Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe
Resource
win10v2004-20220812-en
General
-
Target
61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe
-
Size
446KB
-
MD5
4036e9b96466417aa679d489fd654ee0
-
SHA1
715cde3949f5857ce35e1383e0455a7e57503d12
-
SHA256
61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399
-
SHA512
67e0b4982c89f1e2b8780f82d9d8db7ce8cbaf58ed9039102c87e8c60cda7303a8b46a151300e54d38307310ba9f4e908adf06384a34d21c3f3f117efe612e93
-
SSDEEP
12288:tfwK+SukLYQfhx1BkaS61pWYbxdyk5gWR:tfv1jzJx1BkaS61Yy
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 4540 qyokIscM.exe 4764 wGUYEQEY.exe 3052 LiQUwIQc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wGUYEQEY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyokIscM.exe = "C:\\Users\\Admin\\DqoUwQQQ\\qyokIscM.exe" qyokIscM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wGUYEQEY.exe = "C:\\ProgramData\\rsIsUscE\\wGUYEQEY.exe" wGUYEQEY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wGUYEQEY.exe = "C:\\ProgramData\\rsIsUscE\\wGUYEQEY.exe" LiQUwIQc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyokIscM.exe = "C:\\Users\\Admin\\DqoUwQQQ\\qyokIscM.exe" 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wGUYEQEY.exe = "C:\\ProgramData\\rsIsUscE\\wGUYEQEY.exe" 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\DqoUwQQQ LiQUwIQc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\DqoUwQQQ\qyokIscM LiQUwIQc.exe File created C:\Windows\SysWOW64\shell32.dll.exe wGUYEQEY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 1776 reg.exe 2712 reg.exe 3100 reg.exe 2316 reg.exe 2800 reg.exe 4496 reg.exe 228 reg.exe 1880 reg.exe 5020 reg.exe 4688 reg.exe 2928 reg.exe 3656 reg.exe 4152 reg.exe 4872 reg.exe 3812 reg.exe 1824 reg.exe 4300 reg.exe 4340 reg.exe 532 reg.exe 3884 reg.exe 3488 reg.exe 4884 reg.exe 3488 reg.exe 1988 reg.exe 4728 reg.exe 3956 reg.exe 4304 reg.exe 2288 reg.exe 4188 reg.exe 3936 reg.exe 4892 reg.exe 2812 reg.exe 2032 reg.exe 2452 reg.exe 2504 reg.exe 384 reg.exe 4712 reg.exe 4776 reg.exe 896 reg.exe 604 reg.exe 4120 reg.exe 3824 reg.exe 1556 reg.exe 968 reg.exe 4780 reg.exe 1504 reg.exe 3464 reg.exe 944 reg.exe 1296 reg.exe 3864 reg.exe 2812 reg.exe 3952 reg.exe 204 reg.exe 4312 reg.exe 4840 reg.exe 3664 reg.exe 3100 reg.exe 3936 reg.exe 4876 reg.exe 728 reg.exe 2004 reg.exe 2212 reg.exe 4504 reg.exe 1500 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4220 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4220 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4220 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4220 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4884 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4884 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4884 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4884 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4580 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4580 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4580 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4580 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2300 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2300 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2300 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2300 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4120 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4120 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4120 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4120 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3584 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3584 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3584 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3584 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3228 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3228 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3228 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3228 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4392 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4392 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4392 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4392 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2460 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2460 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2460 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 2460 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 1148 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 1148 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 1148 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 1148 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4892 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4892 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4892 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 4892 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3508 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3508 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3508 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3508 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3488 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3488 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3488 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 3488 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4764 wGUYEQEY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe 4764 wGUYEQEY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3836 wrote to memory of 4540 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 80 PID 3836 wrote to memory of 4540 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 80 PID 3836 wrote to memory of 4540 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 80 PID 3836 wrote to memory of 4764 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 81 PID 3836 wrote to memory of 4764 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 81 PID 3836 wrote to memory of 4764 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 81 PID 3836 wrote to memory of 1992 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 83 PID 3836 wrote to memory of 1992 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 83 PID 3836 wrote to memory of 1992 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 83 PID 3836 wrote to memory of 1960 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 86 PID 3836 wrote to memory of 1960 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 86 PID 3836 wrote to memory of 1960 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 86 PID 1992 wrote to memory of 1860 1992 cmd.exe 85 PID 1992 wrote to memory of 1860 1992 cmd.exe 85 PID 1992 wrote to memory of 1860 1992 cmd.exe 85 PID 3836 wrote to memory of 528 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 88 PID 3836 wrote to memory of 528 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 88 PID 3836 wrote to memory of 528 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 88 PID 3836 wrote to memory of 4840 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 90 PID 3836 wrote to memory of 4840 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 90 PID 3836 wrote to memory of 4840 3836 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 90 PID 1860 wrote to memory of 3300 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 92 PID 1860 wrote to memory of 3300 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 92 PID 1860 wrote to memory of 3300 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 92 PID 3300 wrote to memory of 2316 3300 cmd.exe 94 PID 3300 wrote to memory of 2316 3300 cmd.exe 94 PID 3300 wrote to memory of 2316 3300 cmd.exe 94 PID 1860 wrote to memory of 4168 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 95 PID 1860 wrote to memory of 4168 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 95 PID 1860 wrote to memory of 4168 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 95 PID 1860 wrote to memory of 1164 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 96 PID 1860 wrote to memory of 1164 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 96 PID 1860 wrote to memory of 1164 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 96 PID 1860 wrote to memory of 2812 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 97 PID 1860 wrote to memory of 2812 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 97 PID 1860 wrote to memory of 2812 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 97 PID 1860 wrote to memory of 4268 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 100 PID 1860 wrote to memory of 4268 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 100 PID 1860 wrote to memory of 4268 1860 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 100 PID 2316 wrote to memory of 4600 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 103 PID 2316 wrote to memory of 4600 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 103 PID 2316 wrote to memory of 4600 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 103 PID 4600 wrote to memory of 4220 4600 cmd.exe 105 PID 4600 wrote to memory of 4220 4600 cmd.exe 105 PID 4600 wrote to memory of 4220 4600 cmd.exe 105 PID 4268 wrote to memory of 676 4268 cmd.exe 107 PID 4268 wrote to memory of 676 4268 cmd.exe 107 PID 4268 wrote to memory of 676 4268 cmd.exe 107 PID 2316 wrote to memory of 228 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 106 PID 2316 wrote to memory of 228 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 106 PID 2316 wrote