Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 09:20
Static task
static1
Behavioral task
behavioral1
Sample
b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe
Resource
win10v2004-20221111-en
General
-
Target
b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe
-
Size
437KB
-
MD5
301dde85ae39a541fb5ac8ca53d97a90
-
SHA1
aae9dc788d063fb243741a05745160c266e7bedf
-
SHA256
b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931
-
SHA512
d9418cc7e5887231c5814339d61819c3a2044635026ab69dc2c30c7fcaa8ef7e29de84495af8ac62cfd26e5930ebafd4f6536d21e6bb45cc4bb83f608a5d7ed6
-
SSDEEP
12288:o43M3t2K2S3uZw/MfyGmusP4Lzn+b1xmsPd:oAMv2S++/Mfyasyj+bSod
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 3500 WOkQUIUY.exe 2584 eIkkwsQw.exe 3472 XCIYoIgA.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation eIkkwsQw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WOkQUIUY.exe = "C:\\Users\\Admin\\amIAAEYE\\WOkQUIUY.exe" b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eIkkwsQw.exe = "C:\\ProgramData\\bCAkQEMo\\eIkkwsQw.exe" b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WOkQUIUY.exe = "C:\\Users\\Admin\\amIAAEYE\\WOkQUIUY.exe" WOkQUIUY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eIkkwsQw.exe = "C:\\ProgramData\\bCAkQEMo\\eIkkwsQw.exe" eIkkwsQw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eIkkwsQw.exe = "C:\\ProgramData\\bCAkQEMo\\eIkkwsQw.exe" XCIYoIgA.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\amIAAEYE\WOkQUIUY XCIYoIgA.exe File created C:\Windows\SysWOW64\shell32.dll.exe eIkkwsQw.exe File opened for modification C:\Windows\SysWOW64\sheSyncExit.mpg eIkkwsQw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\amIAAEYE XCIYoIgA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 5384 reg.exe 5792 reg.exe 2520 reg.exe 6068 reg.exe 3356 Process not Found 5508 reg.exe 204 Process not Found 2568 reg.exe 4212 reg.exe 5372 reg.exe 5848 reg.exe 1784 reg.exe 2064 reg.exe 6080 reg.exe 1644 reg.exe 6028 reg.exe 3128 reg.exe 2136 reg.exe 5548 reg.exe 3916 reg.exe 4784 reg.exe 5580 reg.exe 4956 reg.exe 4000 Process not Found 5780 reg.exe 3552 reg.exe 4248 reg.exe 5728 reg.exe 2924 reg.exe 1664 reg.exe 2804 reg.exe 372 reg.exe 1440 reg.exe 4672 reg.exe 6084 reg.exe 1524 reg.exe 5180 reg.exe 4304 reg.exe 836 reg.exe 5408 reg.exe 2588 reg.exe 5440 reg.exe 4356 reg.exe 2104 reg.exe 6020 reg.exe 6056 reg.exe 672 reg.exe 6088 reg.exe 2640 Process not Found 452 reg.exe 3760 reg.exe 800 reg.exe 176 reg.exe 5372 reg.exe 4980 reg.exe 5592 Process not Found 6036 reg.exe 4456 reg.exe 2672 reg.exe 5604 reg.exe 3376 reg.exe 5484 reg.exe 4716 reg.exe 4920 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4456 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4456 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4456 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4456 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3964 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3964 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3964 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3964 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 240 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 240 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 240 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 240 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3044 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3044 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3044 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3044 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4756 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4756 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4756 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4756 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 1876 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 1876 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 1876 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 1876 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 2720 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 2720 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 2720 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 2720 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3904 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3904 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3904 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3904 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4672 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4672 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4672 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4672 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3168 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3168 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3168 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 3168 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4092 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4092 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4092 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 4092 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 400 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 400 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 400 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 400 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2584 eIkkwsQw.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe 2584 eIkkwsQw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1460 wrote to memory of 3500 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 83 PID 1460 wrote to memory of 3500 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 83 PID 1460 wrote to memory of 3500 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 83 PID 1460 wrote to memory of 2584 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 84 PID 1460 wrote to memory of 2584 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 84 PID 1460 wrote to memory of 2584 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 84 PID 1460 wrote to memory of 2100 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 85 PID 1460 wrote to memory of 2100 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 85 PID 1460 wrote to memory of 2100 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 85 PID 1460 wrote to memory of 5016 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 88 PID 1460 wrote to memory of 5016 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 88 PID 1460 wrote to memory of 5016 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 88 PID 1460 wrote to memory of 452 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 89 PID 1460 wrote to memory of 452 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 89 PID 1460 wrote to memory of 452 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 89 PID 2100 wrote to memory of 2432 2100 cmd.exe 90 PID 2100 wrote to memory of 2432 2100 cmd.exe 90 PID 2100 wrote to memory of 2432 2100 cmd.exe 90 PID 1460 wrote to memory of 216 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 91 PID 1460 wrote to memory of 216 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 91 PID 1460 wrote to memory of 216 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 91 PID 2432 wrote to memory of 3628 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 95 PID 2432 wrote to memory of 3628 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 95 PID 2432 wrote to memory of 3628 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 95 PID 2432 wrote to memory of 2884 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 96 PID 2432 wrote to memory of 2884 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 96 PID 2432 wrote to memory of 2884 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 96 PID 2432 wrote to memory of 3916 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 97 PID 2432 wrote to memory of 3916 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 97 PID 2432 wrote to memory of 3916 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 97 PID 2432 wrote to memory of 5112 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 98 PID 2432 wrote to memory of 5112 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 98 PID 2432 wrote to memory of 5112 2432 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 98 PID 1460 wrote to memory of 4220 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 103 PID 1460 wrote to memory of 4220 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 103 PID 1460 wrote to memory of 4220 1460 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 103 PID 3628 wrote to memory of 5052 3628 cmd.exe 105 PID 3628 wrote to memory of 5052 3628 cmd.exe 105 PID 3628 wrote to memory of 5052 3628 cmd.exe 105 PID 5052 wrote to memory of 400 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 106 PID 5052 wrote to memory of 400 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 106 PID 5052 wrote to memory of 400 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 106 PID 5052 wrote to memory of 2664 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 107 PID 5052 wrote to memory of 2664 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 107 PID 5052 wrote to memory of 2664 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 107 PID 5052 wrote to memory of 2556 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 108 PID 5052 wrote to memory of 2556 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 108 PID 5052 wrote to memory of 2556 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 108 PID 5052 wrote to memory of 3812 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 109 PID 5052 wrote to memory of 3812 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 109 PID 5052 wrote to memory of 3812 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 109 PID 5052 wrote to memory of 2280 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 110 PID 5052 wrote to memory of 2280 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 110 PID 5052 wrote to memory of 2280 5052 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 110 PID 4220 wrote to memory of 3796 4220 cmd.exe 113 PID 4220 wrote to memory of 3796 4220 cmd.exe 113 PID 4220 wrote to memory of 3796 4220 cmd.exe 113 PID 400 wrote to memory of 4456 400 cmd.exe 117 PID 400 wrote to memory of 4456 400 cmd.exe 117 PID 400 wrote to memory of 4456 400 cmd.exe 117 PID 4456 wrote to memory of 2948 4456 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 118 PID 4456 wrote to memory of 2948 4456 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 118 PID 4456 wrote to memory of 2948 4456 b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe 118 PID 2948 wrote to memory of 3964 2948 cmd.