Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 17:24
Static task
static1
Behavioral task
behavioral1
Sample
f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe
Resource
win10v2004-20220812-en
General
-
Target
f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe
-
Size
440KB
-
MD5
4e95dd509b07d6db6dbda57435cf93a0
-
SHA1
64f5bd9bfa61e5f9cbedcdd17bbdc9927c033af2
-
SHA256
f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0
-
SHA512
ebae596e1ae599e974a2779bfb438f3494977b3eb1d7839cc78b25eaa49d6a8ff82e467c59035f308f896c127611cc35d4a4cfeb92b52631bc0547944cbe8aa8
-
SSDEEP
12288:xwjRTCUts6Y9uQMZrL77QIuX9zG8uj5Hb+AqD:6dfNvQMZ77QJLu1iAqD
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 44 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe -
Executes dropped EXE 3 IoCs
pid Process 2548 SsIEUkgY.exe 4832 tYEMsUsQ.exe 4580 YKEEMkMs.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation SsIEUkgY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tYEMsUsQ.exe = "C:\\ProgramData\\UiggEIIE\\tYEMsUsQ.exe" YKEEMkMs.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SsIEUkgY.exe = "C:\\Users\\Admin\\jSsMEUMc\\SsIEUkgY.exe" f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tYEMsUsQ.exe = "C:\\ProgramData\\UiggEIIE\\tYEMsUsQ.exe" f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SsIEUkgY.exe = "C:\\Users\\Admin\\jSsMEUMc\\SsIEUkgY.exe" SsIEUkgY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tYEMsUsQ.exe = "C:\\ProgramData\\UiggEIIE\\tYEMsUsQ.exe" tYEMsUsQ.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe SsIEUkgY.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\jSsMEUMc YKEEMkMs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\jSsMEUMc\SsIEUkgY YKEEMkMs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2992 reg.exe 1876 reg.exe 3900 reg.exe 1268 reg.exe 4228 reg.exe 936 reg.exe 3788 reg.exe 4352 reg.exe 1148 reg.exe 1608 reg.exe 4236 reg.exe 780 reg.exe 4704 reg.exe 1760 reg.exe 4284 reg.exe 1592 reg.exe 3208 reg.exe 3836 reg.exe 3640 reg.exe 1672 reg.exe 2488 reg.exe 4792 reg.exe 1696 reg.exe 1112 reg.exe 4796 reg.exe 1884 reg.exe 4540 reg.exe 3180 reg.exe 4184 reg.exe 4684 reg.exe 2080 reg.exe 4684 reg.exe 3120 reg.exe 3696 reg.exe 1028 reg.exe 4460 reg.exe 4152 reg.exe 2252 reg.exe 1212 reg.exe 5000 reg.exe 2488 reg.exe 1832 reg.exe 1032 reg.exe 4524 reg.exe 1688 reg.exe 1436 reg.exe 400 reg.exe 4944 reg.exe 1148 reg.exe 1888 reg.exe 3516 reg.exe 2816 reg.exe 5036 reg.exe 2576 reg.exe 2336 reg.exe 4016 reg.exe 60 reg.exe 4332 reg.exe 4508 reg.exe 3452 reg.exe 2220 reg.exe 5092 reg.exe 616 reg.exe 4400 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 2912 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 2912 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 2912 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 2912 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4276 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4276 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4276 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4276 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1108 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1108 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1108 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 1108 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4036 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4036 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4036 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4036 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4972 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4972 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4972 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4972 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 792 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 792 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 792 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 792 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 512 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 512 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 512 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 512 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 3020 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 3020 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 3020 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 3020 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 3688 Conhost.exe 3688 Conhost.exe 3688 Conhost.exe 3688 Conhost.exe 2812 Conhost.exe 2812 Conhost.exe 2812 Conhost.exe 2812 Conhost.exe 3184 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 3184 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 3184 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 3184 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4740 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4740 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4740 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 4740 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 3760 cmd.exe 3760 cmd.exe 3760 cmd.exe 3760 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2548 SsIEUkgY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe 2548 SsIEUkgY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 2548 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 81 PID 1196 wrote to memory of 2548 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 81 PID 1196 wrote to memory of 2548 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 81 PID 1196 wrote to memory of 4832 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 82 PID 1196 wrote to memory of 4832 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 82 PID 1196 wrote to memory of 4832 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 82 PID 1196 wrote to memory of 4680 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 84 PID 1196 wrote to memory of 4680 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 84 PID 1196 wrote to memory of 4680 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 84 PID 1196 wrote to memory of 4796 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 86 PID 1196 wrote to memory of 4796 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 86 PID 1196 wrote to memory of 4796 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 86 PID 1196 wrote to memory of 4800 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 89 PID 1196 wrote to memory of 4800 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 89 PID 1196 wrote to memory of 4800 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 89 PID 4680 wrote to memory of 1092 4680 cmd.exe 88 PID 4680 wrote to memory of 1092 4680 cmd.exe 88 PID 4680 wrote to memory of 1092 4680 cmd.exe 88 PID 1196 wrote to memory of 3760 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 90 PID 1196 wrote to memory of 3760 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 90 PID 1196 wrote to memory of 3760 1196 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 90 PID 1092 wrote to memory of 400 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 93 PID 1092 wrote to memory of 400 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 93 PID 1092 wrote to memory of 400 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 93 PID 1092 wrote to memory of 4632 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 95 PID 1092 wrote to memory of 4632 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 95 PID 1092 wrote to memory of 4632 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 95 PID 1092 wrote to memory of 2600 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 