Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
98s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 20:01
Behavioral task
behavioral1
Sample
1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe
Resource
win10v2004-20241007-en
General
-
Target
1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe
-
Size
3.8MB
-
MD5
0e2672b7471cd2eb1a8d6b324192eac7
-
SHA1
25d8f4c9c25188dc61c3d4fd7e46de80d5f4d542
-
SHA256
1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5
-
SHA512
d827a62640f255976685fafff69d1ae1f4c9d198e622d3eaf864e89f738295464ee89724fcb45d662a67527faf2ba369b19109be0dd1d7740056f229817dd43c
-
SSDEEP
49152:CjP3KQLTi1GL6tSXAt9J4W+8Z0+0GD0AGeuVEusJ6LNzOeL0GKVIeCjF826If2y:0S3lSeuVlcm7fOKA
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral2/files/0x0008000000023cb4-4.dat family_neshta behavioral2/files/0x0007000000023cb9-11.dat family_neshta behavioral2/memory/2888-16-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2316-20-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/704-28-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/996-32-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3416-40-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2000-51-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/220-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1904-56-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5088-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3920-75-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0006000000020244-81.dat family_neshta behavioral2/files/0x0004000000020363-85.dat family_neshta behavioral2/files/0x000600000002024c-83.dat family_neshta behavioral2/files/0x0006000000020240-84.dat family_neshta behavioral2/memory/2376-88-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/464-108-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000202bd-101.dat family_neshta behavioral2/memory/508-109-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/768-113-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1456-129-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4444-144-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000021506-135.dat family_neshta behavioral2/files/0x0001000000021508-150.dat family_neshta behavioral2/files/0x0001000000021507-148.dat family_neshta behavioral2/files/0x0001000000022f4e-153.dat family_neshta behavioral2/files/0x0001000000022f4a-154.dat family_neshta behavioral2/files/0x0001000000022f4c-161.dat family_neshta behavioral2/files/0x0001000000022f4f-160.dat family_neshta behavioral2/files/0x00010000000167d2-172.dat family_neshta behavioral2/files/0x000100000001dc14-184.dat family_neshta behavioral2/files/0x00010000000167d4-171.dat family_neshta behavioral2/files/0x0001000000016920-198.dat family_neshta behavioral2/files/0x0001000000016922-193.dat family_neshta behavioral2/files/0x000100000001691d-196.dat family_neshta behavioral2/files/0x0001000000022e93-204.dat family_neshta behavioral2/files/0x0001000000022e8f-203.dat family_neshta behavioral2/files/0x0001000000016979-202.dat family_neshta behavioral2/files/0x00010000000167b9-170.dat family_neshta behavioral2/files/0x000100000001680b-169.dat family_neshta behavioral2/files/0x000300000001e8c0-212.dat family_neshta behavioral2/memory/2116-216-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000500000001e8b9-219.dat family_neshta behavioral2/files/0x000a00000001e7fa-222.dat family_neshta behavioral2/memory/2012-230-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3788-235-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2680-237-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1044-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4512-254-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1108-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3804-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2888-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2864-268-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/740-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4692-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1508-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2188-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1796-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4080-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3044-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4700-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4756-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3380-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1762A0~1.EXE -
Executes dropped EXE 64 IoCs
pid Process 3100 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe 2888 svchost.com 2316 1762A0~1.EXE 704 svchost.com 996 1762A0~1.EXE 3416 svchost.com 2000 1762A0~1.EXE 220 svchost.com 1904 1762A0~1.EXE 5088 svchost.com 3920 1762A0~1.EXE 2376 svchost.com 464 1762A0~1.EXE 508 svchost.com 768 1762A0~1.EXE 1456 svchost.com 4444 1762A0~1.EXE 2116 svchost.com 2012 1762A0~1.EXE 3788 svchost.com 2680 1762A0~1.EXE 1044 svchost.com 4512 1762A0~1.EXE 1108 svchost.com 3804 1762A0~1.EXE 2888 svchost.com 2864 1762A0~1.EXE 740 svchost.com 4692 1762A0~1.EXE 1508 svchost.com 2188 1762A0~1.EXE 1796 svchost.com 4080 1762A0~1.EXE 3044 svchost.com 4700 1762A0~1.EXE 4756 svchost.com 3380 1762A0~1.EXE 828 svchost.com 3048 1762A0~1.EXE 448 svchost.com 1528 1762A0~1.EXE 2088 svchost.com 508 1762A0~1.EXE 3372 svchost.com 4356 1762A0~1.EXE 848 svchost.com 1268 1762A0~1.EXE 2460 svchost.com 692 1762A0~1.EXE 372 svchost.com 4708 1762A0~1.EXE 4524 svchost.com 4252 1762A0~1.EXE 2168 svchost.com 2036 1762A0~1.EXE 4052 svchost.com 744 1762A0~1.EXE 3788 svchost.com 1564 1762A0~1.EXE 3604 svchost.com 4264 1762A0~1.EXE 1980 svchost.com 2656 1762A0~1.EXE 1168 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1762A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1762A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1762A0~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762A0~1.