Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
72s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
11/07/2023, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
e4d99b4c2398c9exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
e4d99b4c2398c9exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
e4d99b4c2398c9exeexeexeex.exe
-
Size
189KB
-
MD5
e4d99b4c2398c93b1f2b10e2654f6a16
-
SHA1
4fae6d358c1c12e60734d7af63d4e00aad92b751
-
SHA256
641130fcae1b019622ed1c9711c7cd6888cee2006e9393dd19d9bf17563c3a4a
-
SHA512
0a938b6a5df7139907ea4d866cd47493f9e362ee2bb63780dce5dd3be463d78dd14a070cfe5a16f76762789803fe999726e964914d425d9cbd923efbc723c32b
-
SSDEEP
3072:SH06xfl/ijOsiekvgU3o3pjrgkNVZIJmWcoINr6Akl8oefTwKeEWPPrg0:IXvgU30pnV2JmWcoINr6Akl8oEwKeBLT
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\UnblockSelect.png.exe cIEMUgAI.exe -
Executes dropped EXE 2 IoCs
pid Process 1412 HCokgkog.exe 408 cIEMUgAI.exe -
Loads dropped DLL 20 IoCs
pid Process 2344 e4d99b4c2398c9exeexeexeex.exe 2344 e4d99b4c2398c9exeexeexeex.exe 2344 e4d99b4c2398c9exeexeexeex.exe 2344 e4d99b4c2398c9exeexeexeex.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe 408 cIEMUgAI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Run\HCokgkog.exe = "C:\\Users\\Admin\\OEcccAAE\\HCokgkog.exe" e4d99b4c2398c9exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cIEMUgAI.exe = "C:\\ProgramData\\ESIYoMMo\\cIEMUgAI.exe" e4d99b4c2398c9exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cIEMUgAI.exe = "C:\\ProgramData\\ESIYoMMo\\cIEMUgAI.exe" cIEMUgAI.exe Set value (str) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Run\HCokgkog.exe = "C:\\Users\\Admin\\OEcccAAE\\HCokgkog.exe" HCokgkog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Run\HCEAMkEY.exe = "C:\\Users\\Admin\\HYwgYgcU\\HCEAMkEY.exe" e4d99b4c2398c9exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yWIwwMQk.exe = "C:\\ProgramData\\xGwEowAQ\\yWIwwMQk.exe" e4d99b4c2398c9exeexeexeex.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico cIEMUgAI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 956 1004 WerFault.exe 1532 2036 2356 WerFault.exe 1531 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 576 reg.exe 2808 reg.exe 1740 reg.exe 2424 reg.exe 1320 reg.exe 552 Process not Found 2484 reg.exe 2576 reg.exe 2752 reg.exe 1236 reg.exe 904 reg.exe 924 reg.exe 2240 reg.exe 2320 reg.exe 324 reg.exe 2736 reg.exe 1576 reg.exe 1544 reg.exe 2696 reg.exe 1968 reg.exe 1620 reg.exe 1380 reg.exe 992 reg.exe 468 reg.exe 2036 reg.exe 2456 reg.exe 2972 reg.exe 1056 reg.exe 2828 reg.exe 2844 reg.exe 2248 reg.exe 2332 reg.exe 1456 reg.exe 2948 reg.exe 840 reg.exe 2976 reg.exe 2424 reg.exe 2948 reg.exe 2880 reg.exe 1368 reg.exe 2700 reg.exe 1984 reg.exe 1744 reg.exe 2624 reg.exe 1300 reg.exe 936 reg.exe 1548 reg.exe 1816 reg.exe 384 reg.exe 1292 reg.exe 2444 reg.exe 2480 reg.exe 2608 reg.exe 948 reg.exe 2288 reg.exe 2644 reg.exe 2788 reg.exe 2484 reg.exe 2748 reg.exe 520 reg.exe 2580 reg.exe 2752 reg.exe 860 reg.exe 468 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2344 e4d99b4c2398c9exeexeexeex.exe 2344 e4d99b4c2398c9exeexeexeex.exe 