_neshta behavioral1/files/0x000100000000f7ca-78.dat family_neshta behavioral1/files/0x000100000000f7e6-81.dat family_neshta behavioral1/files/0x000100000000f703-86.dat family_neshta behavioral1/files/0x000100000000f82d-89.dat family_neshta behavioral1/files/0x000100000000f872-94.dat family_neshta behavioral1/files/0x0001000000010c12-118.dat family_neshta behavioral1/files/0x0001000000010361-117.dat family_neshta behavioral1/memory/2548-105-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2192-103-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x00010000000117fc-120.dat family_neshta behavioral1/files/0x00010000000118e3-127.dat family_neshta behavioral1/files/0x0001000000011876-125.dat family_neshta behavioral1/files/0x0001000000010f30-124.dat family_neshta behavioral1/memory/2712-136-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x00010000000118ea-147.dat family_neshta behavioral1/memory/1612-137-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2128-153-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1820-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/112-170-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1240-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1624-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1944-178-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1088-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/860-193-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1508-211-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2252-209-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-237-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1812-236-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1052-248-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/904-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2880-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2400-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1596-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/320-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2044-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1996-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2892-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-286-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2560-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3068-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2992-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1560-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2996-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1128-320-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1756-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2524-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe GoogleUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0" GoogleUpdate.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2072 svchost.com 2732 CA57E9~1.EXE 2900 svchost.com 2652 CA57E9~1.EXE 2564 svchost.com 2704 CA57E9~1.EXE 2548 svchost.com 2192 CA57E9~1.EXE 1612 svchost.com 2712 CA57E9~1.EXE 2128 svchost.com 1820 CA57E9~1.EXE 1240 svchost.com 112 CA57E9~1.EXE 1944 svchost.com 1624 CA57E9~1.EXE 1088 svchost.com 860 CA57E9~1.EXE 1508 svchost.com 2252 CA57E9~1.EXE 2168 svchost.com 1812 CA57E9~1.EXE 1052 svchost.com 904 CA57E9~1.EXE 2880 svchost.com 2400 CA57E9~1.EXE 1596 svchost.com 320 CA57E9~1.EXE 1996 svchost.com 2044 CA57E9~1.EXE 2892 svchost.com 2828 CA57E9~1.EXE 2560 svchost.com 3068 CA57E9~1.EXE 2564 svchost.com 2992 CA57E9~1.EXE 2996 svchost.com 1560 CA57E9~1.EXE 1128 svchost.com 1756 CA57E9~1.EXE 1712 svchost.com 2844 CA57E9~1.EXE 2524 svchost.com 2964 CA57E9~1.EXE 1824 svchost.com 2024 CA57E9~1.EXE 2776 svchost.com 3004 CA57E9~1.EXE 2188 svchost.com 2632 CA57E9~1.EXE 2080 svchost.com 2156 CA57E9~1.EXE 3024 svchost.com 2916 CA57E9~1.EXE 2420 svchost.com 1956 CA57E9~1.EXE 1208 svchost.com 1156 CA57E9~1.EXE 1184 svchost.com 1964 CA57E9~1.EXE 944 svchost.com 2104 CA57E9~1.EXE 2468 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 3060 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 3060 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2072 svchost.com 2072 svchost.com 2900 svchost.com 2900 svchost.com 2564 svchost.com 2564 svchost.com 2548 svchost.com 2548 svchost.com 3060 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 1612 svchost.com 1612 svchost.com 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2128 svchost.com 2128 svchost.com 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 1240 svchost.com 1240 svchost.com 1944 svchost.com 1944 svchost.com 1088 svchost.com 1088 svchost.com 1508 svchost.com 1508 svchost.com 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 2168 svchost.com 2168 svchost.com 1052 svchost.com 1052 svchost.com 2880 svchost.com 2880 svchost.com 1596 svchost.com 1596 svchost.com 1996 svchost.com 1996 svchost.com 2892 svchost.com 2892 svchost.com 2560 svchost.com 2560 svchost.com 2564 svchost.com 2564 svchost.com 2996 svchost.com 2996 svchost.com 1128 svchost.com 1128 svchost.com 1712 svchost.com 1712 svchost.com 2524 svchost.com 2524 svchost.com 1824 svchost.com 1824 svchost.com 2776 svchost.com 2776 svchost.com 2188 svchost.com 2188 svchost.com 2080 svchost.com 2080 svchost.com 3024 svchost.com 3024 svchost.com 2420 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_pt-PT.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_sl.dll CA57E9~1.EXE File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_ms.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_lv.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_mr.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_ru.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_en.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_es-419.dll CA57E9~1.EXE File opened for modification C:\Program Files (x86)\Google\Temp\GUM2972.tmp\GoogleUpdateSetup.exe CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_fil.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_zh-TW.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_ml.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_da.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_gu.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_ta.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_iw.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\GoogleUpdateSetup.exe CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_ca.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\psmachine_64.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_en-GB.dll CA57E9~1.EXE File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\GoogleUpdateBroker.exe CA57E9~1.EXE File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_sv.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_ar.