102 PID 1092 wrote to memory of 2600 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 102 PID 1092 wrote to memory of 2600 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 102 PID 1092 wrote to memory of 1884 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 97 PID 1092 wrote to memory of 1884 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 97 PID 1092 wrote to memory of 1884 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 97 PID 1092 wrote to memory of 4676 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 100 PID 1092 wrote to memory of 4676 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 100 PID 1092 wrote to memory of 4676 1092 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 100 PID 400 wrote to memory of 4776 400 cmd.exe 103 PID 400 wrote to memory of 4776 400 cmd.exe 103 PID 400 wrote to memory of 4776 400 cmd.exe 103 PID 4776 wrote to memory of 2308 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 104 PID 4776 wrote to memory of 2308 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 104 PID 4776 wrote to memory of 2308 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 104 PID 2308 wrote to memory of 2912 2308 cmd.exe 106 PID 2308 wrote to memory of 2912 2308 cmd.exe 106 PID 2308 wrote to memory of 2912 2308 cmd.exe 106 PID 4776 wrote to memory of 1212 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 107 PID 4776 wrote to memory of 1212 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 107 PID 4776 wrote to memory of 1212 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 107 PID 4776 wrote to memory of 3768 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 110 PID 4776 wrote to memory of 3768 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 110 PID 4776 wrote to memory of 3768 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 110 PID 4776 wrote to memory of 3836 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 109 PID 4776 wrote to memory of 3836 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 109 PID 4776 wrote to memory of 3836 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 109 PID 4776 wrote to memory of 3648 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 111 PID 4776 wrote to memory of 3648 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 111 PID 4776 wrote to memory of 3648 4776 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 111 PID 4676 wrote to memory of 1432 4676 cmd.exe 114 PID 4676 wrote to memory of 1432 4676 cmd.exe 114 PID 4676 wrote to memory of 1432 4676 cmd.exe 114 PID 2912 wrote to memory of 4348 2912 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 116 PID 2912 wrote to memory of 4348 2912 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 116 PID 2912 wrote to memory of 4348 2912 f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe 116 PID 3648 wrote to memory of 2852 3648 cmd.exe 118 -
System policy modification 1 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe"C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\jSsMEUMc\SsIEUkgY.exe"C:\Users\Admin\jSsMEUMc\SsIEUkgY.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2548
-
-
C:\ProgramData\UiggEIIE\tYEMsUsQ.exe"C:\ProgramData\UiggEIIE\tYEMsUsQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4832
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"2⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f03⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"4⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f05⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"6⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f07⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"8⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f09⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"10⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f011⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"12⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f013⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"14⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f015⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"16⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f017⤵
- Suspicious behavior: EnumeratesProcesses
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"18⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f019⤵
- Suspicious behavior: EnumeratesProcesses
PID:512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"20⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f021⤵
- Suspicious behavior: EnumeratesProcesses
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"22⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f023⤵PID:3688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"24⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f025⤵PID:2812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"26⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f027⤵
- Suspicious behavior: EnumeratesProcesses
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"28⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f029⤵
- Suspicious behavior: EnumeratesProcesses
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"30⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f031⤵PID:3760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"32⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f033⤵PID:2320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"34⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f035⤵PID:3288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"36⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f037⤵PID:1696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"38⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f039⤵PID:4776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"40⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f041⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"42⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f043⤵PID:848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"44⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f045⤵PID:4288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"46⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f047⤵PID:1488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"48⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f049⤵PID:2608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"50⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f051⤵PID:1688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"52⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f053⤵PID:3640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"54⤵PID:2356
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵PID:3980
-
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f055⤵PID:3596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"56⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f057⤵PID:2100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"58⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f059⤵PID:372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"60⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f061⤵PID:8
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"62⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f063⤵PID:3100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"64⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f065⤵PID:2916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"66⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f067⤵PID:4676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"68⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f069⤵PID:3644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"70⤵PID:1680
