Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe
Resource
win10v2004-20220901-en
General
-
Target
02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe
-
Size
443KB
-
MD5
690d0cc7ff4229930367441d80cbcf90
-
SHA1
e74755fa9b8c7bf0482b72b341afef19b18cff59
-
SHA256
02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e
-
SHA512
7c8da38fb5ef9d54c0f87e4218a1468f3b7f61af20cc519d1f84dc114bd5590157809ae8977b58752667b6cb31b3e844edda863c4b1bd24ace22389d1e5c549a
-
SSDEEP
12288:9KFoXTOXYrhiUZ5cRhowjsdvGTUiFrH5FR:98oSXYFiVVTUipH5FR
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 636 uUQUIoQY.exe 4116 dMYMsIYI.exe 748 UKgkYkIA.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation uUQUIoQY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dMYMsIYI.exe = "C:\\ProgramData\\VKwwMoII\\dMYMsIYI.exe" dMYMsIYI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dMYMsIYI.exe = "C:\\ProgramData\\VKwwMoII\\dMYMsIYI.exe" UKgkYkIA.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uUQUIoQY.exe = "C:\\Users\\Admin\\rCEEgsMg\\uUQUIoQY.exe" 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uUQUIoQY.exe = "C:\\Users\\Admin\\rCEEgsMg\\uUQUIoQY.exe" uUQUIoQY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dMYMsIYI.exe = "C:\\ProgramData\\VKwwMoII\\dMYMsIYI.exe" 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sheRestartRestore.mp3 uUQUIoQY.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\rCEEgsMg UKgkYkIA.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\rCEEgsMg\uUQUIoQY UKgkYkIA.exe File created C:\Windows\SysWOW64\shell32.dll.exe uUQUIoQY.exe File opened for modification C:\Windows\SysWOW64\shePublishSuspend.png uUQUIoQY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 380 reg.exe 372 reg.exe 4628 reg.exe 4932 reg.exe 4608 reg.exe 1972 reg.exe 816 reg.exe 4860 reg.exe 1972 reg.exe 2856 reg.exe 1880 reg.exe 924 reg.exe 460 reg.exe 4084 reg.exe 3924 reg.exe 4736 reg.exe 4504 reg.exe 1748 reg.exe 4288 reg.exe 2116 reg.exe 1664 reg.exe 832 reg.exe 4808 reg.exe 4152 reg.exe 4312 reg.exe 1452 reg.exe 488 reg.exe 1140 reg.exe 2508 reg.exe 4076 reg.exe 3332 reg.exe 1748 reg.exe 3760 reg.exe 1200 reg.exe 4220 reg.exe 4200 reg.exe 3220 reg.exe 5072 reg.exe 4220 reg.exe 1796 reg.exe 4720 reg.exe 2352 reg.exe 3452 reg.exe 3040 reg.exe 4072 reg.exe 4176 reg.exe 3140 reg.exe 3420 reg.exe 4784 reg.exe 4020 reg.exe 1748 reg.exe 3112 reg.exe 3368 reg.exe 4792 reg.exe 560 reg.exe 4180 reg.exe 3820 reg.exe 2252 reg.exe 1876 reg.exe 4724 reg.exe 3624 reg.exe 4792 reg.exe 4584 reg.exe 1440 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4736 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4736 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4736 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4736 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 780 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 780 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 780 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 780 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 5028 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 5028 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 5028 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 5028 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4688 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4688 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4688 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4688 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 2260 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 2260 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 2260 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 2260 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3080 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3080 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3080 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3080 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 4836 Conhost.exe 4836 Conhost.exe 4836 Conhost.exe 4836 Conhost.exe 116 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 116 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 116 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 116 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1364 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1364 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1364 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1364 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1788 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1788 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1788 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1788 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 444 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 444 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 444 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 444 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1688 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1688 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1688 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 1688 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3712 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3712 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3712 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 3712 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 636 uUQUIoQY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe 636 uUQUIoQY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 636 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 81 PID 4708 wrote to memory of 636 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 81 PID 4708 wrote to memory of 636 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 81 PID 4708 wrote to memory of 4116 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 82 PID 4708 wrote to memory of 4116 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 82 PID 4708 wrote to memory of 4116 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 82 PID 4708 wrote to memory of 488 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 84 PID 4708 wrote to memory of 488 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 84 PID 4708 wrote to memory of 488 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 84 PID 488 wrote to memory of 3192 488 cmd.exe 87 PID 488 wrote to memory of 3192 488 cmd.exe 87 PID 488 wrote to memory of 3192 488 cmd.exe 87 PID 4708 wrote to memory of 1092 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 86 PID 4708 wrote to memory of 1092 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 86 PID 4708 wrote to memory of 1092 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 86 PID 4708 wrote to memory of 4784 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 91 PID 4708 wrote to memory of 4784 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 91 PID 4708 wrote to memory of 4784 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 91 PID 4708 wrote to memory of 3504 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 89 PID 4708 wrote to memory of 3504 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 89 PID 4708 wrote to memory of 3504 4708 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 89 PID 3192 wrote to memory of 5048 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 93 PID 3192 wrote to memory of 5048 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 93 PID 3192 wrote to memory of 5048 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 93 PID 3192 wrote to memory of 3452 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 95 PID 3192 wrote to memory of 3452 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 95 PID 3192 wrote to memory of 3452 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 95 PID 3192 wrote to memory of 4584 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 96 PID 3192 wrote to memory of 4584 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 96 PID 3192 wrote to memory of 4584 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 96 PID 3192 wrote to memory of 4824 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 102 PID 3192 wrote to memory of 4824 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 102 PID 3192 wrote to memory of 4824 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 102 PID 3192 wrote to memory of 3360 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 101 PID 3192 wrote to memory of 3360 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 101 PID 3192 wrote to memory of 3360 3192 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 101 PID 5048 wrote to memory of 4832 5048 cmd.exe 103 PID 5048 wrote to memory of 4832 5048 cmd.exe 103 PID 5048 wrote to memory of 4832 5048 cmd.exe 103 PID 3360 wrote to memory of 4108 3360 cmd.exe 104 PID 3360 wrote to memory of 4108 3360 cmd.exe 104 PID 3360 wrote to memory of 4108 3360 cmd.exe 104 PID 4832 wrote to memory of 5056 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 105 PID 4832 wrote to memory of 5056 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 105 PID 4832 wrote