Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe
Resource
win10v2004-20221111-en
General
-
Target
598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe
-
Size
440KB
-
MD5
09de619027fb63f1ee959914d5997350
-
SHA1
16fecfa6f2fd8bd80f2cb59111e389114d597cad
-
SHA256
598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28
-
SHA512
fa608b175cda60ed2c39a528b86bd22766dcd02c41cfecc1c210b7769f742b39ad379af033b40d543f4c276cccb630e49945ba8716acca412a0af0dda8e7b936
-
SSDEEP
12288:zVjiqDRCE+gcBeOR+0gbos+tZKS+l5270n:zYGQEeBl+1wl+
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 3688 lYQkwAgY.exe 4316 HWwocoEo.exe 4508 SEIkEcUU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lYQkwAgY.exe = "C:\\Users\\Admin\\MGcYksEo\\lYQkwAgY.exe" 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HWwocoEo.exe = "C:\\ProgramData\\NoEYkEkk\\HWwocoEo.exe" 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lYQkwAgY.exe = "C:\\Users\\Admin\\MGcYksEo\\lYQkwAgY.exe" lYQkwAgY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HWwocoEo.exe = "C:\\ProgramData\\NoEYkEkk\\HWwocoEo.exe" HWwocoEo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HWwocoEo.exe = "C:\\ProgramData\\NoEYkEkk\\HWwocoEo.exe" SEIkEcUU.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe lYQkwAgY.exe File opened for modification C:\Windows\SysWOW64\sheProtectRename.jpeg lYQkwAgY.exe File opened for modification C:\Windows\SysWOW64\sheShowExport.png lYQkwAgY.exe File opened for modification C:\Windows\SysWOW64\sheUpdateEnable.xlsm lYQkwAgY.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\MGcYksEo SEIkEcUU.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\MGcYksEo\lYQkwAgY SEIkEcUU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 5624 Process not Found 2856 reg.exe 3724 reg.exe 5140 Process not Found 3704 Process not Found 5900 Process not Found 5360 Process not Found 4876 reg.exe 3144 reg.exe 4728 reg.exe 1824 Process not Found 4344 reg.exe 4960 reg.exe 4928 Process not Found 4416 Process not Found 1644 Process not Found 6092 Process not Found 2900 reg.exe 5568 Process not Found 4300 Process not Found 3140 reg.exe 384 Process not Found 4764 reg.exe 5244 Process not Found 5252 reg.exe 5160 reg.exe 4984 reg.exe 5564 reg.exe 1100 Process not Found 6052 Process not Found 5592 Process not Found 4820 reg.exe 6104 reg.exe 3904 Process not Found 3672 reg.exe 5704 Process not Found 2856 Process not Found 4228 reg.exe 3732 reg.exe 4524 Process not Found 2444 Process not Found 5188 Process not Found 4516 reg.exe 2144 reg.exe 4480 reg.exe 3024 reg.exe 2892 reg.exe 1272 reg.exe 3888 Process not Found 5584 reg.exe 2028 reg.exe 384 reg.exe 2592 reg.exe 4708 reg.exe 1644 reg.exe 1228 Process not Found 5424 Process not Found 5680 reg.exe 5352 Process not Found 4108 Process not Found 5572 Process not Found 5768 reg.exe 5376 Process not Found 3204 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1172 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1172 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1172 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1172 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 456 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 456 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 456 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 456 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1812 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1812 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1812 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1812 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2768 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2768 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2768 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 2768 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4920 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4920 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4920 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4920 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4992 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4992 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4992 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4992 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3904 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3904 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3904 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3904 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4736 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4736 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4736 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 4736 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1856 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1856 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1856 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1856 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3580 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3580 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3580 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3580 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3520 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3520 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3520 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 3520 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1856 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1856 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1856 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 1856 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 764 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 764 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 764 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 764 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 3688 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 86 PID 1576 wrote to memory of 3688 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 86 PID 1576 wrote to memory of 3688 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 86 PID 1576 wrote to memory of 4316 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 87 PID 1576 wrote to memory of 4316 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 87 PID 1576 wrote to memory of 4316 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 87 PID 1576 wrote to memory of 3008 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 89 PID 1576 wrote to memory of 3008 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 89 PID 1576 wrote to memory of 3008 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 89 PID 1576 wrote to memory of 960 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 91 PID 1576 wrote to memory of 960 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 91 PID 1576 wrote to memory of 960 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 91 PID 1576 wrote to memory of 4228 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 92 PID 1576 wrote to memory of 4228 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 92 PID 1576 wrote to memory of 4228 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 92 PID 1576 wrote to memory of 4264 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 93 PID 1576 wrote to memory of 4264 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 93 PID 1576 wrote to memory of 4264 1576 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 93 PID 3008 wrote to memory of 2308 3008 cmd.exe 97 PID 3008 wrote to memory of 2308 3008 cmd.exe 97 PID 3008 wrote to memory of 2308 3008 cmd.exe 97 PID 2308 wrote to memory of 4476 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 98 PID 2308 wrote to memory of 4476 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 98 PID 2308 wrote to memory of 4476 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 98 PID 2308 wrote to memory of 3244 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 100 PID 2308 wrote to memory of 3244 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 100 PID 2308 wrote to memory of 3244 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 100 PID 2308 wrote to memory of 4624 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 101 PID 2308 wrote to memory of 4624 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 101 PID 2308 wrote to memory of 4624 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 101 PID 2308 wrote to memory of 3968 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 102 PID 2308 wrote to memory of 3968 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 102 PID 2308 wrote to memory of 3968 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 102 PID 2308 wrote to memory of 4672 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 103 PID 2308 wrote to memory of 4672 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 103 PID 2308 wrote to memory of 4672 2308 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 103 PID 4476 wrote to memory of 2912 4476 cmd.exe 108 PID 4476 wrote to memory of 2912 4476 cmd.exe 108 PID 4476 wrote to memory of 2912 4476 cmd.exe 108 PID 2912 wrote to memory of 3876 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 109 PID 2912 wrote to memory of 3876 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 109 PID 2912 wrote to memory of 3876 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 109 PID 3876 wrote to memory of 1172 3876 cmd.exe 111 PID 3876 wrote to memory of 1172 3876 cmd.exe 111 PID 3876 wrote to memory of 1172 3876 cmd.exe 111 PID 2912 wrote to memory of 3076 