Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe
Resource
win10v2004-20220812-en
General
-
Target
15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe
-
Size
494KB
-
MD5
963383bf67029c42d33c0c98fc1c0860
-
SHA1
78b0b4ab6f19ddd86965169fb387a470b52415f7
-
SHA256
15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b
-
SHA512
6d3bed1bde87dfba0d43eeebe8722b00e6c235d28f1810b7c65eaaa6ab7ff876569d0d6353c93ca4f040b57c17f8de9ddeb553a7f91581701c2bd797e02f8ec0
-
SSDEEP
12288:eOiR3CeCMyLcQNTl0xNLQVNA6Q42Ip3mbUeUlO02lUZG:eOEyLuxaV1vp3N2H
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\ccYIwccU\\LAkAogoA.exe," 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\ccYIwccU\\LAkAogoA.exe," 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 4220 vowgQsgs.exe 3604 hiIAgQgw.exe 116 LAkAogoA.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation vowgQsgs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vowgQsgs.exe = "C:\\Users\\Admin\\AecQgUoE\\vowgQsgs.exe" 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vowgQsgs.exe = "C:\\Users\\Admin\\AecQgUoE\\vowgQsgs.exe" vowgQsgs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAkAogoA.exe = "C:\\ProgramData\\ccYIwccU\\LAkAogoA.exe" 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAkAogoA.exe = "C:\\ProgramData\\ccYIwccU\\LAkAogoA.exe" LAkAogoA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAkAogoA.exe = "C:\\ProgramData\\ccYIwccU\\LAkAogoA.exe" hiIAgQgw.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AecQgUoE hiIAgQgw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AecQgUoE\vowgQsgs hiIAgQgw.exe File created C:\Windows\SysWOW64\shell32.dll.exe vowgQsgs.exe File opened for modification C:\Windows\SysWOW64\sheRestartRename.rar vowgQsgs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2940 reg.exe 5548 reg.exe 4988 reg.exe 4288 reg.exe 5652 reg.exe 2180 reg.exe 2196 reg.exe 5596 reg.exe 4648 reg.exe 1276 reg.exe 2988 reg.exe 2008 reg.exe 4620 reg.exe 1180 reg.exe 6016 reg.exe 2840 reg.exe 2400 reg.exe 5056 reg.exe 1420 reg.exe 3680 reg.exe 5764 reg.exe 3504 reg.exe 4888 reg.exe 908 reg.exe 5336 reg.exe 5272 reg.exe 2236 reg.exe 5236 reg.exe 5524 reg.exe 5232 reg.exe 5556 reg.exe 2988 reg.exe 2992 reg.exe 5684 reg.exe 4940 reg.exe 5308 reg.exe 3856 reg.exe 4376 reg.exe 1324 reg.exe 2180 reg.exe 1944 reg.exe 5420 reg.exe 428 reg.exe 6028 reg.exe 5492 reg.exe 5992 reg.exe 3308 reg.exe 4480 reg.exe 4864 reg.exe 4588 reg.exe 5076 reg.exe 2636 reg.exe 5912 reg.exe 3576 reg.exe 1368 reg.exe 1660 reg.exe 1348 reg.exe 5404 reg.exe 5272 reg.exe 3612 reg.exe 3264 reg.exe 4476 reg.exe 1488 reg.exe 3360 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2420 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2420 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2420 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2420 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3360 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3360 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3360 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3360 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3792 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3792 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3792 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3792 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1968 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1968 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1968 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1968 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2180 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2180 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2180 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 2180 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4384 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4384 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4384 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4384 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4404 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4404 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4404 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4404 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1348 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1348 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1348 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1348 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3672 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3672 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3672 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 3672 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4592 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4592 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4592 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 4592 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 5056 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 5056 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 5056 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 5056 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1188 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1188 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1188 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 1188 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe 4220 vowgQsgs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1908 wrote to memory of 4220 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 82 PID 1908 wrote to memory of 4220 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 82 PID 1908 wrote to memory of 4220 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 82 PID 1908 wrote to memory of 116 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 84 PID 1908 wrote to memory of 116 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 84 PID 1908 wrote to memory of 116 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 84 PID 1908 wrote to memory of 1064 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 85 PID 1908 wrote to memory of 1064 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 85 PID 1908 wrote to memory of 1064 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 85 PID 1908 wrote to memory of 4872 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 86 PID 1908 wrote to memory of 4872 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 86 PID 1908 wrote to memory of 4872 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 86 PID 1908 wrote to memory of 908 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 87 PID 1908 wrote to memory of 908 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 87 PID 1908 wrote to memory of 908 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 87 PID 1908 wrote to memory of 4516 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 88 PID 1908 wrote to memory of 4516 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 88 PID 1908 wrote to memory of 4516 1908 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 88 PID 1064 wrote to memory of 4232 1064 cmd.exe 93 PID 1064 wrote to memory of 4232 1064 cmd.exe 93 PID 1064 wrote to memory of 4232 1064 cmd.exe 93 PID 4232 wrote to memory of 1256 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 94 PID 4232 wrote to memory of 1256 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 94 PID 4232 wrote to memory of 1256 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 94 PID 4232 wrote to memory of 3716 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 96 PID 4232 wrote to memory of 3716 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 96 PID 4232 wrote to memory of 3716 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 96 PID 1256 wrote to memory of 4988 1256 cmd.exe 97 PID 1256 wrote to memory of 4988 1256 cmd.exe 97 PID 1256 wrote to memory of 4988 1256 cmd.exe 97 PID 4232 wrote to memory of 2212 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 98 PID 4232 wrote to memory of 2212 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 98 PID 4232 wrote to memory of 2212 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 98 PID 4232 wrote to memory of 392 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 100 PID 4232 wrote to memory of 392 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 100 PID 4232 wrote to memory of 392 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 100 PID 4232 wrote to memory of 2576 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 103 PID 4232 wrote to memory of 2576 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 103 PID 4232 wrote to memory of 2576 4232 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 103 PID 4988 wrote to memory of 4384 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 105 PID 4988 wrote to memory of 4384 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 105 PID 4988 wrote to memory of 4384 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 105 PID 4384 wrote to memory of 2636 4384 cmd.exe 107 PID 4384 