Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe
Resource
win10v2004-20221111-en
General
-
Target
4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe
-
Size
441KB
-
MD5
10adc0d375801678dcfc3852d68d8840
-
SHA1
bf3e1a50a100f54a066fb2324f61f07e7efb4588
-
SHA256
4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361
-
SHA512
1c9e308c77df3080bb335065d363955d9e23bf06a7b11e31b2e551d576320aa3bc386aa70c159cdabb142e4bc635cc7fafc793e3b0e46c629f33e1a291eba78b
-
SSDEEP
12288:9WR1NHSYCWIYWkPkpi2bW2mJhrpmKAUKu59p2Z9anP:9Wb1SYCWIYWkPciFx1mKRhLW9aP
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 4548 pQcUcwkY.exe 4168 tCocwIso.exe 1880 pwMokIAE.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation tCocwIso.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pQcUcwkY.exe = "C:\\Users\\Admin\\JsUAkEIk\\pQcUcwkY.exe" 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pQcUcwkY.exe = "C:\\Users\\Admin\\JsUAkEIk\\pQcUcwkY.exe" pQcUcwkY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tCocwIso.exe = "C:\\ProgramData\\IUEcYEww\\tCocwIso.exe" 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tCocwIso.exe = "C:\\ProgramData\\IUEcYEww\\tCocwIso.exe" tCocwIso.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tCocwIso.exe = "C:\\ProgramData\\IUEcYEww\\tCocwIso.exe" pwMokIAE.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sheDismountFormat.bmp pQcUcwkY.exe File opened for modification C:\Windows\SysWOW64\sheUnlockEnable.docx pQcUcwkY.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6632A04D-0282-48C7-8458-93F23338FC90}.catalogItem svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\JsUAkEIk\pQcUcwkY pwMokIAE.exe File created C:\Windows\SysWOW64\shell32.dll.exe pQcUcwkY.exe File opened for modification C:\Windows\SysWOW64\sheExitUnblock.docx pQcUcwkY.exe File opened for modification C:\Windows\SysWOW64\shePublishRestart.jpeg pQcUcwkY.exe File opened for modification C:\Windows\SysWOW64\sheRequestRename.xlsb pQcUcwkY.exe File opened for modification C:\Windows\SysWOW64\sheSplitConfirm.ppt pQcUcwkY.exe File opened for modification C:\Windows\SysWOW64\sheSyncConvertFrom.rar pQcUcwkY.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\JsUAkEIk pwMokIAE.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{75EB1360-6386-46C8-A72E-846BBBF8876C}.catalogItem svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 1920 Process not Found 5476 Process not Found 2732 Process not Found 3664 reg.exe 5700 reg.exe 4744 reg.exe 312 Process not Found 2640 Process not Found 4472 reg.exe 2088 reg.exe 2736 Process not Found 1212 reg.exe 5308 reg.exe 4928 Process not Found 580 reg.exe 3844 reg.exe 520 Process not Found 580 reg.exe 3912 reg.exe 3864 reg.exe 4312 Process not Found 768 Process not Found 2956 Process not Found 5280 reg.exe 676 reg.exe 1096 reg.exe 4324 reg.exe 5752 Process not Found 3856 reg.exe 4028 reg.exe 5256 reg.exe 4036 Process not Found 5792 Process not Found 4036 Process not Found 4356 reg.exe 3112 reg.exe 4512 reg.exe 5980 Process not Found 1952 Process not Found 5888 Process not Found 4044 Process not Found 2020 Process not Found 4744 reg.exe 4280 reg.exe 5300 Process not Found 2284 reg.exe 5468 reg.exe 5416 reg.exe 1536 Process not Found 2012 reg.exe 3896 reg.exe 4656 Process not Found 4240 reg.exe 2844 reg.exe 5748 reg.exe 1304 Process not Found 3700 Process not Found 3536 reg.exe 3912 reg.exe 3940 Process not Found 5356 reg.exe 2308 reg.exe 1848 Process not Found 1536 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 4952 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 4952 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 4952 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 4952 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 3160 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 3160 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 3160 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 3160 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1640 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1640 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1640 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1640 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 3420 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 3420 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 3420 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 3420 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2124 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2124 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2124 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2124 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1832 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1832 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1832 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1832 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2164 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2164 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2164 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 2164 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 4708 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 4708 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 4708 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 4708 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1864 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1864 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1864 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1864 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1920 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1920 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1920 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1920 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1540 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1540 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1540 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1540 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1992 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1992 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1992 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 1992 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe 4168 tCocwIso.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 4548 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 82 PID 1636 wrote to memory of 4548 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 82 PID 1636 wrote to memory of 4548 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 82 PID 1636 wrote to memory of 4168 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 83 PID 1636 wrote to memory of 4168 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 83 PID 1636 wrote to memory of 4168 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 83 PID 1636 wrote to memory of 2476 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 84 PID 1636 wrote to memory of 2476 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 84 PID 1636 wrote to memory of 2476 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 84 PID 2476 wrote to memory of 2528 2476 cmd.exe 87 PID 2476 wrote to memory of 2528 2476 cmd.exe 87 PID 2476 wrote to memory of 2528 2476 cmd.exe 87 PID 1636 wrote to memory of 3700 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 88 PID 1636 wrote to memory of 3700 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 88 PID 1636 wrote to memory of 3700 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 88 PID 1636 wrote to memory of 4472 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 89 PID 1636 wrote to memory of 4472 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 89 PID 1636 wrote to memory of 4472 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 89 PID 1636 wrote to memory of 2356 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 90 PID 1636 wrote to memory of 2356 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 90 PID 1636 wrote to memory of 2356 1636 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 90 PID 2528 wrote to memory of 2296 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 94 PID 2528 wrote to memory of 2296 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 94 PID 2528 wrote to memory of 2296 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 94 PID 2296 wrote to memory of 2980 2296 cmd.exe 96 PID 2296 wrote to memory of 2980 2296 cmd.exe 96 PID 2296 wrote to memory of 2980 2296 cmd.exe 96 PID 2528 wrote to memory of 1956 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 97 PID 2528 wrote to memory of 1956 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 97 PID 2528 wrote to memory of 1956 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 97 PID 2528 wrote to memory of 4420 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 99 PID 2528 wrote to memory of 4420 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 99 PID 2528 wrote to memory of 4420 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 99 PID 2528 wrote to memory of 3792 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 102 PID 2528 wrote to memory of 3792 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 102 PID 2528 wrote to memory of 3792 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 102 PID 2528 wrote to memory of 1536 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 101 PID 2528 wrote to memory of 1536 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 101 PID 2528 wrote to memory of 1536 2528 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 101 PID 2980 wrote to memory of 3892 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 105 PID 2980 wrote to memory of 3892 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 105 PID 2980 wrote to memory of 3892 