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 112 PID 2912 wrote to memory of 3076 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 112 PID 2912 wrote to memory of 3076 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 112 PID 2912 wrote to memory of 3472 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 113 PID 2912 wrote to memory of 3472 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 113 PID 2912 wrote to memory of 3472 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 113 PID 2912 wrote to memory of 1000 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 114 PID 2912 wrote to memory of 1000 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 114 PID 2912 wrote to memory of 1000 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 114 PID 2912 wrote to memory of 5028 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 118 PID 2912 wrote to memory of 5028 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 118 PID 2912 wrote to memory of 5028 2912 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 118 PID 1172 wrote to memory of 3684 1172 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 121 PID 1172 wrote to memory of 3684 1172 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 121 PID 1172 wrote to memory of 3684 1172 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 121 PID 3684 wrote to memory of 456 3684 cmd.exe 123 PID 3684 wrote to memory of 456 3684 cmd.exe 123 PID 3684 wrote to memory of 456 3684 cmd.exe 123 PID 1172 wrote to memory of 1652 1172 598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe"C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\MGcYksEo\lYQkwAgY.exe"C:\Users\Admin\MGcYksEo\lYQkwAgY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3688
-
-
C:\ProgramData\NoEYkEkk\HWwocoEo.exe"C:\ProgramData\NoEYkEkk\HWwocoEo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4316
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"2⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc283⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"4⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc285⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"6⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc287⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"8⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc289⤵
- Suspicious behavior: EnumeratesProcesses
PID:456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"10⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2811⤵
- Suspicious behavior: EnumeratesProcesses
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"12⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2813⤵
- Suspicious behavior: EnumeratesProcesses
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"14⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2815⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"16⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2817⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"18⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2819⤵
- Suspicious behavior: EnumeratesProcesses
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"20⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2821⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"22⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2823⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"24⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2825⤵
- Suspicious behavior: EnumeratesProcesses
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"26⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2827⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"28⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2829⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"30⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2831⤵
- Suspicious behavior: EnumeratesProcesses
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"32⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2833⤵PID:3624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"34⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2835⤵PID:3000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"36⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2837⤵PID:4544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"38⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2839⤵PID:2192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"40⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2841⤵PID:3724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"42⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2843⤵PID:5388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"44⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2845⤵PID:5564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"46⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2847⤵PID:5836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"48⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2849⤵PID:3624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"50⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2851⤵PID:5008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"52⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2853⤵PID:3584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"54⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2855⤵PID:4460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"56⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2857⤵PID:3664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"58⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2859⤵PID:4840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"60⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2861⤵PID:5796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"62⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2863⤵PID:5848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"64⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2865⤵PID:6120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"66⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2867⤵PID:4400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"68⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2869⤵PID:4616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"70⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2871⤵PID:960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"72⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2873⤵PID:5332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"74⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2875⤵PID:4248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"76⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2877⤵PID:5532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"78⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2879⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"80⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2881⤵PID:5780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"82⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2883⤵PID:5796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"84⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2885⤵PID:5228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"86⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2887⤵PID:4148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"88⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2889⤵PID:5612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"90⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2891⤵PID:6040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"92⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2893⤵PID:4268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"94⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2895⤵PID:1176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"96⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2897⤵PID:1912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"98⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc2899⤵PID:3048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"100⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28101⤵PID:5068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"102⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28103⤵PID:5220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"104⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28105⤵PID:5908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"106⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28107⤵PID:5244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"108⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28109⤵PID:3080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"110⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28111⤵PID:748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"112⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28113⤵PID:2004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"114⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28115⤵PID:1156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"116⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28117⤵PID:2064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"118⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28119⤵PID:3296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"120⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28.exeC:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28121⤵PID:2388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\598e4f257c551a221153ca1eabd504fcb29c289472e8702df8e3ba30fc67bc28"122⤵PID:5204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-