Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe
Resource
win10v2004-20220812-en
General
-
Target
49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe
-
Size
504KB
-
MD5
63af7fee2f39d6064aa58cd616f97400
-
SHA1
a82451a52cc6d59acc301c8dbd4f9c30c1884f4e
-
SHA256
49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297
-
SHA512
51471996cca503e9523dd084c65ba0c9a431c0dd262ae1d60cb4214343e20bd4acbc7a4e9c8884c692a074113089c8cdaf5e7eedd267f1ebb90699f14a92a14e
-
SSDEEP
12288:LFA01s79ob0Ux+DMzyAtP5Q5xEzCIyVHkZvFZT/jD5m69:nO9oAa9yV5xEzCXVHINZo69
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\yQUYgYQU\\UksEIwsM.exe," 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\yQUYgYQU\\UksEIwsM.exe," 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 3452 eMssMIss.exe 1428 UksEIwsM.exe 1212 XAEwsEsE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eMssMIss.exe = "C:\\Users\\Admin\\fcQgwwUc\\eMssMIss.exe" eMssMIss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UksEIwsM.exe = "C:\\ProgramData\\yQUYgYQU\\UksEIwsM.exe" UksEIwsM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UksEIwsM.exe = "C:\\ProgramData\\yQUYgYQU\\UksEIwsM.exe" XAEwsEsE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eMssMIss.exe = "C:\\Users\\Admin\\fcQgwwUc\\eMssMIss.exe" 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UksEIwsM.exe = "C:\\ProgramData\\yQUYgYQU\\UksEIwsM.exe" 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\fcQgwwUc XAEwsEsE.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\fcQgwwUc\eMssMIss XAEwsEsE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 1344 reg.exe 4120 reg.exe 3268 reg.exe 6268 reg.exe 5164 Process not Found 5508 reg.exe 3788 reg.exe 6756 reg.exe 5480 Process not Found 1164 reg.exe 1196 reg.exe 6744 reg.exe 5956 Process not Found 1412 Process not Found 7004 Process not Found 6552 reg.exe 6228 reg.exe 6524 reg.exe 5240 reg.exe 5908 reg.exe 5736 Process not Found 1400 Process not Found 5996 Process not Found 2256 reg.exe 6448 reg.exe 2748 reg.exe 4852 reg.exe 4780 reg.exe 5240 reg.exe 1476 reg.exe 6712 Process not Found 5676 reg.exe 6324 reg.exe 4736 reg.exe 2284 reg.exe 2924 reg.exe 6280 reg.exe 5452 Process not Found 3008 reg.exe 5532 reg.exe 6508 reg.exe 3652 reg.exe 3800 reg.exe 1316 reg.exe 6204 reg.exe 4788 reg.exe 5892 Process not Found 3988 reg.exe 1140 reg.exe 4912 Process not Found 1844 reg.exe 1248 reg.exe 1880 reg.exe 3636 Process not Found 1772 reg.exe 4716 reg.exe 6504 reg.exe 5972 reg.exe 6344 Process not Found 4252 Process not Found 6696 Process not Found 5412 Process not Found 2628 reg.exe 2080 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2960 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2960 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2960 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2960 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1344 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1344 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1344 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1344 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1344 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1200 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1200 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1200 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1200 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 4280 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 4280 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 4280 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 4280 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3832 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3832 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3832 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3832 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3608 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3608 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3608 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3608 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2924 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2924 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2924 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2924 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1636 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1636 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1636 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 1636 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3404 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3404 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3404 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3404 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 4412 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 4412 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 4412 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 4412 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2388 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2388 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2388 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 2388 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3940 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3940 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 3940 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2000 wrote to memory of 3452 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 82 PID 2000 wrote to memory of 3452 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 82 PID 2000 wrote to memory of 3452 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 82 PID 2000 wrote to memory of 1428 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 83 PID 2000 wrote to memory of 1428 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 83 PID 2000 wrote to memory of 1428 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 83 PID 2000 wrote to memory of 4528 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 85 PID 2000 wrote to memory of 4528 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 85 PID 2000 wrote to memory of 4528 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 85 PID 2000 wrote to memory of 4756 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 87 PID 2000 wrote to memory of 4756 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 87 PID 2000 wrote to memory of 4756 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 87 PID 2000 wrote to memory of 1772 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 88 PID 2000 wrote to memory of 1772 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 88 PID 2000 wrote to memory of 1772 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 88 PID 2000 wrote to memory of 308 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 89 PID 2000 wrote to memory of 308 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 89 PID 2000 wrote to memory of 308 2000 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 89 PID 4528 wrote to memory of 3776 4528 cmd.exe 93 PID 4528 wrote to memory of 3776 4528 cmd.exe 93 PID 4528 wrote to memory of 3776 4528 cmd.exe 93 PID 3776 wrote to memory of 4328 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 94 PID 3776 wrote to memory of 4328 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 94 PID 3776 wrote to memory of 4328 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 94 PID 4328 wrote to memory of 2260 4328 cmd.exe 96 PID 4328 wrote to memory of 2260 4328 cmd.exe 96 PID 4328 wrote to memory of 2260 4328 cmd.exe 96 PID 2260 wrote to memory of 4620 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 97 PID 2260 wrote to memory of 4620 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 97 PID 2260 wrote to memory of 4620 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 97 PID 4620 wrote to memory of 3588 4620 cmd.exe 99 PID 4620 wrote to memory of 3588 4620 cmd.exe 99 PID 4620 wrote to memory of 3588 4620 cmd.exe 99 PID 3776 wrote to memory of 4964 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 100 PID 3776 wrote to memory of 4964 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 100 PID 3776 wrote to memory of 4964 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 100 PID 2260 wrote to memory of 1364 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 102 PID 2260 wrote to memory of 1364 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 102 PID 2260 wrote to memory of 1364 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 102 PID 3776 wrote to memory of 4224 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 101 PID 3776 wrote to memory of 4224 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 101 PID 3776 wrote to memory of 4224 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 101 PID 2260 wrote to memory of 1164 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 104 PID 2260 wrote to memory of 1164 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 104 PID 2260 wrote to memory of 1164 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 104 PID 3776 wrote to memory of 1664 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 103 PID 3776 wrote to memory of 1664 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 103 PID 3776 wrote to memory of 1664 3776 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 103 PID 2260 wrote to memory of 5052 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 105 PID 2260 wrote to memory of 5052 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 105 PID 2260 wrote to memory of 5052 2260 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 105 PID 3588 wrote to memory of 2480 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 107 PID 3588 wrote to memory of 2480 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 107 PID 3588 wrote to memory of 2480 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 107 PID 3588 wrote to memory of 1896 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 114 PID 3588 wrote to memory of 1896 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 114 PID 3588 wrote to memory of 1896 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 114 PID 3588 wrote to memory of 1288 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 115 PID 3588 wrote to memory of 1288 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 115 PID 3588 wrote to memory of 1288 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 115 PID 3588 wrote to memory of 3480 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 117 PID 3588 wrote to memory of 3480 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 117 PID 3588 wrote to memory of 3480 3588 49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe 117 PID 2480 wrote to memory of 2960 2480 cmd.