Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2023, 15:09
Static task
static1
Behavioral task
behavioral1
Sample
97770c0f488814exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
97770c0f488814exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
97770c0f488814exeexeexeex.exe
-
Size
209KB
-
MD5
97770c0f4888147bbc71747aa68927aa
-
SHA1
7c17880fdc80b7a8a2781c1fd94897318165d4ca
-
SHA256
79d2295e28737b94cc736944990d2232552f730c2538cef88bdd6c31657d0c62
-
SHA512
a8a9c10566ddf53896f32528b2165005f0e9b590ef419170be0c621449d2604dde641640c7629616d8e89204465e260529c9f6eed9b48a1d80ace424b905b67b
-
SSDEEP
6144:SVTXUz4zLUc/z5TjzPvEE0Icu+sW7qJ85oNZXl:UAzkpjjvEE0Icu+s2qJZZXl
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\CompressConfirm.png.exe GiIcQssk.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation GiIcQssk.exe -
Executes dropped EXE 2 IoCs
pid Process 444 GiIcQssk.exe 324 IIEkcAQY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GiIcQssk.exe = "C:\\Users\\Admin\\MQUEwkwQ\\GiIcQssk.exe" 97770c0f488814exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IIEkcAQY.exe = "C:\\ProgramData\\Rckgksow\\IIEkcAQY.exe" 97770c0f488814exeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GiIcQssk.exe = "C:\\Users\\Admin\\MQUEwkwQ\\GiIcQssk.exe" GiIcQssk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IIEkcAQY.exe = "C:\\ProgramData\\Rckgksow\\IIEkcAQY.exe" IIEkcAQY.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 97770c0f488814exeexeexeex.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 97770c0f488814exeexeexeex.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe GiIcQssk.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe GiIcQssk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2976 reg.exe 4488 reg.exe 4700 reg.exe 2776 reg.exe 4464 reg.exe 4620 reg.exe 1900 reg.exe 4708 reg.exe 4816 reg.exe 4004 reg.exe 704 reg.exe 3932 reg.exe 3756 reg.exe 2200 reg.exe 2372 reg.exe 1968 reg.exe 4552 reg.exe 1124 reg.exe 748 reg.exe 4464 reg.exe 1344 reg.exe 1124 reg.exe 5016 reg.exe 2428 reg.exe 4708 reg.exe 4992 reg.exe 4312 reg.exe 4784 reg.exe 540 reg.exe 4612 reg.exe 1136 reg.exe 2296 reg.exe 2288 reg.exe 4444 reg.exe 1748 reg.exe 4788 reg.exe 920 reg.exe 4572 reg.exe 3324 reg.exe 3084 reg.exe 4876 reg.exe 4664 reg.exe 4776 reg.exe 2816 reg.exe 2692 reg.exe 3896 reg.exe 796 reg.exe 3464 reg.exe 2488 reg.exe 4064 reg.exe 660 reg.exe 4816 reg.exe 4776 reg.exe 5008 reg.exe 3492 reg.exe 2284 reg.exe 4460 reg.exe 2076 reg.exe 4300 reg.exe 4708 reg.exe 4552 reg.exe 2616 reg.exe 3992 reg.exe 396 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 97770c0f488814exeexeexeex.exe 2372 97770c0f488814exeexeexeex.exe 2372 97770c0f488814exeexeexeex.exe 2372 97770c0f488814exeexeexeex.exe 2488 97770c0f488814exeexeexeex.exe 2488 97770c0f488814exeexeexeex.exe 2488 97770c0f488814exeexeexeex.exe 2488 97770c0f488814exeexeexeex.exe 5056 Process not Found 5056 Process not Found 5056 Process not Found 5056 Process not Found 888 reg.exe 888 reg.exe 888 reg.exe 888 reg.exe 1828 97770c0f488814exeexeexeex.exe 1828 97770c0f488814exeexeexeex.exe 1828 97770c0f488814exeexeexeex.exe 1828 97770c0f488814exeexeexeex.exe 4748 97770c0f488814exeexeexeex.exe 4748 97770c0f488814exeexeexeex.exe 4748 97770c0f488814exeexeexeex.exe 4748 97770c0f488814exeexeexeex.exe 3820 97770c0f488814exeexeexeex.exe 3820 97770c0f488814exeexeexeex.exe 3820 97770c0f488814exeexeexeex.exe 3820 97770c0f488814exeexeexeex.exe 1772 97770c0f488814exeexeexeex.exe 1772 97770c0f488814exeexeexeex.exe 1772 97770c0f488814exeexeexeex.exe 1772 97770c0f488814exeexeexeex.exe 4020 97770c0f488814exeexeexeex.exe 4020 97770c0f488814exeexeexeex.exe 4020 97770c0f488814exeexeexeex.exe 4020 97770c0f488814exeexeexeex.exe 3740 reg.exe 3740 reg.exe 3740 reg.exe 3740 reg.exe 1664 97770c0f488814exeexeexeex.exe 1664 97770c0f488814exeexeexeex.exe 1664 97770c0f488814exeexeexeex.exe 1664 97770c0f488814exeexeexeex.exe 4452 reg.exe 4452 reg.exe 4452 reg.exe 4452 reg.exe 1968 97770c0f488814exeexeexeex.exe 1968 97770c0f488814exeexeexeex.exe 1968 97770c0f488814exeexeexeex.exe 1968 97770c0f488814exeexeexeex.exe 4308 97770c0f488814exeexeexeex.exe 4308 97770c0f488814exeexeexeex.exe 4308 97770c0f488814exeexeexeex.exe 4308 97770c0f488814exeexeexeex.exe 3224 reg.exe 3224 reg.exe 3224 reg.exe 3224 reg.exe 2928 reg.exe 2928 reg.exe 2928 reg.exe 2928 reg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 444 GiIcQssk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe 444 GiIcQssk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 444 2372 97770c0f488814exeexeexeex.exe 84 PID 2372 wrote to memory of 444 2372 97770c0f488814exeexeexeex.exe 84 PID 2372 wrote to memory of 444 2372 97770c0f488814exeexeexeex.exe 84 PID 2372 wrote to memory of 324 2372 97770c0f488814exeexeexeex.exe 85 PID 2372 wrote to memory of 324 2372 97770c0f488814exeexeexeex.exe 85 PID 2372 wrote to memory of 324 2372 97770c0f488814exeexeexeex.exe 85 PID 2372 wrote to memory of 876 2372 97770c0f488814exeexeexeex.exe 86 PID 2372 wrote to memory of 876 2372 97770c0f488814exeexeexeex.exe 86 PID 2372 wrote to memory of 876 2372 97770c0f488814exeexeexeex.exe 86 PID 2372 wrote to memory of 2616 2372 97770c0f488814exeexeexeex.exe 88 PID 2372 wrote to memory of 2616 2372 97770c0f488814exeexeexeex.exe 88 PID 2372 wrote to memory of 2616 2372 97770c0f488814exeexeexeex.exe 88 PID 2372 wrote to memory of 4808 2372 97770c0f488814exeexeexeex.exe 92 PID 2372 wrote to memory of 4808 2372 97770c0f488814exeexeexeex.exe 92 PID 2372 wrote to memory of 4808 2372 97770c0f488814exeexeexeex.exe 92 PID 2372 wrote to memory of 3324 2372 97770c0f488814exeexeexeex.exe 90 PID 2372 wrote to memory of 3324 2372 97770c0f488814exeexeexeex.exe 90 