Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
72s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
06/07/2023, 11:59
Static task
static1
Behavioral task
behavioral1
Sample
25c0a17378ed06exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
25c0a17378ed06exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
25c0a17378ed06exeexeexeex.exe
-
Size
204KB
-
MD5
25c0a17378ed06242717e69b42b51b8d
-
SHA1
2592ea2f28efe478ac042edf2c0a8739941054f8
-
SHA256
e8f779aa8691150666aebdc3bd4b57b0dcdf43ab76ddb3d3d673cd3889019088
-
SHA512
f6ab5df57fa1de2d7fdf1420aced07b4441e4208035ef112b97dd16b7c367b176f61c13115a20eefb8eacfb27990d4384488992c203f6bbc677a3429676fea6b
-
SSDEEP
3072:6ho1jshIqjLdyQb1HIRe39gmpB0JI43GrforUZ9HtSAVX8iqOTwLWe:6ho1fQpB3rpBOhW8rUZ9NhXAO2n
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Control Panel\International\Geo\Nation eAMUYEAk.exe -
Deletes itself 1 IoCs
pid Process 2876 Process not Found -
Executes dropped EXE 2 IoCs
pid Process 2104 eAMUYEAk.exe 584 RQYwYoUM.exe -
Loads dropped DLL 20 IoCs
pid Process 2268 25c0a17378ed06exeexeexeex.exe 2268 25c0a17378ed06exeexeexeex.exe 2268 25c0a17378ed06exeexeexeex.exe 2268 25c0a17378ed06exeexeexeex.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\huIgMIYc.exe = "C:\\ProgramData\\OqUMoQwE\\huIgMIYc.exe" 25c0a17378ed06exeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Run\eAMUYEAk.exe = "C:\\Users\\Admin\\ICYowIAU\\eAMUYEAk.exe" 25c0a17378ed06exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RQYwYoUM.exe = "C:\\ProgramData\\jsYMsUUs\\RQYwYoUM.exe" 25c0a17378ed06exeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Run\eAMUYEAk.exe = "C:\\Users\\Admin\\ICYowIAU\\eAMUYEAk.exe" eAMUYEAk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RQYwYoUM.exe = "C:\\ProgramData\\jsYMsUUs\\RQYwYoUM.exe" RQYwYoUM.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Run\XGssAEow.exe = "C:\\Users\\Admin\\uMksQIcQ\\XGssAEow.exe" 25c0a17378ed06exeexeexeex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2216 2920 WerFault.exe 727 1572 2836 WerFault.exe 728 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 908 reg.exe 1500 reg.exe 900 reg.exe 2516 reg.exe 2536 reg.exe 1000 reg.exe 2012 reg.exe 3024 reg.exe 2888 reg.exe 2112 reg.exe 1860 reg.exe 2852 reg.exe 2084 reg.exe 2404 reg.exe 2392 reg.exe 1628 reg.exe 1000 reg.exe 444 reg.exe 1852 reg.exe 1160 reg.exe 2748 reg.exe 1332 reg.exe 2980 reg.exe 2180 reg.exe 1708 reg.exe 1516 reg.exe 1924 reg.exe 1076 reg.exe 2636 Process not Found 2372 reg.exe 2348 reg.exe 240 reg.exe 2152 reg.exe 2284 reg.exe 752 Process not Found 1596 reg.exe 1076 reg.exe 2332 reg.exe 3020 reg.exe 2804 reg.exe 2316 reg.exe 1684 reg.exe 2664 reg.exe 2660 reg.exe 880 Process not Found 1804 reg.exe 2716 reg.exe 2496 reg.exe 2232 reg.exe 1732 reg.exe 2924 reg.exe 2932 reg.exe 872 reg.exe 2316 reg.exe 2816 reg.exe 2264 reg.exe 1332 reg.exe 2428 reg.exe 1728 reg.exe 2060 reg.exe 1092 reg.exe 2880 reg.exe 2140 reg.exe 2340 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2268 25c0a17378ed06exeexeexeex.exe 2268 25c0a17378ed06exeexeexeex.exe 444 25c0a17378ed06exeexeexeex.exe 444 25c0a17378ed06exeexeexeex.exe 1144 25c0a17378ed06exeexeexeex.exe 1144 25c0a17378ed06exeexeexeex.exe 2484 25c0a17378ed06exeexeexeex.exe 2484 25c0a17378ed06exeexeexeex.exe 1628 25c0a17378ed06exeexeexeex.exe 1628 25c0a17378ed06exeexeexeex.exe 1040 25c0a17378ed06exeexeexeex.exe 1040 25c0a17378ed06exeexeexeex.exe 1444 25c0a17378ed06exeexeexeex.exe 1444 25c0a17378ed06exeexeexeex.exe 1120 25c0a17378ed06exeexeexeex.exe 1120 25c0a17378ed06exeexeexeex.exe 2748 25c0a17378ed06exeexeexeex.exe 2748 25c0a17378ed06exeexeexeex.exe 2712 25c0a17378ed06exeexeexeex.exe 2712 25c0a17378ed06exeexeexeex.exe 2448 25c0a17378ed06exeexeexeex.exe 2448 25c0a17378ed06exeexeexeex.exe 432 25c0a17378ed06exeexeexeex.exe 432 25c0a17378ed06exeexeexeex.exe 1748 25c0a17378ed06exeexeexeex.exe 1748 25c0a17378ed06exeexeexeex.exe 2308 25c0a17378ed06exeexeexeex.exe 2308 25c0a17378ed06exeexeexeex.exe 2100 25c0a17378ed06exeexeexeex.exe 2100 25c0a17378ed06exeexeexeex.exe 3004 25c0a17378ed06exeexeexeex.exe 3004 25c0a17378ed06exeexeexeex.exe 1948 25c0a17378ed06exeexeexeex.exe 1948 25c0a17378ed06exeexeexeex.exe 876 25c0a17378ed06exeexeexeex.exe 876 25c0a17378ed06exeexeexeex.exe 2964 25c0a17378ed06exeexeexeex.exe 2964 25c0a17378ed06exeexeexeex.exe 2372 25c0a17378ed06exeexeexeex.exe 2372 25c0a17378ed06exeexeexeex.exe 1456 25c0a17378ed06exeexeexeex.exe 1456 25c0a17378ed06exeexeexeex.exe 2032 25c0a17378ed06exeexeexeex.exe 2032 25c0a17378ed06exeexeexeex.exe 2736 25c0a17378ed06exeexeexeex.exe 2736 25c0a17378ed06exeexeexeex.exe 2424 25c0a17378ed06exeexeexeex.exe 2424 25c0a17378ed06exeexeexeex.exe 2120 25c0a17378ed06exeexeexeex.exe 2120 25c0a17378ed06exeexeexeex.exe 2220 25c0a17378ed06exeexeexeex.exe 2220 25c0a17378ed06exeexeexeex.exe 2848 25c0a17378ed06exeexeexeex.exe 2848 25c0a17378ed06exeexeexeex.exe 1556 25c0a17378ed06exeexeexeex.exe 1556 25c0a17378ed06exeexeexeex.exe 2700 25c0a17378ed06exeexeexeex.exe 2700 25c0a17378ed06exeexeexeex.exe 1444 25c0a17378ed06exeexeexeex.exe 1444 25c0a17378ed06exeexeexeex.exe 444 25c0a17378ed06exeexeexeex.exe 444 25c0a17378ed06exeexeexeex.exe 2636 25c0a17378ed06exeexeexeex.exe 2636 25c0a17378ed06exeexeexeex.