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_zh-TW.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_pl.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_ml.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_mr.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_fi.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_en.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler64.exe GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_lt.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_it.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.372\psuser_64.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_ar.dll CA57E9~1.EXE File created C:\Program Files (x86)\Google\Temp\GUM2972.tmp\goopdateres_id.dll CA57E9~1.EXE File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdate.exe GoogleUpdate.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys CA57E9~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CA57E9~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA57E9~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2808 GoogleUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback\ = "GoogleUpdate Update3Web" GoogleUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69} GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32 GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ = "IBrowserHttpRequest2" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\VersionIndependentProgID\ = "GoogleUpdate.PolicyStatusMachineFallback" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CredentialDialogMachine\ = "GoogleUpdate CredentialDialog" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\ = "Update3COMClass" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\ = "11" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE} GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\ = "10" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\goopdate.dll,-1004" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID\ = "GoogleUpdate.Update3COMClassService.1.0" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ = "IPolicyStatusValue" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ProgID\ = "GoogleUpdate.OnDemandCOMClassMachine.1.0" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\goopdate.dll,-3000" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\ProgID GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CurVer\ = "GoogleUpdate.Update3COMClassService.1.0" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods\ = "4" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503} GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\GoogleUpdateOnDemand.exe\"" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ = "IAppCommand2" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll" GoogleUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\VERSIONINDEPENDENTPROGID GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\ = "GoogleUpdate CredentialDialog" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\VersionIndependentProgID GoogleUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ProgID GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ = "IPackage" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\ = "17" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ = "IAppBundle" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32 GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\ = "11" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6} GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B} GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\Elevation GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ = "IAppCommand" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods GoogleUpdateComRegisterShell64.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 964 GoogleUpdate.exe 964 GoogleUpdate.exe 964 GoogleUpdate.exe 964 GoogleUpdate.exe 964 GoogleUpdate.exe 964 GoogleUpdate.exe 964 GoogleUpdate.exe 964 GoogleUpdate.exe 964 GoogleUpdate.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 964 GoogleUpdate.exe Token: SeDebugPrivilege 964 GoogleUpdate.exe Token: SeDebugPrivilege 964 GoogleUpdate.exe Token: SeDebugPrivilege 964 GoogleUpdate.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2504 3060 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 31 PID 3060 wrote to memory of 2504 3060 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 31 PID 3060 wrote to memory of 2504 3060 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 31 PID 3060 wrote to memory of 2504 3060 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 31 PID 2504 wrote to memory of 2072 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 32 PID 2504 wrote to memory of 2072 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 32 PID 2504 wrote to memory of 2072 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 32 PID 2504 wrote to memory of 2072 2504 ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe 32 PID 2072 wrote to memory of 2732 2072 svchost.com 33 PID 2072 wrote to memory of 2732 2072 svchost.com 33 PID 2072 wrote to memory of 2732 2072 svchost.com 33 PID 2072 wrote to memory of 2732 2072 svchost.com 33 PID 2732 wrote to memory of 2900 2732 CA57E9~1.EXE 34 PID 2732 wrote to memory of 2900 2732 CA57E9~1.EXE 34 PID 2732 wrote to memory of 2900 2732 CA57E9~1.EXE 34 PID 2732 wrote to memory of 2900 2732 CA57E9~1.EXE 34 PID 2900 wrote to memory of 2652 2900 svchost.com 35 PID 2900 wrote to memory of 2652 2900 svchost.com 35 PID 2900 wrote to memory of 2652 2900 svchost.com 35 PID 2900 wrote to memory of 2652 2900 svchost.com 35 PID 2652 wrote to memory of 2564 2652 CA57E9~1.EXE 66 PID 2652 wrote to memory of 2564 2652 CA57E9~1.EXE 66 PID 2652 wrote to memory of 2564 2652 CA57E9~1.EXE 66 PID 2652 wrote to memory of 2564 2652 CA57E9~1.EXE 66 PID 2564 wrote to memory of 2704 2564 svchost.com 37 PID 2564 wrote to memory of 2704 2564 svchost.com 37 PID 2564 wrote to memory of 2704 2564 svchost.com 37 PID 2564 wrote to memory of 2704 2564 svchost.com 37 PID 2704 wrote to memory of 2548 2704 CA57E9~1.EXE 38 PID 2704 wrote to memory of 2548 2704 CA57E9~1.EXE 38 PID 2704 wrote to memory of 2548 2704 CA57E9~1.EXE 38 PID 2704 wrote to memory of 2548 2704 CA57E9~1.EXE 38 PID 2548 wrote to memory of 2192 2548 svchost.com 39 PID 2548 wrote to memory of 2192 2548 svchost.com 39 PID 2548 wrote to memory of 2192 2548 svchost.com 39 PID 2548 wrote to memory of 2192 2548 svchost.com 39 PID 2192 wrote to memory of 1612 2192 CA57E9~1.EXE 40 PID 2192 wrote to memory of 1612 2192 CA57E9~1.EXE 40 PID 2192 wrote to memory of 1612 2192 CA57E9~1.EXE 40 PID 2192 wrote to memory of 1612 2192 CA57E9~1.EXE 40 PID 1612 wrote to memory of 2712 1612 svchost.com 41 PID 1612 wrote to memory of 2712 1612 svchost.com 41 PID 1612 wrote to memory