wrote to memory of 2636 4384 cmd.exe 107 PID 4384 wrote to memory of 2636 4384 cmd.exe 107 PID 4988 wrote to memory of 2344 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 108 PID 4988 wrote to memory of 2344 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 108 PID 4988 wrote to memory of 2344 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 108 PID 4988 wrote to memory of 4620 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 109 PID 4988 wrote to memory of 4620 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 109 PID 4988 wrote to memory of 4620 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 109 PID 4988 wrote to memory of 3516 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 112 PID 4988 wrote to memory of 3516 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 112 PID 4988 wrote to memory of 3516 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 112 PID 4988 wrote to memory of 3420 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 114 PID 4988 wrote to memory of 3420 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 114 PID 4988 wrote to memory of 3420 4988 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 114 PID 2636 wrote to memory of 1000 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 116 PID 2636 wrote to memory of 1000 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 116 PID 2636 wrote to memory of 1000 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 116 PID 2636 wrote to memory of 3504 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 117 PID 2636 wrote to memory of 3504 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 117 PID 2636 wrote to memory of 3504 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 117 PID 2636 wrote to memory of 2632 2636 15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe"C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AecQgUoE\vowgQsgs.exe"C:\Users\Admin\AecQgUoE\vowgQsgs.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:4220
-
-
C:\ProgramData\ccYIwccU\LAkAogoA.exe"C:\ProgramData\ccYIwccU\LAkAogoA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:116
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"2⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"4⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"6⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"8⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"10⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b11⤵
- Suspicious behavior: EnumeratesProcesses
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"12⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"14⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"16⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"18⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"20⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"22⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"24⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b25⤵
- Suspicious behavior: EnumeratesProcesses
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"26⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b27⤵
- Suspicious behavior: EnumeratesProcesses
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"28⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b29⤵
- Suspicious behavior: EnumeratesProcesses
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"30⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"32⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b33⤵PID:3468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"34⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b35⤵PID:4792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"36⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b37⤵PID:1468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"38⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b39⤵PID:1932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"40⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b41⤵PID:3308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"42⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b43⤵PID:2548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"44⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b45⤵PID:3304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"46⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b47⤵PID:4332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"48⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b49⤵PID:3672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"50⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b51⤵PID:2172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"52⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b53⤵PID:4940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"54⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b55⤵PID:4980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"56⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b57⤵PID:3524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"58⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b59⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"60⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b61⤵PID:4756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"62⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b63⤵PID:2004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"64⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b65⤵PID:5188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"66⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b67⤵PID:5464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"68⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b69⤵PID:5748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"70⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b71⤵PID:5984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"72⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b73⤵PID:1256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"74⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b75⤵PID:5608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"76⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b77⤵PID:4016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"78⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b79⤵PID:5448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"80⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b81⤵PID:6060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"82⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b83⤵PID:6016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"84⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b85⤵PID:5112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"86⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b87⤵PID:772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"88⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b89⤵PID:5280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"90⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b91⤵PID:5536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"92⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b93⤵PID:3128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"94⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b95⤵PID:4452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"96⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b97⤵PID:5128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"98⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b99⤵PID:5892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"100⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b101⤵PID:3396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"102⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b103⤵PID:2508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"104⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b105⤵PID:3928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"106⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b107⤵PID:4888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"108⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b109⤵PID:5500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"110⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b111⤵PID:5156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"112⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b113⤵PID:5608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"114⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b115⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"116⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b117⤵PID:4444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"118⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b119⤵PID:4972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"120⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b.exeC:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b121⤵PID:4024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\15b530a4f4a309ae537873ef1317476c788d1222a3b4cf4b3f6e3aa3e60bbc7b"122⤵PID:2484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-