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe 2104 eAMUYEAk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2104 2268 25c0a17378ed06exeexeexeex.exe 29 PID 2268 wrote to memory of 2104 2268 25c0a17378ed06exeexeexeex.exe 29 PID 2268 wrote to memory of 2104 2268 25c0a17378ed06exeexeexeex.exe 29 PID 2268 wrote to memory of 2104 2268 25c0a17378ed06exeexeexeex.exe 29 PID 2268 wrote to memory of 584 2268 25c0a17378ed06exeexeexeex.exe 30 PID 2268 wrote to memory of 584 2268 25c0a17378ed06exeexeexeex.exe 30 PID 2268 wrote to memory of 584 2268 25c0a17378ed06exeexeexeex.exe 30 PID 2268 wrote to memory of 584 2268 25c0a17378ed06exeexeexeex.exe 30 PID 2268 wrote to memory of 936 2268 25c0a17378ed06exeexeexeex.exe 32 PID 2268 wrote to memory of 936 2268 25c0a17378ed06exeexeexeex.exe 32 PID 2268 wrote to memory of 936 2268 25c0a17378ed06exeexeexeex.exe 32 PID 2268 wrote to memory of 936 2268 25c0a17378ed06exeexeexeex.exe 32 PID 936 wrote to memory of 444 936 cmd.exe 33 PID 936 wrote to memory of 444 936 cmd.exe 33 PID 936 wrote to memory of 444 936 cmd.exe 33 PID 936 wrote to memory of 444 936 cmd.exe 33 PID 2268 wrote to memory of 2144 2268 25c0a17378ed06exeexeexeex.exe 34 PID 2268 wrote to memory of 2144 2268 25c0a17378ed06exeexeexeex.exe 34 PID 2268 wrote to memory of 2144 2268 25c0a17378ed06exeexeexeex.exe 34 PID 2268 wrote to memory of 2144 2268 25c0a17378ed06exeexeexeex.exe 34 PID 2268 wrote to memory of 632 2268 25c0a17378ed06exeexeexeex.exe 35 PID 2268 wrote to memory of 632 2268 25c0a17378ed06exeexeexeex.exe 35 PID 2268 wrote to memory of 632 2268 25c0a17378ed06exeexeexeex.exe 35 PID 2268 wrote to memory of 632 2268 25c0a17378ed06exeexeexeex.exe 35 PID 2268 wrote to memory of 2284 2268 25c0a17378ed06exeexeexeex.exe 37 PID 2268 wrote to memory of 2284 2268 25c0a17378ed06exeexeexeex.exe 37 PID 2268 wrote to memory of 2284 2268 25c0a17378ed06exeexeexeex.exe 37 PID 2268 wrote to memory of 2284 2268 25c0a17378ed06exeexeexeex.exe 37 PID 2268 wrote to memory of 2388 2268 25c0a17378ed06exeexeexeex.exe 38 PID 2268 wrote to memory of 2388 2268 25c0a17378ed06exeexeexeex.exe 38 PID 2268 wrote to memory of 2388 2268 25c0a17378ed06exeexeexeex.exe 38 PID 2268 wrote to memory of 2388 2268 25c0a17378ed06exeexeexeex.exe 38 PID 2388 wrote to memory of 2208 2388 cmd.exe 42 PID 2388 wrote to memory of 2208 2388 cmd.exe 42 PID 2388 wrote to memory of 2208 2388 cmd.exe 42 PID 2388 wrote to memory of 2208 2388 cmd.exe 42 PID 444 wrote to memory of 3004 444 25c0a17378ed06exeexeexeex.exe 43 PID 444 wrote to memory of 3004 444 25c0a17378ed06exeexeexeex.exe 43 PID 444 wrote to memory of 3004 444 25c0a17378ed06exeexeexeex.exe 43 PID 444 wrote to memory of 3004 444 25c0a17378ed06exeexeexeex.exe 43 PID 3004 wrote to memory of 1144 3004 cmd.exe 45 PID 3004 wrote to memory of 1144 3004 cmd.exe 45 PID 3004 wrote to memory of 1144 3004 cmd.exe 45 PID 3004 wrote to memory of 1144 3004 cmd.exe 45 PID 444 wrote to memory of 2600 444 25c0a17378ed06exeexeexeex.exe 46 PID 444 wrote to memory of 2600 444 25c0a17378ed06exeexeexeex.exe 46 PID 444 wrote to memory of 2600 444 25c0a17378ed06exeexeexeex.exe 46 PID 444 wrote to memory of 2600 444 25c0a17378ed06exeexeexeex.exe 46 PID 444 wrote to memory of 2664 444 25c0a17378ed06exeexeexeex.exe 48 PID 444 wrote to memory of 2664 444 25c0a17378ed06exeexeexeex.exe 48 PID 444 wrote to memory of 2664 444 25c0a17378ed06exeexeexeex.exe 48 PID 444 wrote to memory of 2664 444 25c0a17378ed06exeexeexeex.exe 48 PID 444 wrote to memory of 2684 444 25c0a17378ed06exeexeexeex.exe 50 PID 444 wrote to memory of 2684 444 25c0a17378ed06exeexeexeex.exe 50 PID 444 wrote to memory of 2684 444 25c0a17378ed06exeexeexeex.exe 50 PID 444 wrote to memory of 2684 444 25c0a17378ed06exeexeexeex.exe 50 PID 444 wrote to memory of 2480 444 25c0a17378ed06exeexeexeex.exe 53 PID 444 wrote to memory of 2480 444 25c0a17378ed06exeexeexeex.exe 53 PID 444 wrote to memory of 2480 444 25c0a17378ed06exeexeexeex.exe 53 PID 444 wrote to memory of 2480 444 25c0a17378ed06exeexeexeex.exe 53 PID 2480 wrote to memory of 2500 2480 cmd.exe 54 PID 2480 wrote to memory of 2500 2480 cmd.exe 54 PID 2480 wrote to memory of 2500 2480 cmd.exe 54 PID 2480 wrote to memory of 2500 2480 cmd.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\ICYowIAU\eAMUYEAk.exe"C:\Users\Admin\ICYowIAU\eAMUYEAk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
