Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 12:01
Static task
static1
Behavioral task
behavioral1
Sample
e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
Resource
win10v2004-20220812-en
General
-
Target
e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
-
Size
500KB
-
MD5
741881a4decc4960fe7dcebac35e5050
-
SHA1
b8fe46ea965c3e653611933f85db0c5a8e1f4e24
-
SHA256
e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
-
SHA512
8c4d53e61d3622eb3c6ad252ca02b9ec9808f39e973746f771e096ac980050aee265e68645e3717d7075e8fd36d6c265f9d5156ae00bd9cefd736f7b57e236fe
-
SSDEEP
12288:ZlWtZnNlB2e7EQXokRUCLxSftAd7U44Vn:Xq11hRokRwui1
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 1424 MEIkQIcI.exe 3324 QCoUQUgA.exe 4416 cUoYAkMc.exe -
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MEIkQIcI.exe = "C:\\Users\\Admin\\TgwAssYQ\\MEIkQIcI.exe" e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MEIkQIcI.exe = "C:\\Users\\Admin\\TgwAssYQ\\MEIkQIcI.exe" MEIkQIcI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QCoUQUgA.exe = "C:\\ProgramData\\uiEYgwgM\\QCoUQUgA.exe" e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QCoUQUgA.exe = "C:\\ProgramData\\uiEYgwgM\\QCoUQUgA.exe" QCoUQUgA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QCoUQUgA.exe = "C:\\ProgramData\\uiEYgwgM\\QCoUQUgA.exe" cUoYAkMc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ngEAAIsY.exe = "C:\\Users\\Admin\\JuYQoEYo\\ngEAAIsY.exe" e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YMYgUsAE.exe = "C:\\ProgramData\\umIkgMkk\\YMYgUsAE.exe" e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\TgwAssYQ cUoYAkMc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\TgwAssYQ\MEIkQIcI cUoYAkMc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 332 3304 WerFault.exe 950 2532 4672 WerFault.exe 955 3700 1904 WerFault.exe 951 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 980 reg.exe 1412 reg.exe 2748 reg.exe 3652 reg.exe 4036 reg.exe 4192 reg.exe 1172 reg.exe 1892 reg.exe 4960 reg.exe 1752 reg.exe 1648 reg.exe 3972 reg.exe 2860 reg.exe 4776 reg.exe 2288 reg.exe 2220 reg.exe 1400 reg.exe 3052 reg.exe 4884 reg.exe 2632 reg.exe 4496 reg.exe 4584 reg.exe 3652 reg.exe 2344 reg.exe 5112 reg.exe 4060 reg.exe 1792 reg.exe 3168 reg.exe 2544 reg.exe 3924 reg.exe 1420 reg.exe 4648 reg.exe 2324 reg.exe 3108 reg.exe 3120 reg.exe 360 reg.exe 4072 reg.exe 1064 reg.exe 1400 reg.exe 1392 reg.exe 1880 reg.exe 4876 reg.exe 920 reg.exe 2840 reg.exe 216 reg.exe 2212 reg.exe 3048 reg.exe 2840 reg.exe 3148 reg.exe 4076 reg.exe 4328 reg.exe 5036 reg.exe 2540 reg.exe 4920 reg.exe 3712 reg.exe 2520 reg.exe 4320 reg.exe 2100 reg.exe 3116 reg.exe 4516 reg.exe 308 reg.exe 4872 reg.exe 2556 reg.exe 2056 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 932 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 932 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 932 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 932 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 2980 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 2980 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 2980 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 2980 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 480 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 480 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 480 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 480 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3216 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3216 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3216 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3216 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4192 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4192 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4192 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4192 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 1904 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 1904 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 1904 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 1904 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4656 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4656 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4656 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4656 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4652 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4652 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4652 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 4652 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 360 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 360 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 360 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 360 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3984 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3984 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3984 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3984 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3092 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3092 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3092 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3092 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 1316 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 1316 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 1316 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 1316 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3312 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3312 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3312 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 3312 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4968 wrote to memory of 1424 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 86 PID 4968 wrote to memory of 1424 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 86 PID 4968 wrote to memory of 1424 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 86 PID 4968 wrote to memory of 3324 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 87 PID 4968 wrote to memory of 3324 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 87 PID 4968 wrote to memory of 3324 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 87 PID 4968 wrote to memory of 4300 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 89 PID 4968 wrote to memory of 4300 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 89 PID 4968 wrote to memory of 4300 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 89 PID 4968 wrote to memory of 1080 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 91 PID 4968 wrote to memory of 1080 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 91 PID 4968 wrote to memory of 1080 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 91 PID 4968 wrote to memory of 308 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 94 PID 4968 wrote to memory of 308 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 94 PID 4968 wrote to memory of 308 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 94 PID 4968 wrote to memory of 4192 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 93 PID 4968 wrote to memory of 4192 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 93 PID 4968 wrote to memory of 4192 4968 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 93 PID 4300 wrote to memory of 556 4300 cmd.exe 95 PID 4300 wrote to memory of 556 4300 cmd.exe 95 PID 4300 wrote to memory of 556 4300 cmd.exe 95 PID 556 wrote to memory of 3664 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 98 PID 556 wrote to memory of 3664 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 98 PID 556 wrote to memory of 3664 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 98 PID 556 wrote to memory of 1872 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 99 PID 556 wrote to memory of 1872 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 99 PID 556 wrote to memory of 1872 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 99 PID 556 wrote to memory of 3332 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 100 PID 556 wrote to memory of 3332 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 100 PID 556 wrote to memory of 3332 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 100 PID 556 wrote to memory of 3972 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 101 PID 556 wrote to memory of 3972 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 101 PID 556 wrote to memory of 3972 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 101 PID 556 wrote to memory of 3264 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 102 PID 556 wrote to memory of 3264 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 102 PID 556 wrote to memory of 3264 556 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 102 PID 3664 wrote to memory of 832 3664 cmd.exe 108 PID 3664 wrote to memory of 832 3664 cmd.exe 108 PID 3664 wrote to memory of 832 3664 cmd.exe 108 PID 832 wrote to memory of 3976 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 109 PID 832 wrote to memory of 3976 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 109 PID 832 wrote to memory of 3976 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 109 PID 3976 wrote to memory of 932 3976 cmd.exe 111 PID 3976 wrote to memory of 932 3976 cmd.exe 111 PID 3976 wrote to memory of 932 3976 cmd.exe 111 PID 832 wrote to memory of 2548 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 112 PID 832 wrote