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
- UAC bypass
PID:1860
-
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f071⤵PID:1828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"72⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f073⤵PID:4816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"74⤵PID:2908
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵PID:8
-
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f075⤵
- Modifies visibility of file extensions in Explorer
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"76⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f077⤵PID:3840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"78⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f079⤵PID:2240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"80⤵PID:3700
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
- UAC bypass
PID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f081⤵PID:5000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"82⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f083⤵PID:3872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"84⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f085⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"86⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exeC:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f087⤵PID:1044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0"88⤵PID:2176
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵PID:5076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hOscwEEk.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""88⤵PID:3524
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵PID:2188
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
PID:1688
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
PID:4508
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\migkssoc.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""86⤵PID:4288
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵PID:2212
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
PID:804
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵PID:4632
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
PID:3776
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MUoUIgMg.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""84⤵PID:3936
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
- Modifies visibility of file extensions in Explorer
PID:1268
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
PID:4548
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1112
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1888
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KskUsggM.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""82⤵PID:3096
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵PID:1588
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
PID:4964
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
- UAC bypass
- Modifies registry key
PID:3208
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4228
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
- Modifies registry key
PID:616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LOEcYcMo.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""80⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵PID:5044
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
- Modifies registry key
PID:4352
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
PID:1452
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qEcwcYkI.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""78⤵PID:2232
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵PID:3472
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
PID:2224
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵PID:744
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies registry key
PID:4684
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MaMsUIws.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""76⤵PID:4712
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
PID:2576
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵PID:100
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵PID:4604
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- Modifies registry key
PID:60
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3696
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EkQkIwcQ.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""74⤵PID:4780
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵PID:796
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
PID:436
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
PID:4184
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies registry key
PID:1268
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies registry key
PID:4236
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wiEIYEMI.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""72⤵PID:4920
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵PID:1880
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- Modifies registry key
PID:3120
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
- Modifies registry key
PID:1592
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hesokAoI.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""70⤵PID:1772
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵PID:1248
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
- Modifies registry key
PID:400
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- Modifies registry key
PID:3900
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
PID:2388
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3788 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:2864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\osEYoUMg.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""68⤵
- Modifies visibility of file extensions in Explorer
PID:2312 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵PID:4336
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵PID:2044
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
- Modifies registry key
PID:4016
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FaMsoAcg.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""66⤵
- Modifies visibility of file extensions in Explorer
PID:936 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵PID:4348
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- Modifies registry key
PID:2336
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- Modifies registry key
PID:1436
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1760
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MMkIsEAw.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""64⤵PID:3032
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵PID:4892
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- Modifies registry key
PID:2576
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
PID:1688 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:2304
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1696
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qwccYgwY.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""62⤵PID:3524
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵PID:1648
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵PID:1956
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵PID:2976
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
PID:5092
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:5036
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
PID:2816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bKwoUwsY.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""60⤵PID:1488