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1762A0~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3428 wrote to memory of 3100 3428 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe 84 PID 3428 wrote to memory of 3100 3428 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe 84 PID 3428 wrote to memory of 3100 3428 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe 84 PID 3100 wrote to memory of 2888 3100 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe 85 PID 3100 wrote to memory of 2888 3100 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe 85 PID 3100 wrote to memory of 2888 3100 1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe 85 PID 2888 wrote to memory of 2316 2888 svchost.com 86 PID 2888 wrote to memory of 2316 2888 svchost.com 86 PID 2888 wrote to memory of 2316 2888 svchost.com 86 PID 2316 wrote to memory of 704 2316 1762A0~1.EXE 87 PID 2316 wrote to memory of 704 2316 1762A0~1.EXE 87 PID 2316 wrote to memory of 704 2316 1762A0~1.EXE 87 PID 704 wrote to memory of 996 704 svchost.com 88 PID 704 wrote to memory of 996 704 svchost.com 88 PID 704 wrote to memory of 996 704 svchost.com 88 PID 996 wrote to memory of 3416 996 1762A0~1.EXE 89 PID 996 wrote to memory of 3416 996 1762A0~1.EXE 89 PID 996 wrote to memory of 3416 996 1762A0~1.EXE 89 PID 3416 wrote to memory of 2000 3416 svchost.com 90 PID 3416 wrote to memory of 2000 3416 svchost.com 90 PID 3416 wrote to memory of 2000 3416 svchost.com 90 PID 2000 wrote to memory of 220 2000 1762A0~1.EXE 91 PID 2000 wrote to memory of 220 2000 1762A0~1.EXE 91 PID 2000 wrote to memory of 220 2000 1762A0~1.EXE 91 PID 220 wrote to memory of 1904 220 svchost.com 92 PID 220 wrote to memory of 1904 220 svchost.com 92 PID 220 wrote to memory of 1904 220 svchost.com 92 PID 1904 wrote to memory of 5088 1904 1762A0~1.EXE 155 PID 1904 wrote to memory of 5088 1904 1762A0~1.EXE 155 PID 1904 wrote to memory of 5088 1904 1762A0~1.EXE 155 PID 5088 wrote to memory of 3920 5088 svchost.com 94 PID 5088 wrote to memory of 3920 5088 svchost.com 94 PID 5088 wrote to memory of 3920 5088 svchost.com 94 PID 3920 wrote to memory of 2376 3920 1762A0~1.EXE 95 PID 3920 wrote to memory of 2376 3920 1762A0~1.EXE 95 PID 3920 wrote to memory of 2376 3920 1762A0~1.EXE 95 PID 2376 wrote to memory of 464 2376 svchost.com 96 PID 2376 wrote to memory of 464 2376 svchost.com 96 PID 2376 wrote to memory of 464 2376 svchost.com 96 PID 464 wrote to memory of 508 464 1762A0~1.EXE 126 PID 464 wrote to memory of 508 464 1762A0~1.EXE 126 PID 464 wrote to memory of 508 464 1762A0~1.EXE 126 PID 508 wrote to memory of 768 508 svchost.com 163 PID 508 wrote to memory of 768 508 svchost.com 163 PID 508 wrote to memory of 768 508 svchost.com 163 PID 768 wrote to memory of 1456 768 1762A0~1.EXE 99 PID 768 wrote to memory of 1456 768 1762A0~1.EXE 99 PID 768 wrote to memory of 1456 768 1762A0~1.EXE 99 PID 1456 wrote to memory of 4444 1456 svchost.com 100 PID 1456 wrote to memory of 4444 1456 svchost.com 100 PID 1456 wrote to memory of 4444 1456 svchost.com 100 PID 4444 wrote to memory of 2116 4444 1762A0~1.EXE 101 PID 4444 wrote to memory of 2116 4444 1762A0~1.EXE 101 PID 4444 wrote to memory of 2116 4444 1762A0~1.EXE 101 PID 2116 wrote to memory of 2012 2116 svchost.com 102 PID 2116 wrote to memory of 2012 2116 svchost.com 102 PID 2116 wrote to memory of 2012 2116 svchost.com 102 PID 2012 wrote to memory of 3788 2012 1762A0~1.EXE 141 PID 2012 wrote to memory of 3788 2012 1762A0~1.EXE 141 PID 2012 wrote to memory of 3788 2012 1762A0~1.EXE 141 PID 3788 wrote to memory of 2680 3788 svchost.com 180 PID 3788 wrote to memory of 2680 3788 svchost.com 180 PID 3788 wrote to memory of 2680 3788 svchost.com 180 PID 2680 wrote to memory of 1044 2680 1762A0~1.EXE 181
Processes
-
C:\Users\Admin\AppData\Local\Temp\1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe"C:\Users\Admin\AppData\Local\Temp\1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1762a0a3de3d353469925c435ceafcfeebe005d3735386439ff0f0131f5925b5.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"23⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"25⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"27⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE28⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
PID:4692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"31⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE32⤵
- Executes dropped EXE
PID:2188 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"37⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE40⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"41⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"43⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"45⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE46⤵
- Executes dropped EXE
