Analysis
-
max time kernel
190s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe
Resource
win10v2004-20220812-en
General
-
Target
9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe
-
Size
445KB
-
MD5
7d29491defd63eb9a66673a4e8929610
-
SHA1
7c0b58795bc86dbfeb9c3763d33e1072ccd917b4
-
SHA256
9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6
-
SHA512
fe0e531a38bad87452eb663289691239dbf3e44b6e5ea903cf383b19a664ad49520e8b6d5efe05e7f283c8badfa3c0a16c9c98f1f3cd887a7e74bc57b4db280d
-
SSDEEP
12288:4+d4na+Or3g4ADajEXYvu2XqbDjfTBc3VzF1bLbm8s3mjYyyTeH+:4++iU4ADaj6YmJbXfT23VRx7N8le+
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 3140 pEosgIws.exe 4568 nqYsIMgA.exe 3424 vWUkYkkU.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation pEosgIws.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pEosgIws.exe = "C:\\Users\\Admin\\UuEoEEYA\\pEosgIws.exe" 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nqYsIMgA.exe = "C:\\ProgramData\\YOYgwIYA\\nqYsIMgA.exe" 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pEosgIws.exe = "C:\\Users\\Admin\\UuEoEEYA\\pEosgIws.exe" pEosgIws.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nqYsIMgA.exe = "C:\\ProgramData\\YOYgwIYA\\nqYsIMgA.exe" nqYsIMgA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nqYsIMgA.exe = "C:\\ProgramData\\YOYgwIYA\\nqYsIMgA.exe" vWUkYkkU.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sheProtectUninstall.mp3 pEosgIws.exe File opened for modification C:\Windows\SysWOW64\sheReceiveShow.pdf pEosgIws.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\UuEoEEYA vWUkYkkU.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\UuEoEEYA\pEosgIws vWUkYkkU.exe File created C:\Windows\SysWOW64\shell32.dll.exe pEosgIws.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 3184 Process not Found 1916 reg.exe 5296 reg.exe 5920 reg.exe 3564 reg.exe 5040 reg.exe 4668 reg.exe 4468 reg.exe 208 reg.exe 3144 reg.exe 4288 reg.exe 5220 reg.exe 1348 reg.exe 3136 Process not Found 692 reg.exe 2040 reg.exe 1540 reg.exe 4444 reg.exe 2272 reg.exe 3944 reg.exe 5812 reg.exe 2516 reg.exe 1652 reg.exe 808 reg.exe 2744 reg.exe 880 Process not Found 5220 reg.exe 3948 Process not Found 4068 reg.exe 5976 reg.exe 532 reg.exe 5072 reg.exe 4392 reg.exe 5956 reg.exe 4012 reg.exe 3844 reg.exe 5952 reg.exe 3100 reg.exe 3932 reg.exe 4212 reg.exe 4552 reg.exe 4092 reg.exe 4596 reg.exe 4212 reg.exe 1336 reg.exe 4416 reg.exe 6136 Process not Found 2988 reg.exe 4476 reg.exe 2340 reg.exe 1752 reg.exe 4496 reg.exe 4768 reg.exe 4756 reg.exe 908 reg.exe 2988 reg.exe 1304 reg.exe 5856 reg.exe 3172 Process not Found 5304 reg.exe 752 reg.exe 1464 reg.exe 5080 reg.exe 6120 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1856 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1856 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1856 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1856 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4532 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4532 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4532 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4532 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 956 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 956 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 956 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 956 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 3844 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 3844 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 3844 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 3844 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4260 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4260 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4260 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4260 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1364 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1364 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1364 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1364 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1472 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1472 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1472 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1472 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4212 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4212 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4212 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4212 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4456 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4456 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4456 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 4456 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5036 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5036 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5036 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5036 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5424 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5424 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5424 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5424 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5560 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5560 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5560 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 5560 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 6140 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 6140 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 6140 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 6140 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 796 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 796 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 796 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 796 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1380 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1380 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1380 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 1380 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 3140 pEosgIws.exe 3140 pEosgIws.exe 3140 pEosgIws.exe 3140 pEosgIws.exe 3140 pEosgIws.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5024 wrote to memory of 3140 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 81 PID 5024 wrote to memory of 3140 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 81 PID 5024 wrote to memory of 3140 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 81 PID 5024 wrote to memory of 4568 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 82 PID 5024 wrote to memory of 4568 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 82 PID 5024 wrote to memory of 4568 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 82 PID 5024 wrote to memory of 3192 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 84 PID 5024 wrote to memory of 3192 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 84 PID 5024 wrote to memory of 3192 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 84 PID 5024 wrote to memory of 2488 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 87 PID 5024 wrote to memory of 2488 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 87 PID 5024 wrote to memory of 2488 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 87 PID 3192 wrote to memory of 1856 3192 cmd.exe 86 PID 3192 wrote to memory of 1856 3192 cmd.exe 86 PID 3192 wrote to memory of 1856 3192 cmd.exe 86 PID 5024 wrote to memory of 3916 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 90 PID 5024 wrote to memory of 3916 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 90 PID 5024 wrote to memory of 3916 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 90 PID 5024 wrote to memory of 3556 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 88 PID 5024 wrote to memory of 3556 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 88 PID 5024 wrote to memory of 3556 5024 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 88 PID 1856 wrote to memory of 2340 1856 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 93 PID 1856 wrote to memory of 2340 1856 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 93 PID 1856 wrote to memory of 2340 1856 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 93 PID 2340 wrote to memory of 4532 2340 cmd.exe 95 PID 2340 wrote to memory of 4532 2340 