PID:2104
-
-
C:\ProgramData\jsYMsUUs\RQYwYoUM.exe"C:\ProgramData\jsYMsUUs\RQYwYoUM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:584
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1144 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"6⤵PID:2528
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
PID:2592
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵PID:240
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
PID:2516
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\lggQsIow.bat" "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exe""6⤵PID:2444
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵PID:1396
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵PID:2600
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
PID:2664
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵PID:2684
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\pUccggcA.bat" "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exe""4⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵PID:2500
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
PID:2144
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵PID:632
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵PID:2284
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\IwAksQYM.bat" "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵PID:2208
-
-
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2484 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"2⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"4⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1040 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"6⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1444 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"8⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"10⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"12⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"14⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"16⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
PID:432 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"18⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"20⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"22⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2100 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"24⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
PID:3004 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"26⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"28⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
PID:876 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"30⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2964 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"32⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2372 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"34⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1456 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"36⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"38⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"40⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"42⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex43⤵
- Suspicious behavior: EnumeratesProcesses
PID:2120 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"44⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2220 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"46⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex47⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"48⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex49⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"50⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"52⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex53⤵
- Suspicious behavior: EnumeratesProcesses
PID:1444 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"54⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex55⤵
- Suspicious behavior: EnumeratesProcesses
PID:444 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"56⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex57⤵