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵PID:2076
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
- Modifies registry key
PID:4704
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵PID:1112
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KocoYgAk.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""58⤵PID:4596
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵PID:3936
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV160⤵PID:1680
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- Modifies registry key
PID:1876
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵PID:5096
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵PID:4980
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
- Modifies visibility of file extensions in Explorer
PID:2380
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
PID:368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nIEcAAkA.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""56⤵PID:2992
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵PID:780
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵PID:1664
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
PID:848
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SSQYIssI.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""54⤵PID:400
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵PID:2864
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
- Modifies visibility of file extensions in Explorer
PID:3976
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- Modifies registry key
PID:4684
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- Modifies registry key
PID:1212
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
PID:1676
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1148
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
PID:3568
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jmYwwcoc.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""52⤵PID:860
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵PID:1048
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- Modifies registry key
PID:4524
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies registry key
PID:3180
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TAMUocQE.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""50⤵PID:332
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵PID:2540
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
PID:4612
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵PID:1956
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵PID:4184
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
PID:2784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nEYMIEEc.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""48⤵PID:3500
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵PID:2304
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
PID:2584
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵PID:2080
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵PID:2920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vcUwEokE.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""46⤵PID:4552
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵PID:4844
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
PID:4264
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
PID:1892
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uSIsYUEs.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""44⤵PID:4032
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵PID:1828
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
PID:2252
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵PID:1132
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4284
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵PID:2380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\swckkQcE.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""42⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4980 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵PID:3644
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵PID:2388
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies registry key
PID:2220
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wAMkEwQM.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""40⤵PID:1772
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵PID:4728
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵PID:1860
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
PID:3452
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
PID:4244
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
PID:4668
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SkUEUEAs.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""38⤵PID:2916
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵PID:3520
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵PID:4972
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies registry key
PID:936
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵PID:1984
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JkQYAckE.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""36⤵PID:532
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵PID:2188
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
PID:1832
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1608
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RoIMAEQE.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""34⤵PID:3164
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵PID:3500
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- Modifies registry key
PID:4944
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵PID:1948
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4792
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kCQgksEQ.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""32⤵PID:2908
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵PID:4756
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
PID:2852
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
PID:4152
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵PID:3976
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵PID:2312
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IIkgMAIQ.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""30⤵PID:4984
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵PID:4284
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵PID:3208
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
- Modifies visibility of file extensions in Explorer
PID:4980
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵PID:2044
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKwwwMok.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""28⤵PID:4420
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵PID:2388
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵PID:4460
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
PID:1032
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵PID:2576
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵PID:4524
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GUwEUgIM.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""26⤵PID:3980
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵PID:4332
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
PID:2488
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵PID:3404
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
PID:1640
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
PID:4800
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
PID:2080 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
- Suspicious behavior: EnumeratesProcesses
PID:3688