PID 2372 wrote to memory of 3324 2372 97770c0f488814exeexeexeex.exe 90 PID 2372 wrote to memory of 3232 2372 97770c0f488814exeexeexeex.exe 89 PID 2372 wrote to memory of 3232 2372 97770c0f488814exeexeexeex.exe 89 PID 2372 wrote to memory of 3232 2372 97770c0f488814exeexeexeex.exe 89 PID 876 wrote to memory of 2488 876 cmd.exe 96 PID 876 wrote to memory of 2488 876 cmd.exe 96 PID 876 wrote to memory of 2488 876 cmd.exe 96 PID 3232 wrote to memory of 2172 3232 cmd.exe 97 PID 3232 wrote to memory of 2172 3232 cmd.exe 97 PID 3232 wrote to memory of 2172 3232 cmd.exe 97 PID 2488 wrote to memory of 3756 2488 97770c0f488814exeexeexeex.exe 98 PID 2488 wrote to memory of 3756 2488 97770c0f488814exeexeexeex.exe 98 PID 2488 wrote to memory of 3756 2488 97770c0f488814exeexeexeex.exe 98 PID 3756 wrote to memory of 5056 3756 cmd.exe 108 PID 3756 wrote to memory of 5056 3756 cmd.exe 108 PID 3756 wrote to memory of 5056 3756 cmd.exe 108 PID 2488 wrote to memory of 4224 2488 97770c0f488814exeexeexeex.exe 100 PID 2488 wrote to memory of 4224 2488 97770c0f488814exeexeexeex.exe 100 PID 2488 wrote to memory of 4224 2488 97770c0f488814exeexeexeex.exe 100 PID 2488 wrote to memory of 2296 2488 97770c0f488814exeexeexeex.exe 107 PID 2488 wrote to memory of 2296 2488 97770c0f488814exeexeexeex.exe 107 PID 2488 wrote to memory of 2296 2488 97770c0f488814exeexeexeex.exe 107 PID 2488 wrote to memory of 2768 2488 97770c0f488814exeexeexeex.exe 106 PID 2488 wrote to memory of 2768 2488 97770c0f488814exeexeexeex.exe 106 PID 2488 wrote to memory of 2768 2488 97770c0f488814exeexeexeex.exe 106 PID 2488 wrote to memory of 3896 2488 97770c0f488814exeexeexeex.exe 101 PID 2488 wrote to memory of 3896 2488 97770c0f488814exeexeexeex.exe 101 PID 2488 wrote to memory of 3896 2488 97770c0f488814exeexeexeex.exe 101 PID 3896 wrote to memory of 1640 3896 cmd.exe 109 PID 3896 wrote to memory of 1640 3896 cmd.exe 109 PID 3896 wrote to memory of 1640 3896 cmd.exe 109 PID 5056 wrote to memory of 3740 5056 Process not Found 110 PID 5056 wrote to memory of 3740 5056 Process not Found 110 PID 5056 wrote to memory of 3740 5056 Process not Found 110 PID 5056 wrote to memory of 4564 5056 Process not Found 112 PID 5056 wrote to memory of 4564 5056 Process not Found 112 PID 5056 wrote to memory of 4564 5056 Process not Found 112 PID 3740 wrote to memory of 888 3740 97770c0f488814exeexeexeex.exe 186 PID 3740 wrote to memory of 888 3740 97770c0f488814exeexeexeex.exe 186 PID 3740 wrote to memory of 888 3740 97770c0f488814exeexeexeex.exe 186 PID 5056 wrote to memory of 4312 5056 Process not Found 114 PID 5056 wrote to memory of 4312 5056 Process not Found 114 PID 5056 wrote to memory of 4312 5056 Process not Found 114 PID 5056 wrote to memory of 5092 5056 Process not Found 119 PID 5056 wrote to memory of 5092 5056 Process not Found 119 PID 5056 wrote to memory of 5092 5056 Process not Found 119 PID 5056 wrote to memory of 2916 5056 Process not Found 116 -
System policy modification 1 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 97770c0f488814exeexeexeex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 97770c0f488814exeexeexeex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 97770c0f488814exeexeexeex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97770c0f488814exeexeexeex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\MQUEwkwQ\GiIcQssk.exe"C:\Users\Admin\MQUEwkwQ\GiIcQssk.exe"2⤵
- Modifies extensions of user files
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:444
-
-
C:\ProgramData\Rckgksow\IIEkcAQY.exe"C:\ProgramData\Rckgksow\IIEkcAQY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex5⤵PID:5056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"6⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex7⤵PID:888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"8⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"10⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"12⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"14⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"16⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
PID:4020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"18⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex19⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"20⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"22⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex23⤵PID:4452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"24⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"26⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"28⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex29⤵PID:3224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"30⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex31⤵PID:2928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"32⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex33⤵PID:2372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"34⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex35⤵PID:1484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"36⤵PID:5108
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
- UAC bypass
PID:4628
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex37⤵PID:2000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"38⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex39⤵PID:4208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"40⤵PID:4476
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵PID:2556
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex41⤵PID:4320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"42⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex43⤵PID:2040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"44⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex45⤵