to memory of 228 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 106 PID 2316 wrote to memory of 216 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 108 PID 2316 wrote to memory of 216 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 108 PID 2316 wrote to memory of 216 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 108 PID 2316 wrote to memory of 2004 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 109 PID 2316 wrote to memory of 2004 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 109 PID 2316 wrote to memory of 2004 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 109 PID 2316 wrote to memory of 3364 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 112 PID 2316 wrote to memory of 3364 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 112 PID 2316 wrote to memory of 3364 2316 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 112 PID 4220 wrote to memory of 3100 4220 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 115 PID 4220 wrote to memory of 3100 4220 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 115 PID 4220 wrote to memory of 3100 4220 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe 115 PID 3364 wrote to memory of 4588 3364 cmd.exe 118 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe"C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\DqoUwQQQ\qyokIscM.exe"C:\Users\Admin\DqoUwQQQ\qyokIscM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4540
-
-
C:\ProgramData\rsIsUscE\wGUYEQEY.exe"C:\ProgramData\rsIsUscE\wGUYEQEY.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4764
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"2⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c6782103993⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"4⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c6782103995⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"6⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c6782103997⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"8⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c6782103999⤵
- Suspicious behavior: EnumeratesProcesses
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"10⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039911⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"12⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039913⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"14⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039915⤵
- Suspicious behavior: EnumeratesProcesses
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"16⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039917⤵
- Suspicious behavior: EnumeratesProcesses
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"18⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039919⤵
- Suspicious behavior: EnumeratesProcesses
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"20⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039921⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"22⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039923⤵
- Suspicious behavior: EnumeratesProcesses
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"24⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039925⤵
- Suspicious behavior: EnumeratesProcesses
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"26⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039927⤵
- Suspicious behavior: EnumeratesProcesses
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"28⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039929⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"30⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039931⤵
- Suspicious behavior: EnumeratesProcesses
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"32⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039933⤵PID:560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"34⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039935⤵PID:3364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"36⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039937⤵PID:4240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"38⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039939⤵PID:5052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"40⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039941⤵PID:4676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"42⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039943⤵PID:1848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"44⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039945⤵PID:2340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"46⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039947⤵PID:820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"48⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039949⤵PID:2308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"50⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039951⤵PID:4960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"52⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039953⤵PID:1088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"54⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039955⤵PID:4608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"56⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039957⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"58⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039959⤵PID:1384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"60⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039961⤵PID:1976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"62⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039963⤵PID:4808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"64⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039965⤵PID:1664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"66⤵PID:1052
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039967⤵PID:2052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"68⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039969⤵PID:4604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"70⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039971⤵PID:740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"72⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039973⤵PID:4968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"74⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039975⤵PID:2228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"76⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039977⤵PID:3648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"78⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039979⤵PID:1840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"80⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039981⤵PID:4908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"82⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039983⤵PID:4048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"84⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039985⤵PID:4528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"86⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039987⤵PID:5068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"88⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039989⤵PID:3476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"90⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039991⤵PID:3028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"92⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039993⤵PID:4704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"94⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039995⤵PID:2248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"96⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039997⤵PID:1904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"98⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c67821039999⤵PID:636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"100⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399101⤵PID:4800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"102⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399103⤵PID:1676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"104⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399105⤵PID:3208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"106⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399107⤵PID:3672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"108⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399109⤵PID:2260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"110⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399111⤵PID:1808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"112⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399113⤵PID:4940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"114⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399115⤵PID:996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"116⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399117⤵PID:4888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"118⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399119⤵PID:4692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"120⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399.exeC:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399121⤵PID:4148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\61d8821af6b8103d44646e007be589b82607a0bb9c21073a0a31f4c678210399"122⤵PID:4112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-