Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 18:41
Static task
static1
Behavioral task
behavioral1
Sample
fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe
Resource
win10v2004-20220812-en
General
-
Target
fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe
-
Size
509KB
-
MD5
56e52149b4259610a4d13d8b5d5eebc0
-
SHA1
0d5ef726dc70c2042d40eab6fc9a0190277e7b4b
-
SHA256
fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56
-
SHA512
e3d99ac7f93196eddfd16dd2e321cbd21b2f506c467fbc16467de1172fb8fabc43058542899150d20880a94d4be8c06c203f4e85bd5dca2033773e9e772a8299
-
SSDEEP
12288:gbXvc2NgoQLebpdCxYIROscqKHmRMX+X1yEwYQg:2fyqpdMYIqHsMaEEwYQg
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 1220 gCIQAgAI.exe 1520 XMoYYkUs.exe 1936 SUMAYAAE.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\ExportUnblock.png.exe XMoYYkUs.exe File created C:\Users\Admin\Pictures\ProtectEnable.png.exe XMoYYkUs.exe File created C:\Users\Admin\Pictures\SetMove.png.exe XMoYYkUs.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation XMoYYkUs.exe -
Loads dropped DLL 26 IoCs
pid Process 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe 1520 XMoYYkUs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XMoYYkUs.exe = "C:\\ProgramData\\pKAkEUoA\\XMoYYkUs.exe" fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\gCIQAgAI.exe = "C:\\Users\\Admin\\GuwgsIcA\\gCIQAgAI.exe" gCIQAgAI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XMoYYkUs.exe = "C:\\ProgramData\\pKAkEUoA\\XMoYYkUs.exe" XMoYYkUs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XMoYYkUs.exe = "C:\\ProgramData\\pKAkEUoA\\XMoYYkUs.exe" SUMAYAAE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\gCIQAgAI.exe = "C:\\Users\\Admin\\GuwgsIcA\\gCIQAgAI.exe" fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\GuwgsIcA SUMAYAAE.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\GuwgsIcA\gCIQAgAI SUMAYAAE.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico XMoYYkUs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 784 reg.exe 1564 reg.exe 1192 reg.exe 1924 reg.exe 1888 reg.exe 1192 reg.exe 1468 reg.exe 1724 reg.exe 1172 reg.exe 1644 reg.exe 276 reg.exe 2008 reg.exe 1632 reg.exe 800 reg.exe 1272 reg.exe 900 reg.exe 832 reg.exe 1636 reg.exe 1388 reg.exe 1540 reg.exe 1396 reg.exe 1016 reg.exe 1436 reg.exe 1212 reg.exe 1656 reg.exe 1392 reg.exe 1820 reg.exe 1740 reg.exe 1016 reg.exe 1072 reg.exe 892 reg.exe 1636 reg.exe 1340 reg.exe 1340 reg.exe 1656 reg.exe 1928 reg.exe 1708 reg.exe 1660 reg.exe 1940 reg.exe 1008 reg.exe 1980 reg.exe 1888 reg.exe 1492 reg.exe 1348 reg.exe 1916 reg.exe 316 reg.exe 1916 reg.exe 1192 reg.exe 1308 reg.exe 836 reg.exe 1336 reg.exe 924 reg.exe 836 reg.exe 1204 reg.exe 1892 reg.exe 784 reg.exe 268 reg.exe 1008 reg.exe 1204 reg.exe 1388 reg.exe 884 reg.exe 1660 reg.exe 1892 reg.exe 1664 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1820 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1820 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1864 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1864 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1292 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1292 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1820 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1820 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 272 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 272 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 784 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 784 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1632 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1632 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1340 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1340 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1716 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1716 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1964 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1964 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1924 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1924 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1652 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1652 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1904 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1904 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1636 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1636 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 744 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 744 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1348 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1348 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1728 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1728 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1888 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1888 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1172 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1172 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1572 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1572 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1900 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1900 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 924 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 924 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1436 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1436 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1196 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1196 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1724 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1724 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1588 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1588 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1708 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1708 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1008 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1008 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1820 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1820 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1220 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 27 PID 1968 wrote to memory of 1220 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 27 PID 1968 wrote to memory of 1220 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 27 PID 1968 wrote to memory of 1220 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 27 PID 1968 wrote to memory of 1520 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 28 PID 1968 wrote to memory of 1520 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 28 PID 1968 wrote to memory of 1520 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 28 PID 1968 wrote to memory of 1520 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 28 PID 1968 wrote to memory of 1212 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 30 PID 1968 wrote to memory of 1212 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 30 PID 1968 wrote to memory of 1212 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 30 PID 1968 wrote to memory of 1212 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 30 PID 1212 wrote to memory of 1720 1212 cmd.exe 32 PID 1212 wrote to memory of 1720 1212 cmd.exe 32 PID 1212 wrote to memory of 1720 1212 cmd.exe 32 PID 1212 wrote to memory of 1720 1212 cmd.exe 32 PID 1968 wrote to memory of 1340 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 33 PID 1968 wrote to memory of 1340 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 33 PID 1968 wrote to memory of 1340 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 33 PID 1968 wrote to memory of 1340 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 33 PID 1968 wrote to memory of 1072 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 34 PID 1968 wrote to memory of 1072 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 34 PID 1968 wrote to memory of 1072 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 34 PID 1968 wrote to memory of 1072 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 34 PID 1968 wrote to memory of 1616 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 36 PID 1968 wrote to memory of 1616 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 36 PID 1968 wrote to memory of 1616 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 36 PID 1968 wrote to memory of 1616 1968 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 36 PID 1720 wrote to memory of 780 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 39 PID 1720 wrote to memory of 780 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 39 PID 1720 wrote to memory of 780 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 39 PID 1720 wrote to memory of 780 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 39 PID 780 wrote to memory of 1980 780 cmd.exe 41 PID 780 wrote to memory of 1980 780 cmd.exe 41 PID 780 wrote to memory of 1980 780 cmd.exe 41 PID 780 wrote to memory of 1980 780 cmd.exe 41 PID 1720 wrote to memory of 1388 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 42 PID 1720 wrote to memory of 1388 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 42 PID 1720 wrote to memory of 1388 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 42 PID 1720 wrote to memory of 1388 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 42 PID 1720 wrote to memory of 1512 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 48 PID 1720 wrote to memory of 1512 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 48 PID 1720 wrote to memory of 1512 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 48 PID 1720 wrote to