- Modifies visibility of file extensions in Explorer
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"46⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex47⤵PID:2104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"48⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex49⤵PID:2816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"50⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex51⤵PID:1952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"52⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex53⤵PID:1468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"54⤵PID:2828
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵PID:2076
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex55⤵
- Modifies visibility of file extensions in Explorer
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"56⤵PID:4008
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵PID:4992
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex57⤵PID:4028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"58⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex59⤵
- Modifies visibility of file extensions in Explorer
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"60⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex61⤵PID:3560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"62⤵PID:3204
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵PID:2252
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex63⤵PID:5092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"64⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex65⤵PID:1520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"66⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex67⤵PID:3780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"68⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex69⤵PID:5088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"70⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex71⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"72⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex73⤵PID:2444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"74⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex75⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"76⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex77⤵PID:4320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"78⤵PID:4428
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵PID:3732
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex79⤵PID:3948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"80⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex81⤵PID:3296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"82⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex83⤵PID:764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"84⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex85⤵PID:4608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"86⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex87⤵PID:3532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"88⤵PID:4108
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
- UAC bypass
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex89⤵PID:2752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"90⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex91⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"92⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex93⤵PID:2908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"94⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex95⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"96⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex97⤵PID:3168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"98⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex99⤵PID:628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"100⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex101⤵PID:4476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"102⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex103⤵PID:4648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"104⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex105⤵PID:1700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"106⤵PID:4784
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
- UAC bypass
PID:460
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex107⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"108⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex109⤵PID:316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"110⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex111⤵PID:4940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"112⤵
- Modifies visibility of file extensions in Explorer
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex113⤵PID:4436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"114⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex115⤵PID:1732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"116⤵
- Checks whether UAC is enabled
- System policy modification
PID:3012 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:2148
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex117⤵PID:2272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"118⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex119⤵PID:1864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"120⤵PID:2832
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:5108
-
-
C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex121⤵PID:4816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\97770c0f488814exeexeexeex"122⤵PID:1004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-