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe"C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\amIAAEYE\WOkQUIUY.exe"C:\Users\Admin\amIAAEYE\WOkQUIUY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3500
-
-
C:\ProgramData\bCAkQEMo\eIkkwsQw.exe"C:\ProgramData\bCAkQEMo\eIkkwsQw.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2584
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"2⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d9313⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"4⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d9315⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"6⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d9317⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"8⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d9319⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"10⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93111⤵
- Suspicious behavior: EnumeratesProcesses
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"12⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93113⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"14⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93115⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"16⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93117⤵
- Suspicious behavior: EnumeratesProcesses
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"18⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93119⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"20⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93121⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"22⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93123⤵
- Suspicious behavior: EnumeratesProcesses
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"24⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93125⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"26⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93127⤵
- Suspicious behavior: EnumeratesProcesses
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"28⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93129⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"30⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93131⤵
- Suspicious behavior: EnumeratesProcesses
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"32⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93133⤵PID:3476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"34⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93135⤵PID:4288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"36⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93137⤵PID:2068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"38⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93139⤵PID:2928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"40⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93141⤵PID:816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"42⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93143⤵PID:4288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"44⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93145⤵PID:4236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"46⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93147⤵PID:4320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"48⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93149⤵PID:5604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"50⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93151⤵PID:5968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"52⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93153⤵PID:6056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"54⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93155⤵PID:5464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"56⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93157⤵PID:5376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"58⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93159⤵PID:5340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"60⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93161⤵PID:5700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"62⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93163⤵PID:2720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"64⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93165⤵PID:364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"66⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93167⤵PID:4948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"68⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93169⤵PID:2664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"70⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93171⤵PID:4236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"72⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93173⤵PID:3464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"74⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93175⤵PID:672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"76⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93177⤵PID:5596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"78⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93179⤵PID:5668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"80⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93181⤵PID:5848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"82⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93183⤵PID:5020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"84⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93185⤵PID:5500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"86⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93187⤵PID:4772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"88⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93189⤵PID:4028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"90⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93191⤵PID:6132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"92⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93193⤵PID:6112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"94⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93195⤵PID:6024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"96⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93197⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"98⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d93199⤵PID:5140
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"100⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931101⤵PID:5728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"102⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931103⤵PID:2896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"104⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931105⤵PID:5792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"106⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931107⤵PID:6096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"108⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931109⤵PID:3120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"110⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931111⤵PID:5920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"112⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931113⤵PID:2896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"114⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931115⤵PID:5268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"116⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931117⤵PID:1876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"118⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931119⤵PID:4212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"120⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931.exeC:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931121⤵PID:5364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b9b8fcdd87634ece064702d0895e10cb54aa03de1cbd2d87373b55abda43d931"122⤵PID:5672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-