PID:4356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"47⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE48⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"49⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE50⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"51⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE52⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE54⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"55⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE56⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE58⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE60⤵
- Executes dropped EXE
- Modifies registry class
PID:1564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE62⤵
- Executes dropped EXE
PID:4264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE64⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:2656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE66⤵
- Modifies registry class
PID:4256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"67⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE68⤵
- Checks computer location settings
PID:704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"69⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE70⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"71⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE72⤵
- Checks computer location settings
PID:4080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"73⤵
- Drops file in Windows directory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE74⤵
- Checks computer location settings
PID:3172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"75⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE76⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:2016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"77⤵
- Drops file in Windows directory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE78⤵
- Modifies registry class
PID:3048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"79⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE80⤵
- Modifies registry class
PID:4836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"81⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE82⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"83⤵
- Drops file in Windows directory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE84⤵PID:4356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"85⤵
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE86⤵
- Modifies registry class
PID:2436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"87⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE88⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"89⤵
- Drops file in Windows directory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE90⤵
- Checks computer location settings
PID:4392 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"91⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE92⤵
- Modifies registry class
PID:4780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"93⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE94⤵PID:3644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"95⤵
- Drops file in Windows directory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE96⤵
- Checks computer location settings
- Modifies registry class
PID:1408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"97⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE98⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"99⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE100⤵PID:1052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"101⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE102⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:1460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"103⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE104⤵
- Drops file in Windows directory
- Modifies registry class
PID:4396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"105⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE106⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"107⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE108⤵
- Drops file in Windows directory
PID:528 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"109⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE110⤵
- Drops file in Windows directory
- Modifies registry class
PID:1996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"111⤵
- Drops file in Windows directory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE112⤵
- Checks computer location settings
PID:4756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"113⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE114⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE116⤵
- Drops file in Windows directory
PID:532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"117⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE118⤵
- Checks computer location settings
PID:1556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"119⤵
- System Location Discovery: System Language Discovery
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE120⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:3004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE"121⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1762A0~1.EXE122⤵
- Checks computer location settings
- Modifies registry class
PID:4444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-