of 2712 1612 svchost.com 41 PID 1612 wrote to memory of 2712 1612 svchost.com 41 PID 2712 wrote to memory of 2128 2712 CA57E9~1.EXE 42 PID 2712 wrote to memory of 2128 2712 CA57E9~1.EXE 42 PID 2712 wrote to memory of 2128 2712 CA57E9~1.EXE 42 PID 2712 wrote to memory of 2128 2712 CA57E9~1.EXE 42 PID 2128 wrote to memory of 1820 2128 svchost.com 43 PID 2128 wrote to memory of 1820 2128 svchost.com 43 PID 2128 wrote to memory of 1820 2128 svchost.com 43 PID 2128 wrote to memory of 1820 2128 svchost.com 43 PID 1820 wrote to memory of 1240 1820 CA57E9~1.EXE 44 PID 1820 wrote to memory of 1240 1820 CA57E9~1.EXE 44 PID 1820 wrote to memory of 1240 1820 CA57E9~1.EXE 44 PID 1820 wrote to memory of 1240 1820 CA57E9~1.EXE 44 PID 1240 wrote to memory of 112 1240 svchost.com 129 PID 1240 wrote to memory of 112 1240 svchost.com 129 PID 1240 wrote to memory of 112 1240 svchost.com 129 PID 1240 wrote to memory of 112 1240 svchost.com 129 PID 112 wrote to memory of 1944 112 CA57E9~1.EXE 46 PID 112 wrote to memory of 1944 112 CA57E9~1.EXE 46 PID 112 wrote to memory of 1944 112 CA57E9~1.EXE 46 PID 112 wrote to memory of 1944 112 CA57E9~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe"C:\Users\Admin\AppData\Local\Temp\ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\ca57e99ade26b3160109b802c747f640bf5da1345b031ed5d45e4447e9eb03da.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE12⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE18⤵
- Executes dropped EXE
PID:1624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE20⤵
- Executes dropped EXE
PID:860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE22⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE24⤵
- Executes dropped EXE
PID:1812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE28⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE30⤵
- Executes dropped EXE
PID:320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE32⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE34⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE36⤵
- Executes dropped EXE
PID:3068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE40⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE42⤵
- Executes dropped EXE
PID:1756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE44⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE46⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE48⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE50⤵
- Executes dropped EXE
PID:3004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE52⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE54⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE56⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE58⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"59⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"61⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE64⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"65⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE66⤵
- Drops file in Windows directory
PID:2244 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"67⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE68⤵PID:1076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"69⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE70⤵PID:2296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"71⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE72⤵PID:2400
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"73⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE74⤵PID:320
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"75⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE76⤵
- Drops file in Windows directory
PID:2688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"77⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE78⤵PID:2660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"79⤵
- Drops file in Windows directory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE80⤵
- Drops file in Windows directory
PID:2700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"81⤵
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE82⤵PID:2556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"83⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE84⤵PID:2088
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"85⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE86⤵
- Drops file in Windows directory
PID:988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"87⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE88⤵PID:2364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"89⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE90⤵PID:396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"91⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE92⤵PID:1612
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"93⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"95⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE96⤵PID:2120
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"97⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE98⤵PID:764
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"99⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE100⤵
- System Location Discovery: System Language Discovery
PID:112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"101⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE102⤵
- Drops file in Windows directory
PID:916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"103⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE104⤵
- Drops file in Windows directory
PID:1088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"105⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE106⤵PID:1736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"107⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE108⤵
- System Location Discovery: System Language Discovery
PID:2368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"109⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE110⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"111⤵
- Drops file in Windows directory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE112⤵PID:1548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"113⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE114⤵PID:900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE116⤵
- Drops file in Windows directory
PID:1544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"117⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE118⤵
- Drops file in Windows directory
PID:1596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"119⤵
- Drops file in Windows directory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE120⤵PID:320
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CA57E9~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-