memory of 1512 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 48 PID 1980 wrote to memory of 1920 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 47 PID 1980 wrote to memory of 1920 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 47 PID 1980 wrote to memory of 1920 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 47 PID 1980 wrote to memory of 1920 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 47 PID 1720 wrote to memory of 1932 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 43 PID 1720 wrote to memory of 1932 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 43 PID 1720 wrote to memory of 1932 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 43 PID 1720 wrote to memory of 1932 1720 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 43 PID 1920 wrote to memory of 1820 1920 cmd.exe 50 PID 1920 wrote to memory of 1820 1920 cmd.exe 50 PID 1920 wrote to memory of 1820 1920 cmd.exe 50 PID 1920 wrote to memory of 1820 1920 cmd.exe 50 PID 1980 wrote to memory of 1008 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 51 PID 1980 wrote to memory of 1008 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 51 PID 1980 wrote to memory of 1008 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 51 PID 1980 wrote to memory of 1008 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 51 PID 1980 wrote to memory of 1756 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 58 PID 1980 wrote to memory of 1756 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 58 PID 1980 wrote to memory of 1756 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 58 PID 1980 wrote to memory of 1756 1980 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe"C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\GuwgsIcA\gCIQAgAI.exe"C:\Users\Admin\GuwgsIcA\gCIQAgAI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1220
-
-
C:\ProgramData\pKAkEUoA\XMoYYkUs.exe"C:\ProgramData\pKAkEUoA\XMoYYkUs.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
PID:1520
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"2⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd563⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"4⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd565⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"6⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd567⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"8⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd569⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"10⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5611⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"12⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5613⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"14⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5615⤵
- Suspicious behavior: EnumeratesProcesses
PID:272 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"16⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5617⤵
- Suspicious behavior: EnumeratesProcesses
PID:784 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"18⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5619⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"20⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5621⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"22⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5623⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"24⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5625⤵
- Suspicious behavior: EnumeratesProcesses
PID:1964 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"26⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5627⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"28⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5629⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"30⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5631⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"32⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5633⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"34⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5635⤵
- Suspicious behavior: EnumeratesProcesses
PID:744 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"36⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5637⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"38⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5639⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"40⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5641⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"42⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5643⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"44⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5645⤵
- Suspicious behavior: EnumeratesProcesses
PID:1572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"46⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5647⤵
- Suspicious behavior: EnumeratesProcesses
PID:1900 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"48⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5649⤵
- Suspicious behavior: EnumeratesProcesses
PID:924 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"50⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5651⤵
- Suspicious behavior: EnumeratesProcesses
PID:1436 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"52⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5653⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"54⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5655⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"56⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5657⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"58⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5659⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"60⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5661⤵
- Suspicious behavior: EnumeratesProcesses
PID:1008 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"62⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5663⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"64⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5665⤵PID:1196
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"66⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5667⤵PID:1632
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"68⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5669⤵PID:1644
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"70⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5671⤵PID:276
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"72⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5673⤵PID:744
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"74⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5675⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"76⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5677⤵PID:1072
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"78⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5679⤵PID:736
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"80⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5681⤵PID:1708
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"82⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5683⤵PID:316
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"84⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5685⤵PID:1988
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"86⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5687⤵PID:696
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"88⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5689⤵PID:1120
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"90⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5691⤵PID:1388
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"92⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5693⤵PID:1916
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"94⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5695⤵PID:1336
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"96⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5697⤵PID:1608
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"98⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5699⤵PID:1756
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"100⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56101⤵PID:1716
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"102⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56103⤵PID:1568
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"104⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56105⤵PID:1652
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"106⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56107⤵PID:1700
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"108⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56109⤵PID:800
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"110⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56111⤵PID:664
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"112⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56113⤵PID:1820
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"114⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56115⤵PID:992
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"116⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56117⤵PID:1784
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"118⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56119⤵PID:1916
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"120⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56121⤵PID:1612
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"122⤵PID:2040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-