cmd.exe 95 PID 2340 wrote to memory of 4532 2340 cmd.exe 95 PID 4532 wrote to memory of 4388 4532 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 96 PID 4532 wrote to memory of 4388 4532 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 96 PID 4532 wrote to memory of 4388 4532 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 96 PID 4388 wrote to memory of 956 4388 cmd.exe 98 PID 4388 wrote to memory of 956 4388 cmd.exe 98 PID 4388 wrote to memory of 956 4388 cmd.exe 98 PID 956 wrote to memory of 4144 956 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 99 PID 956 wrote to memory of 4144 956 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 99 PID 956 wrote to memory of 4144 956 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 99 PID 4144 wrote to memory of 3844 4144 cmd.exe 101 PID 4144 wrote to memory of 3844 4144 cmd.exe 101 PID 4144 wrote to memory of 3844 4144 cmd.exe 101 PID 3844 wrote to memory of 4596 3844 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 102 PID 3844 wrote to memory of 4596 3844 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 102 PID 3844 wrote to memory of 4596 3844 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 102 PID 4596 wrote to memory of 4260 4596 cmd.exe 104 PID 4596 wrote to memory of 4260 4596 cmd.exe 104 PID 4596 wrote to memory of 4260 4596 cmd.exe 104 PID 4260 wrote to memory of 2056 4260 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 105 PID 4260 wrote to memory of 2056 4260 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 105 PID 4260 wrote to memory of 2056 4260 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 105 PID 2056 wrote to memory of 1364 2056 cmd.exe 107 PID 2056 wrote to memory of 1364 2056 cmd.exe 107 PID 2056 wrote to memory of 1364 2056 cmd.exe 107 PID 1364 wrote to memory of 4876 1364 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 108 PID 1364 wrote to memory of 4876 1364 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 108 PID 1364 wrote to memory of 4876 1364 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 108 PID 4876 wrote to memory of 1472 4876 cmd.exe 110 PID 4876 wrote to memory of 1472 4876 cmd.exe 110 PID 4876 wrote to memory of 1472 4876 cmd.exe 110 PID 1472 wrote to memory of 2920 1472 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 111 PID 1472 wrote to memory of 2920 1472 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 111 PID 1472 wrote to memory of 2920 1472 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 111 PID 2920 wrote to memory of 4212 2920 cmd.exe 113 PID 2920 wrote to memory of 4212 2920 cmd.exe 113 PID 2920 wrote to memory of 4212 2920 cmd.exe 113 PID 4212 wrote to memory of 5056 4212 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe 114 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe"C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\UuEoEEYA\pEosgIws.exe"C:\Users\Admin\UuEoEEYA\pEosgIws.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:3140
-
-
C:\ProgramData\YOYgwIYA\nqYsIMgA.exe"C:\ProgramData\YOYgwIYA\nqYsIMgA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4568
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"2⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c63⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"4⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c65⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"6⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c67⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"8⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c69⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"10⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c611⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"12⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c613⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"14⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c615⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"16⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c617⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"18⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c619⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"20⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c621⤵
- Suspicious behavior: EnumeratesProcesses
PID:5036 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs22⤵PID:5848
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
PID:1916
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵PID:5012
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
PID:1836
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cqIkkkwM.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""20⤵PID:3408
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵PID:5908
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
PID:1888
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵PID:4288
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵PID:1416
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hooUUMco.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""18⤵PID:4824
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵PID:5848
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4468 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵PID:5032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zOAwQQMk.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""16⤵PID:448
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵PID:5824
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵PID:1504
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵PID:2252
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4444
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵PID:1656
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵PID:2360
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hYoQEwgs.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""14⤵PID:912
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵PID:5480
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵PID:1588
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
PID:1452
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵PID:1316
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XuMYsAQQ.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""12⤵PID:1820
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵PID:5512
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵PID:1696
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
PID:2280
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵PID:1460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SoksogQQ.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""10⤵PID:1076
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵PID:5840
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵PID:2456
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- Modifies registry key
PID:4068
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵PID:4312
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OsAosAQQ.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""8⤵PID:3372
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵PID:5680
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵PID:5040
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
PID:4804
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵PID:1636
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵PID:5000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uygssAkQ.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""6⤵PID:3772
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵PID:5816
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
PID:3084
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HcAIgwIc.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""4⤵PID:3488
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵PID:5488
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
PID:4344
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵PID:2520
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
PID:2488
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵PID:3556
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵PID:3916
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MYsYwgoQ.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""2⤵PID:5752
-
-
C:\ProgramData\dMskksgQ\vWUkYkkU.exeC:\ProgramData\dMskksgQ\vWUkYkkU.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3424
