Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 18:41
Static task
static1
Behavioral task
behavioral1
Sample
fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe
Resource
win10v2004-20220812-en
General
-
Target
fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe
-
Size
509KB
-
MD5
56e52149b4259610a4d13d8b5d5eebc0
-
SHA1
0d5ef726dc70c2042d40eab6fc9a0190277e7b4b
-
SHA256
fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56
-
SHA512
e3d99ac7f93196eddfd16dd2e321cbd21b2f506c467fbc16467de1172fb8fabc43058542899150d20880a94d4be8c06c203f4e85bd5dca2033773e9e772a8299
-
SSDEEP
12288:gbXvc2NgoQLebpdCxYIROscqKHmRMX+X1yEwYQg:2fyqpdMYIqHsMaEEwYQg
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 4844 DSUwMMkQ.exe 4796 eaQMQUYY.exe 1072 KCAwUogE.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation eaQMQUYY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DSUwMMkQ.exe = "C:\\Users\\Admin\\omYAcoQY\\DSUwMMkQ.exe" fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eaQMQUYY.exe = "C:\\ProgramData\\aqAMIQYE\\eaQMQUYY.exe" fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DSUwMMkQ.exe = "C:\\Users\\Admin\\omYAcoQY\\DSUwMMkQ.exe" DSUwMMkQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eaQMQUYY.exe = "C:\\ProgramData\\aqAMIQYE\\eaQMQUYY.exe" eaQMQUYY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eaQMQUYY.exe = "C:\\ProgramData\\aqAMIQYE\\eaQMQUYY.exe" KCAwUogE.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\omYAcoQY KCAwUogE.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\omYAcoQY\DSUwMMkQ KCAwUogE.exe File created C:\Windows\SysWOW64\shell32.dll.exe eaQMQUYY.exe File opened for modification C:\Windows\SysWOW64\sheRevokeCompare.mp3 eaQMQUYY.exe File opened for modification C:\Windows\SysWOW64\sheSplitConvert.pdf eaQMQUYY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 3448 reg.exe 2464 reg.exe 3252 reg.exe 3276 reg.exe 1924 reg.exe 4876 reg.exe 4456 reg.exe 1236 reg.exe 4064 reg.exe 4956 reg.exe 2276 reg.exe 4572 reg.exe 5096 reg.exe 3668 reg.exe 2768 reg.exe 1324 reg.exe 256 reg.exe 1008 reg.exe 616 reg.exe 1392 reg.exe 2848 reg.exe 760 reg.exe 3108 reg.exe 4592 reg.exe 4716 reg.exe 644 reg.exe 2208 reg.exe 3524 reg.exe 736 reg.exe 5088 reg.exe 4064 reg.exe 3812 reg.exe 2156 reg.exe 1264 reg.exe 1960 reg.exe 256 reg.exe 1464 reg.exe 4944 reg.exe 1772 reg.exe 3748 reg.exe 3256 reg.exe 3172 reg.exe 4476 reg.exe 4200 reg.exe 4132 reg.exe 2368 reg.exe 3792 reg.exe 3604 reg.exe 4624 reg.exe 1772 reg.exe 3820 reg.exe 3792 reg.exe 1344 reg.exe 648 reg.exe 4040 reg.exe 4740 reg.exe 1088 reg.exe 1020 reg.exe 1696 reg.exe 4220 reg.exe 1584 reg.exe 2392 reg.exe 4176 reg.exe 3832 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2388 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2388 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2388 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2388 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 3956 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 3956 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 3956 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 3956 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2284 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2284 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2284 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2284 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4060 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4060 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4060 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4060 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2664 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2664 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2664 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2664 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2780 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2780 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2780 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 2780 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1576 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1576 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1576 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1576 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4184 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4184 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4184 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4184 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1340 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1340 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1340 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1340 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4604 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4604 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4604 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4604 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 3172 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 3172 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 3172 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 3172 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1132 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1132 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1132 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 1132 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4312 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4312 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4312 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 4312 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4796 eaQMQUYY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe 4796 eaQMQUYY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 4844 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 80 PID 2960 wrote to memory of 4844 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 80 PID 2960 wrote to memory of 4844 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 80 PID 2960 wrote to memory of 4796 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 81 PID 2960 wrote to memory of 4796 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 81 PID 2960 wrote to memory of 4796 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 81 PID 2960 wrote to memory of 368 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 83 PID 2960 wrote to memory of 368 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 83 PID 2960 wrote to memory of 368 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 83 PID 2960 wrote to memory of 1324 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 85 PID 2960 wrote to memory of 1324 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 85 PID 2960 wrote to memory of 1324 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 85 PID 2960 wrote to memory of 2080 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 87 PID 2960 wrote to memory of 2080 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 87 PID 2960 wrote to memory of 2080 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 87 PID 2960 wrote to memory of 1936 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 90 PID 2960 wrote to memory of 1936 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 90 PID 2960 wrote to memory of 1936 2960 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 90 PID 368 wrote to memory of 212 368 cmd.exe 91 PID 368 wrote to memory of 212 368 cmd.exe 91 PID 368 wrote to memory of 212 368 cmd.exe 91 PID 212 wrote to memory of 876 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 92 PID 212 wrote to memory of 876 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 92 PID 212 wrote to memory of 876 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 92 PID 876 wrote to memory of 4944 876 cmd.exe 94 PID 876 wrote to memory of 4944 876 cmd.exe 94 PID 876 wrote to memory of 4944 876 cmd.exe 94 PID 212 wrote to memory of 616 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 95 PID 212 wrote to memory of 616 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 95 PID 212 wrote to memory of 616 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 95 PID 212 wrote to memory of 2780 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 99 PID 212 wrote to memory of 2780 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 99 PID 212 wrote to memory of 2780 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 99 PID 212 wrote to memory of 2464 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 97 PID 212 wrote to memory of 2464 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 97 PID 212 wrote to memory of 2464 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 97 PID 212 wrote to memory of 2688 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 100 PID 212 wrote to memory of 2688 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 100 PID 212 wrote to memory of 2688 212 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 100 PID 4944 wrote to memory of 1672 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 103 PID 4944 wrote to memory of 1672 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 103 PID 4944 wrote to memory of 1672 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 103 PID 4944 wrote to memory of 3792 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 105 PID 4944 wrote to memory of 3792 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 105 PID 4944 wrote to memory