to memory of 5056 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 105 PID 4832 wrote to memory of 4444 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 107 PID 4832 wrote to memory of 4444 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 107 PID 4832 wrote to memory of 4444 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 107 PID 4832 wrote to memory of 492 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 108 PID 4832 wrote to memory of 492 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 108 PID 4832 wrote to memory of 492 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 108 PID 4832 wrote to memory of 4596 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 111 PID 4832 wrote to memory of 4596 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 111 PID 4832 wrote to memory of 4596 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 111 PID 4832 wrote to memory of 4296 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 112 PID 4832 wrote to memory of 4296 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 112 PID 4832 wrote to memory of 4296 4832 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 112 PID 5056 wrote to memory of 4736 5056 cmd.exe 114 PID 5056 wrote to memory of 4736 5056 cmd.exe 114 PID 5056 wrote to memory of 4736 5056 cmd.exe 114 PID 4296 wrote to memory of 3268 4296 cmd.exe 116 PID 4296 wrote to memory of 3268 4296 cmd.exe 116 PID 4296 wrote to memory of 3268 4296 cmd.exe 116 PID 4736 wrote to memory of 4532 4736 02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe 117 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe"C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\rCEEgsMg\uUQUIoQY.exe"C:\Users\Admin\rCEEgsMg\uUQUIoQY.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:636
-
-
C:\ProgramData\VKwwMoII\dMYMsIYI.exe"C:\ProgramData\VKwwMoII\dMYMsIYI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4116
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"2⤵
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"4⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"6⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"8⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e9⤵
- Suspicious behavior: EnumeratesProcesses
PID:780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"10⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e11⤵
- Suspicious behavior: EnumeratesProcesses
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"12⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"14⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"16⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e17⤵
- Suspicious behavior: EnumeratesProcesses
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"18⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e19⤵PID:4836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"20⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e21⤵
- Suspicious behavior: EnumeratesProcesses
PID:116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"22⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"24⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"26⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e27⤵
- Suspicious behavior: EnumeratesProcesses
PID:444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"28⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"30⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e31⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"32⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e33⤵PID:4668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"34⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e35⤵PID:3548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"36⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e37⤵PID:4712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"38⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e39⤵PID:2856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"40⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e41⤵PID:4504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"42⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e43⤵PID:3204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"44⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e45⤵PID:1048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"46⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e47⤵PID:1972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"48⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e49⤵PID:3632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"50⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e51⤵PID:3360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"52⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e53⤵PID:2028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"54⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e55⤵PID:4164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"56⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e57⤵PID:3876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"58⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e59⤵PID:836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"60⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e61⤵PID:4268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"62⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e63⤵PID:3092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"64⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e65⤵PID:4156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"66⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e67⤵PID:816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"68⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e69⤵PID:3460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"70⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e71⤵PID:1292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"72⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e73⤵PID:3508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"74⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e75⤵PID:4040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"76⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e77⤵PID:1976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"78⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e79⤵PID:2168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"80⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e81⤵PID:4268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"82⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e83⤵PID:4668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"84⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e85⤵PID:560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"86⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e87⤵PID:1776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"88⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e89⤵PID:5048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"90⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e91⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"92⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e93⤵PID:2248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"94⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e95⤵PID:3984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"96⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e97⤵PID:4076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"98⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e99⤵PID:4296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"100⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e101⤵PID:4712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"102⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e103⤵PID:4280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"104⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e105⤵PID:3776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"106⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e107⤵PID:4480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"108⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e109⤵PID:3632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"110⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e111⤵PID:4148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"112⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e113⤵PID:4592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"114⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e115⤵PID:3736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"116⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e117⤵PID:1776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"118⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e119⤵PID:3112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"120⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e.exeC:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e121⤵PID:3392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\02eaed0baa851a0bb2400164c4e871e677f7b580cf7e09541ad70e0f9a63652e"122⤵PID:4944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-