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵PID:2660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LcwoMgsk.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""1⤵PID:744
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵PID:5900
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵PID:2656
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
PID:4212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"1⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c62⤵
- Suspicious behavior: EnumeratesProcesses
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"3⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c64⤵
- Suspicious behavior: EnumeratesProcesses
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"5⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c66⤵
- Suspicious behavior: EnumeratesProcesses
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"7⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c68⤵
- Suspicious behavior: EnumeratesProcesses
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"9⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c610⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"11⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c612⤵PID:4176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"13⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c614⤵PID:2444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qYscsAEo.bat" "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exe""15⤵PID:4192
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs16⤵PID:2680
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f15⤵PID:2132
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 215⤵PID:4488
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 115⤵PID:4460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"15⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c616⤵PID:4740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"17⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c618⤵PID:5432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"19⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c620⤵PID:5736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"21⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c622⤵PID:6036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"23⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c624⤵PID:2460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"25⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c626⤵PID:3492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"27⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c628⤵PID:580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"29⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c630⤵PID:3216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"31⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c632⤵PID:1504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"33⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c634⤵PID:5608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"35⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c636⤵PID:5104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"37⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c638⤵PID:4804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"39⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c640⤵PID:880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"41⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c642⤵PID:1472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"43⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c644⤵PID:5644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"45⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c646⤵PID:5548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"47⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c648⤵PID:1316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"49⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c650⤵PID:4440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"51⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c652⤵PID:3668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"53⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c654⤵PID:5736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"55⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c656⤵PID:412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"57⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c658⤵PID:3464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"59⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c660⤵PID:1664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"61⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c662⤵PID:5384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"63⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c664⤵PID:5552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"65⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c666⤵PID:4368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"67⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c668⤵PID:3028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"69⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c670⤵PID:5440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"71⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c672⤵PID:6040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"73⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c674⤵PID:1564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"75⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c676⤵PID:4108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"77⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c678⤵PID:5484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"79⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c680⤵PID:5564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"81⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c682⤵PID:3112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"83⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c684⤵PID:4132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"85⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c686⤵PID:6052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"87⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c688⤵PID:1560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"89⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c690⤵PID:4276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"91⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c692⤵PID:1148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"93⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c694⤵PID:692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"95⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c696⤵PID:2352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"97⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c698⤵PID:5288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"99⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6100⤵PID:4932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"101⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6102⤵PID:4996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"103⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6104⤵PID:4628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"105⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6106⤵PID:3980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"107⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6108⤵PID:5664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"109⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6110⤵PID:4924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"111⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6112⤵PID:2280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"113⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6114⤵PID:704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"115⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6116⤵PID:2108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"117⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6118⤵PID:2352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"119⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6120⤵PID:5748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6"121⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6.exeC:\Users\Admin\AppData\Local\Temp\9744476e066b90044db4fa5f501c4670c0ba3dc03dc07ee43fcb6ba140a741c6122⤵PID:5016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-