to memory of 2548 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 112 PID 832 wrote to memory of 2548 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 112 PID 832 wrote to memory of 2620 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 113 PID 832 wrote to memory of 2620 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 113 PID 832 wrote to memory of 2620 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 113 PID 832 wrote to memory of 1564 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 114 PID 832 wrote to memory of 1564 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 114 PID 832 wrote to memory of 1564 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 114 PID 832 wrote to memory of 2612 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 116 PID 832 wrote to memory of 2612 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 116 PID 832 wrote to memory of 2612 832 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 116 PID 932 wrote to memory of 2640 932 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 120 PID 932 wrote to memory of 2640 932 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 120 PID 932 wrote to memory of 2640 932 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 120 PID 2640 wrote to memory of 2980 2640 cmd.exe 124 PID 2640 wrote to memory of 2980 2640 cmd.exe 124 PID 2640 wrote to memory of 2980 2640 cmd.exe 124 PID 932 wrote to memory of 4496 932 e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe"C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\TgwAssYQ\MEIkQIcI.exe"C:\Users\Admin\TgwAssYQ\MEIkQIcI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1424
-
-
C:\ProgramData\uiEYgwgM\QCoUQUgA.exe"C:\ProgramData\uiEYgwgM\QCoUQUgA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"2⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f2606633⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"4⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f2606635⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"6⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f2606637⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"8⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f2606639⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"10⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066311⤵
- Suspicious behavior: EnumeratesProcesses
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"12⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066313⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"14⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066315⤵
- Suspicious behavior: EnumeratesProcesses
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"16⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066317⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"18⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066319⤵
- Suspicious behavior: EnumeratesProcesses
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"20⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066321⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"22⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066323⤵
- Suspicious behavior: EnumeratesProcesses
PID:360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"24⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066325⤵
- Suspicious behavior: EnumeratesProcesses
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"26⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066327⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"28⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066329⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"30⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066331⤵
- Suspicious behavior: EnumeratesProcesses
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"32⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066333⤵PID:3372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"34⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066335⤵PID:1488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"36⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066337⤵PID:2204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"38⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066339⤵PID:4572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"40⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066341⤵PID:1592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"42⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066343⤵PID:1716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"44⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066345⤵PID:1208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"46⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066347⤵PID:4636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"48⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066349⤵PID:2336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"50⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066351⤵PID:1104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"52⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066353⤵PID:4344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"54⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066355⤵PID:1808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"56⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066357⤵PID:3372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"58⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066359⤵PID:3180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"60⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066361⤵PID:920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"62⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066363⤵PID:428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"64⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066365⤵PID:4884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"66⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066367⤵PID:2216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"68⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066369⤵PID:1832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"70⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066371⤵PID:5016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"72⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066373⤵PID:4876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"74⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066375⤵PID:1896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"76⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066377⤵PID:3688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"78⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066379⤵PID:4312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"80⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066381⤵PID:3836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"82⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066383⤵PID:2328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"84⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066385⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"86⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066387⤵PID:2336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"88⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066389⤵PID:3924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"90⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066391⤵PID:3948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"92⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066393⤵PID:4252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"94⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066395⤵PID:2868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"96⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066397⤵PID:4144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"98⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f26066399⤵PID:2192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"100⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663101⤵PID:2288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"102⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663103⤵PID:1404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"104⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663105⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"106⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663107⤵PID:2136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"108⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663109⤵PID:2204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"110⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663111⤵PID:2924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"112⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663113⤵PID:1732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"114⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663115⤵PID:4352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"116⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663117⤵PID:4692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"118⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663119⤵PID:1328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"120⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exeC:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663121⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"122⤵PID:2136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-