- Suspicious behavior: EnumeratesProcesses
PID:2636 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"58⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex59⤵PID:2772
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"60⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex61⤵PID:2180
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"62⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex63⤵PID:2972
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"64⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex65⤵PID:2336
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"66⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex67⤵PID:2844
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"68⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex69⤵PID:1648
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"70⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex71⤵PID:624
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"72⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex73⤵PID:1628
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"74⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex75⤵PID:2544
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"76⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex77⤵PID:1520
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"78⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex79⤵PID:2928
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"80⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex81⤵PID:1804
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"82⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex83⤵PID:2468
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"84⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex85⤵PID:1120
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"86⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex87⤵PID:2320
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"88⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex89⤵PID:2448
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"90⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex91⤵PID:2560
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"92⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex93⤵PID:2604
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"94⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex95⤵PID:2492
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"96⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex97⤵PID:1944
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"98⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex99⤵PID:2776
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"100⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex101⤵PID:1988
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"102⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex103⤵PID:2560
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"104⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex105⤵PID:2932
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"106⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex107⤵PID:1984
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"108⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex109⤵PID:1944
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"110⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex111⤵
- Adds Run key to start application
PID:3012 -
C:\Users\Admin\uMksQIcQ\XGssAEow.exe"C:\Users\Admin\uMksQIcQ\XGssAEow.exe"112⤵PID:2920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 36113⤵
- Program crash
PID:2216
-
-
-
C:\ProgramData\OqUMoQwE\huIgMIYc.exe"C:\ProgramData\OqUMoQwE\huIgMIYc.exe"112⤵PID:2836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 36113⤵
- Program crash
PID:1572
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"112⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex113⤵PID:2176
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"114⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex115⤵PID:2716
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"116⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex117⤵PID:2964
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"118⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex119⤵PID:948
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"120⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex121⤵PID:2356
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\25c0a17378ed06exeexeexeex"122⤵PID:1372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-