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe"C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\fcQgwwUc\eMssMIss.exe"C:\Users\Admin\fcQgwwUc\eMssMIss.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3452
-
-
C:\ProgramData\yQUYgYQU\UksEIwsM.exe"C:\ProgramData\yQUYgYQU\UksEIwsM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1428
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"2⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a72362973⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"4⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a72362975⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"6⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a72362977⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"8⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a72362979⤵
- Suspicious behavior: EnumeratesProcesses
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"10⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629711⤵
- Suspicious behavior: EnumeratesProcesses
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"12⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629713⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"14⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629715⤵
- Suspicious behavior: EnumeratesProcesses
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"16⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629717⤵
- Suspicious behavior: EnumeratesProcesses
PID:3832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"18⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629719⤵
- Suspicious behavior: EnumeratesProcesses
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"20⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629721⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"22⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629723⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"24⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629725⤵
- Suspicious behavior: EnumeratesProcesses
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"26⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629727⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"28⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629729⤵
- Suspicious behavior: EnumeratesProcesses
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"30⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629731⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"32⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629733⤵PID:3676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"34⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629735⤵PID:4572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"36⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629737⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"38⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629739⤵PID:3016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"40⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629741⤵PID:1464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"42⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629743⤵PID:4896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"44⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629745⤵PID:3088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"46⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629747⤵PID:360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"48⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629749⤵PID:2924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"50⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629751⤵PID:1604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"52⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629753⤵PID:3016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"54⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629755⤵PID:3104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"56⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629757⤵PID:5380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"58⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629759⤵PID:5500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"60⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629761⤵PID:5772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"62⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629763⤵PID:6036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"64⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629765⤵PID:5260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"66⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629767⤵PID:5516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"68⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629769⤵PID:5952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"70⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629771⤵PID:3116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"72⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629773⤵PID:2076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"74⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629775⤵PID:4032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"76⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629777⤵PID:5252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"78⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629779⤵PID:5592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"80⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629781⤵PID:5216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"82⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629783⤵PID:6120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"84⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629785⤵PID:5784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"86⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629787⤵PID:5556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"88⤵PID:6204
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629789⤵PID:6256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"90⤵PID:6480
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629791⤵PID:6528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"92⤵PID:6732
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629793⤵PID:6784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"94⤵PID:7000
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629795⤵PID:7076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"96⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629797⤵PID:5360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"98⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a723629799⤵PID:6628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"100⤵PID:6944
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297101⤵PID:6480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"102⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297103⤵PID:4260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"104⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297105⤵PID:7080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"106⤵PID:6316
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297107⤵PID:6612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"108⤵PID:6488
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297109⤵PID:6776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"110⤵PID:6792
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297111⤵PID:6312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"112⤵PID:7004
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297113⤵PID:6120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"114⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297115⤵PID:6004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"116⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297117⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"118⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297119⤵PID:5032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"120⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297.exeC:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297121⤵PID:6464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\49037200d617b69a161b94bed0c609f20e655ca896d695b7de4cc0a5a7236297"122⤵PID:5536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-