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 105 PID 2980 wrote to memory of 5108 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 107 PID 2980 wrote to memory of 5108 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 107 PID 2980 wrote to memory of 5108 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 107 PID 2980 wrote to memory of 2628 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 110 PID 2980 wrote to memory of 2628 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 110 PID 2980 wrote to memory of 2628 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 110 PID 2980 wrote to memory of 5092 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 108 PID 2980 wrote to memory of 5092 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 108 PID 2980 wrote to memory of 5092 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 108 PID 2980 wrote to memory of 4372 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 112 PID 2980 wrote to memory of 4372 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 112 PID 2980 wrote to memory of 4372 2980 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 112 PID 3892 wrote to memory of 4952 3892 cmd.exe 115 PID 3892 wrote to memory of 4952 3892 cmd.exe 115 PID 3892 wrote to memory of 4952 3892 cmd.exe 115 PID 4952 wrote to memory of 2404 4952 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 116 PID 4952 wrote to memory of 2404 4952 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 116 PID 4952 wrote to memory of 2404 4952 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 116 PID 2404 wrote to memory of 3160 2404 cmd.exe 118 PID 2404 wrote to memory of 3160 2404 cmd.exe 118 PID 2404 wrote to memory of 3160 2404 cmd.exe 118 PID 4952 wrote to memory of 4784 4952 4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe"C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\JsUAkEIk\pQcUcwkY.exe"C:\Users\Admin\JsUAkEIk\pQcUcwkY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4548
-
-
C:\ProgramData\IUEcYEww\tCocwIso.exe"C:\ProgramData\IUEcYEww\tCocwIso.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
PID:4168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"2⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e3613⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"4⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e3615⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"6⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e3617⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"8⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e3619⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"10⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36111⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"12⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36113⤵
- Suspicious behavior: EnumeratesProcesses
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"14⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36115⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"16⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36117⤵
- Suspicious behavior: EnumeratesProcesses
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"18⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36119⤵
- Suspicious behavior: EnumeratesProcesses
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"20⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36121⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"22⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36123⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"24⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36125⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"26⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36127⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"28⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36129⤵
- Suspicious behavior: EnumeratesProcesses
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"30⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36131⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"32⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36133⤵PID:1224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"34⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36135⤵PID:3940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"36⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36137⤵PID:4892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"38⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36139⤵PID:4528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"40⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36141⤵PID:4200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"42⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36143⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"44⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36145⤵PID:2176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"46⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36147⤵PID:2360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"48⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36149⤵PID:3980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"50⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36151⤵PID:3592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"52⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36153⤵PID:5104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"54⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36155⤵PID:3700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"56⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36157⤵PID:448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"58⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36159⤵PID:1940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"60⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36161⤵PID:2624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"62⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36163⤵PID:3648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"64⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36165⤵PID:2404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"66⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36167⤵PID:3424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"68⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36169⤵PID:1288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"70⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36171⤵PID:4848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"72⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36173⤵PID:4372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"74⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36175⤵PID:2628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"76⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36177⤵PID:3856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"78⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36179⤵PID:2112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"80⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36181⤵PID:4540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"82⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36183⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"84⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36185⤵PID:2092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"86⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36187⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"88⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36189⤵PID:3280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"90⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36191⤵PID:1776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"92⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36193⤵PID:204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"94⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36195⤵PID:3096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"96⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36197⤵PID:3552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"98⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e36199⤵PID:2864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"100⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361101⤵PID:2472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"102⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361103⤵PID:3160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"104⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361105⤵PID:2420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"106⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361107⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"108⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361109⤵PID:3528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"110⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361111⤵PID:4852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"112⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361113⤵PID:3280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"114⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361115⤵PID:3892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"116⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361117⤵PID:4632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"118⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361119⤵PID:5212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"120⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361.exeC:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361121⤵PID:5456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4b614ec4ba2277791c94c64eeb80151fbb65ec7dc8083333749d9891fed6e361"122⤵PID:1888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-