of 3792 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 105 PID 4944 wrote to memory of 2748 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 106 PID 4944 wrote to memory of 2748 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 106 PID 4944 wrote to memory of 2748 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 106 PID 4944 wrote to memory of 1708 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 111 PID 4944 wrote to memory of 1708 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 111 PID 4944 wrote to memory of 1708 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 111 PID 4944 wrote to memory of 3120 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 108 PID 4944 wrote to memory of 3120 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 108 PID 4944 wrote to memory of 3120 4944 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 108 PID 2688 wrote to memory of 4572 2688 cmd.exe 113 PID 2688 wrote to memory of 4572 2688 cmd.exe 113 PID 2688 wrote to memory of 4572 2688 cmd.exe 113 PID 1672 wrote to memory of 2388 1672 cmd.exe 114 PID 1672 wrote to memory of 2388 1672 cmd.exe 114 PID 1672 wrote to memory of 2388 1672 cmd.exe 114 PID 3120 wrote to memory of 4308 3120 cmd.exe 115 PID 3120 wrote to memory of 4308 3120 cmd.exe 115 PID 3120 wrote to memory of 4308 3120 cmd.exe 115 PID 2388 wrote to memory of 3284 2388 fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe"C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\omYAcoQY\DSUwMMkQ.exe"C:\Users\Admin\omYAcoQY\DSUwMMkQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4844
-
-
C:\ProgramData\aqAMIQYE\eaQMQUYY.exe"C:\ProgramData\aqAMIQYE\eaQMQUYY.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4796
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"2⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd563⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"4⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd565⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"6⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd567⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"8⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd569⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"10⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5611⤵
- Suspicious behavior: EnumeratesProcesses
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"12⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5613⤵
- Suspicious behavior: EnumeratesProcesses
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"14⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5615⤵
- Suspicious behavior: EnumeratesProcesses
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"16⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5617⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"18⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5619⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"20⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5621⤵
- Suspicious behavior: EnumeratesProcesses
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"22⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5623⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"24⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5625⤵
- Suspicious behavior: EnumeratesProcesses
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"26⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5627⤵
- Suspicious behavior: EnumeratesProcesses
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"28⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5629⤵
- Suspicious behavior: EnumeratesProcesses
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"30⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5631⤵
- Suspicious behavior: EnumeratesProcesses
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"32⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5633⤵PID:4072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"34⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5635⤵PID:4108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"36⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5637⤵PID:2520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"38⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5639⤵PID:1860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"40⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5641⤵PID:2876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"42⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5643⤵PID:4200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"44⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5645⤵PID:2588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"46⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5647⤵PID:3004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"48⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5649⤵PID:5068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"50⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5651⤵PID:2336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"52⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5653⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"54⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5655⤵PID:3204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"56⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5657⤵PID:4684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"58⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5659⤵PID:1576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"60⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5661⤵PID:3004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"62⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5663⤵PID:4080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"64⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5665⤵PID:5000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"66⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5667⤵PID:3980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"68⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5669⤵PID:2172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"70⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5671⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"72⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5673⤵PID:1308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"74⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5675⤵PID:1928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"76⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5677⤵PID:644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"78⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5679⤵PID:2836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"80⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5681⤵PID:4084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"82⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5683⤵PID:3220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"84⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5685⤵PID:3044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"86⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5687⤵PID:2304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"88⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5689⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"90⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5691⤵PID:2264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"92⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5693⤵PID:3548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"94⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5695⤵PID:3280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"96⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5697⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"98⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd5699⤵PID:5024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"100⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56101⤵PID:3492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"102⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56103⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"104⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56105⤵PID:1636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"106⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56107⤵PID:2624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"108⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56109⤵PID:4088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"110⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56111⤵PID:3300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"112⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56113⤵PID:3572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"114⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56115⤵PID:1508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"116⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56117⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"118⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56119⤵PID:976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"120⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56.exeC:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56121⤵PID:4208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdaf0c004606521918d2dd481ef53c276ae151c0d452e38053b53d80282abd56"122⤵PID:3092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-