2856 e4d99b4c2398c9exeexeexeex.exe 2856 e4d99b4c2398c9exeexeexeex.exe 2664 e4d99b4c2398c9exeexeexeex.exe 2664 e4d99b4c2398c9exeexeexeex.exe 2088 e4d99b4c2398c9exeexeexeex.exe 2088 e4d99b4c2398c9exeexeexeex.exe 1616 e4d99b4c2398c9exeexeexeex.exe 1616 e4d99b4c2398c9exeexeexeex.exe 1396 e4d99b4c2398c9exeexeexeex.exe 1396 e4d99b4c2398c9exeexeexeex.exe 1324 e4d99b4c2398c9exeexeexeex.exe 1324 e4d99b4c2398c9exeexeexeex.exe 2336 e4d99b4c2398c9exeexeexeex.exe 2336 e4d99b4c2398c9exeexeexeex.exe 2696 e4d99b4c2398c9exeexeexeex.exe 2696 e4d99b4c2398c9exeexeexeex.exe 2720 e4d99b4c2398c9exeexeexeex.exe 2720 e4d99b4c2398c9exeexeexeex.exe 1544 e4d99b4c2398c9exeexeexeex.exe 1544 e4d99b4c2398c9exeexeexeex.exe 1816 e4d99b4c2398c9exeexeexeex.exe 1816 e4d99b4c2398c9exeexeexeex.exe 1828 e4d99b4c2398c9exeexeexeex.exe 1828 e4d99b4c2398c9exeexeexeex.exe 2424 e4d99b4c2398c9exeexeexeex.exe 2424 e4d99b4c2398c9exeexeexeex.exe 2580 e4d99b4c2398c9exeexeexeex.exe 2580 e4d99b4c2398c9exeexeexeex.exe 2736 e4d99b4c2398c9exeexeexeex.exe 2736 e4d99b4c2398c9exeexeexeex.exe 2760 e4d99b4c2398c9exeexeexeex.exe 2760 e4d99b4c2398c9exeexeexeex.exe 1548 e4d99b4c2398c9exeexeexeex.exe 1548 e4d99b4c2398c9exeexeexeex.exe 544 e4d99b4c2398c9exeexeexeex.exe 544 e4d99b4c2398c9exeexeexeex.exe 1152 e4d99b4c2398c9exeexeexeex.exe 1152 e4d99b4c2398c9exeexeexeex.exe 2136 e4d99b4c2398c9exeexeexeex.exe 2136 e4d99b4c2398c9exeexeexeex.exe 2552 e4d99b4c2398c9exeexeexeex.exe 2552 e4d99b4c2398c9exeexeexeex.exe 956 e4d99b4c2398c9exeexeexeex.exe 956 e4d99b4c2398c9exeexeexeex.exe 1064 e4d99b4c2398c9exeexeexeex.exe 1064 e4d99b4c2398c9exeexeexeex.exe 2984 e4d99b4c2398c9exeexeexeex.exe 2984 e4d99b4c2398c9exeexeexeex.exe 2724 e4d99b4c2398c9exeexeexeex.exe 2724 e4d99b4c2398c9exeexeexeex.exe 2516 e4d99b4c2398c9exeexeexeex.exe 2516 e4d99b4c2398c9exeexeexeex.exe 968 e4d99b4c2398c9exeexeexeex.exe 968 e4d99b4c2398c9exeexeexeex.exe 1748 e4d99b4c2398c9exeexeexeex.exe 1748 e4d99b4c2398c9exeexeexeex.exe 2992 e4d99b4c2398c9exeexeexeex.exe 2992 e4d99b4c2398c9exeexeexeex.exe 2156 e4d99b4c2398c9exeexeexeex.exe 2156 e4d99b4c2398c9exeexeexeex.exe 1588 e4d99b4c2398c9exeexeexeex.exe 1588 e4d99b4c2398c9exeexeexeex.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1412 2344 e4d99b4c2398c9exeexeexeex.exe 28 PID 2344 wrote to memory of 1412 2344 e4d99b4c2398c9exeexeexeex.exe 28 PID 2344 wrote to memory of 1412 2344 e4d99b4c2398c9exeexeexeex.exe 28 PID 2344 wrote to memory of 1412 2344 e4d99b4c2398c9exeexeexeex.exe 28 PID 2344 wrote to memory of 408 2344 e4d99b4c2398c9exeexeexeex.exe 29 PID 2344 wrote to memory of 408 2344 e4d99b4c2398c9exeexeexeex.exe 29 PID 2344 wrote to memory of 408 2344 e4d99b4c2398c9exeexeexeex.exe 29 PID 2344 wrote to memory of 408 2344 e4d99b4c2398c9exeexeexeex.exe 29 PID 2344 wrote to memory of 2212 2344 e4d99b4c2398c9exeexeexeex.exe 31 PID 2344 wrote to memory of 2212 2344 e4d99b4c2398c9exeexeexeex.exe 31 PID 2344 wrote to memory of 2212 2344 e4d99b4c2398c9exeexeexeex.exe 31 PID 2344 wrote to memory of 2212 2344 e4d99b4c2398c9exeexeexeex.exe 31 PID 2212 wrote to memory of 2856 2212 cmd.exe 32 PID 2212 wrote to