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4508 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
- UAC bypass
PID:4604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JWMckQEc.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""24⤵PID:1996
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵PID:4972
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
PID:4044
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵PID:3248
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JaEQgAog.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""22⤵PID:4020
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵PID:1596
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4540
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
PID:1756
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵PID:4980
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egEggMoY.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""20⤵PID:4844
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵PID:4236
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵PID:2388
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
PID:2176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QWskkEkU.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""18⤵PID:5068
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵PID:1664
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
PID:4460
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1672
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3640
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
PID:1148
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- Modifies registry key
PID:2488
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xYEQAUoY.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""16⤵PID:1884
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵PID:1660
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3516
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
PID:4268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CqcsMoow.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""14⤵PID:4932
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵PID:2100
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵PID:3288
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
PID:1488
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵PID:4032
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
PID:780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IIcIAwgc.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""12⤵PID:2800
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵PID:2908
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4400
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
PID:5000
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
PID:2992
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mCsQEcss.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""10⤵PID:1280
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵PID:3976
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵PID:4236
-
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4332
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
PID:5056
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
PID:1028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xiAgsUcc.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""8⤵PID:1304
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵PID:2768
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
PID:1212
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
PID:3836
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵PID:3768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UwsIckAQ.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""6⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵PID:2852
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
PID:4632
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
PID:1884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DSoAMMAc.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""4⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵PID:1432
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵PID:2600
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4796
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵PID:4800
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
PID:3760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gsckksgc.bat" "C:\Users\Admin\AppData\Local\Temp\f9c4fbe57e73531e344e7d96acc8222d27c04c0a4c1bfb7be5f03d95f0e262f0.exe""2⤵PID:3240
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵PID:3032
-
-
-
C:\ProgramData\IekMMcAM\YKEEMkMs.exeC:\ProgramData\IekMMcAM\YKEEMkMs.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4580
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
PID:2488
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3164
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4972
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:2920
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv V9pSgVP5mUC+Uoujn2yOBw.0.21⤵PID:2080
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3404
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3928
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3596
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
PID:4236
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:2320
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:4676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
PID:4684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434KB
MD5f2dbfd028e1a237a9d645ae3a74fdc1f
SHA17152fa168769246a336169b48ea9a42a56921961
SHA2568d4de771c0336a40f504d6e7c1d7ece7acbf1666e08ac6db27ae53f315317d75
SHA512d9818bc6099f9ccb42c65bfd0bf7f9d383355ede234a75f387187612d479a9c024422bd086d5effc2fc842008765deb3088d3b1a3eeb542a273a5f8d280cef0e
-
Filesize
434KB
MD5f2dbfd028e1a237a9d645ae3a74fdc1f
SHA17152fa168769246a336169b48ea9a42a56921961
SHA2568d4de771c0336a40f504d6e7c1d7ece7acbf1666e08ac6db27ae53f315317d75
SHA512d9818bc6099f9ccb42c65bfd0bf7f9d383355ede234a75f387187612d479a9c024422bd086d5effc2fc842008765deb3088d3b1a3eeb542a273a5f8d280cef0e
-
Filesize
435KB
MD53b2a6e36fa424ab66bf50308dc202ee9
SHA1d12adeadab861a733d5e153b94fb753825898dbf
SHA256a5f3984291e176a92d113f9e3eabc15872c29eeaf6bd48663e542f4a3ca81d3e
SHA512cae5ee3d979b7075b315de52ed1aad1559fb0c3865e67e6372bccb6b58dc0f54e459fec151f2836516bb955f9fce151e49f1669cc8cacb4d5a121f115c8f5217
-
Filesize
435KB
MD53b2a6e36fa424ab66bf50308dc202ee9
SHA1d12adeadab861a733d5e153b94fb753825898dbf
SHA256a5f3984291e176a92d113f9e3eabc15872c29eeaf6bd48663e542f4a3ca81d3e
SHA512cae5ee3d979b7075b315de52ed1aad1559fb0c3865e67e6372bccb6b58dc0f54e459fec151f2836516bb955f9fce151e49f1669cc8cacb4d5a121f115c8f5217
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
6KB
MD5a137db26123ef0010b9a5a32a99280dc
SHA15bf02a4fb41d55ec25ba5ae0d884a6f27427f3e6
SHA256ba3f69d25e4e77c54b430ccb1cd5af85fff66ec22689f0db6a9bed4fe3733bfd
SHA512b5b971b7ed99c5682896e8bbfd1aaf93e0a72aa7a4219f93908b98770a0104c6bfd81f6d0b15588a6aceffd99fa305cff0ba4946a6a27675804a273598b83e2f
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
432KB
MD5552fb7219722a2e81e806615881df85f
SHA13de21074f63ea887a92c309e4c7d1300bf42e33b
SHA25684cb00c8ae971bed0fa0d7bca909ae126dc87c5f17ec46d0d435b2af3835e04e
SHA512674afbd28a3f1fcfc2c7a613c4f20ef099f14cd81009d906501df23f81164cff9ff257387ff8fdb6fb007bfc3000efeeb12156940e10d235a6181270911d8c5a
-
Filesize
432KB
MD5552fb7219722a2e81e806615881df85f
SHA13de21074f63ea887a92c309e4c7d1300bf42e33b
SHA25684cb00c8ae971bed0fa0d7bca909ae126dc87c5f17ec46d0d435b2af3835e04e
SHA512674afbd28a3f1fcfc2c7a613c4f20ef099f14cd81009d906501df23f81164cff9ff257387ff8fdb6fb007bfc3000efeeb12156940e10d235a6181270911d8c5a