memory of 2856 2212 cmd.exe 32 PID 2212 wrote to memory of 2856 2212 cmd.exe 32 PID 2212 wrote to memory of 2856 2212 cmd.exe 32 PID 2344 wrote to memory of 2424 2344 e4d99b4c2398c9exeexeexeex.exe 33 PID 2344 wrote to memory of 2424 2344 e4d99b4c2398c9exeexeexeex.exe 33 PID 2344 wrote to memory of 2424 2344 e4d99b4c2398c9exeexeexeex.exe 33 PID 2344 wrote to memory of 2424 2344 e4d99b4c2398c9exeexeexeex.exe 33 PID 2344 wrote to memory of 588 2344 e4d99b4c2398c9exeexeexeex.exe 34 PID 2344 wrote to memory of 588 2344 e4d99b4c2398c9exeexeexeex.exe 34 PID 2344 wrote to memory of 588 2344 e4d99b4c2398c9exeexeexeex.exe 34 PID 2344 wrote to memory of 588 2344 e4d99b4c2398c9exeexeexeex.exe 34 PID 2344 wrote to memory of 2004 2344 e4d99b4c2398c9exeexeexeex.exe 36 PID 2344 wrote to memory of 2004 2344 e4d99b4c2398c9exeexeexeex.exe 36 PID 2344 wrote to memory of 2004 2344 e4d99b4c2398c9exeexeexeex.exe 36 PID 2344 wrote to memory of 2004 2344 e4d99b4c2398c9exeexeexeex.exe 36 PID 2344 wrote to memory of 2896 2344 e4d99b4c2398c9exeexeexeex.exe 40 PID 2344 wrote to memory of 2896 2344 e4d99b4c2398c9exeexeexeex.exe 40 PID 2344 wrote to memory of 2896 2344 e4d99b4c2398c9exeexeexeex.exe 40 PID 2344 wrote to memory of 2896 2344 e4d99b4c2398c9exeexeexeex.exe 40 PID 2896 wrote to memory of 1172 2896 cmd.exe 41 PID 2896 wrote to memory of 1172 2896 cmd.exe 41 PID 2896 wrote to memory of 1172 2896 cmd.exe 41 PID 2896 wrote to memory of 1172 2896 cmd.exe 41 PID 2856 wrote to memory of 2716 2856 e4d99b4c2398c9exeexeexeex.exe 42 PID 2856 wrote to memory of 2716 2856 e4d99b4c2398c9exeexeexeex.exe 42 PID 2856 wrote to memory of 2716 2856 e4d99b4c2398c9exeexeexeex.exe 42 PID 2856 wrote to memory of 2716 2856 e4d99b4c2398c9exeexeexeex.exe 42 PID 2716 wrote to memory of 2664 2716 cmd.exe 44 PID 2716 wrote to memory of 2664 2716 cmd.exe 44 PID 2716 wrote to memory of 2664 2716 cmd.exe 44 PID 2716 wrote to memory of 2664 2716 cmd.exe 44 PID 2856 wrote to memory of 2580 2856 e4d99b4c2398c9exeexeexeex.exe 45 PID 2856 wrote to memory of 2580 2856 e4d99b4c2398c9exeexeexeex.exe 45 PID 2856 wrote to memory of 2580 2856 e4d99b4c2398c9exeexeexeex.exe 45 PID 2856 wrote to memory of 2580 2856 e4d99b4c2398c9exeexeexeex.exe 45 PID 2856 wrote to memory of 2456 2856 e4d99b4c2398c9exeexeexeex.exe 47 PID 2856 wrote to memory of 2456 2856 e4d99b4c2398c9exeexeexeex.exe 47 PID 2856 wrote to memory of 2456 2856 e4d99b4c2398c9exeexeexeex.exe 47 PID 2856 wrote to memory of 2456 2856 e4d99b4c2398c9exeexeexeex.exe 47 PID 2856 wrote to memory of 2648 2856 e4d99b4c2398c9exeexeexeex.exe 52 PID 2856 wrote to memory of 2648 2856 e4d99b4c2398c9exeexeexeex.exe 52 PID 2856 wrote to memory of 2648 2856 e4d99b4c2398c9exeexeexeex.exe 52 PID 2856 wrote to memory of 2648 2856 e4d99b4c2398c9exeexeexeex.exe 52 PID 2856 wrote to memory of 2072 2856 e4d99b4c2398c9exeexeexeex.exe 48 PID 2856 wrote to memory of 2072 2856 e4d99b4c2398c9exeexeexeex.exe 48 PID 2856 wrote to memory of 2072 2856 e4d99b4c2398c9exeexeexeex.exe 48 PID 2856 wrote to memory of 2072 2856 e4d99b4c2398c9exeexeexeex.exe 48 PID 2072 wrote to memory of 1340 2072 cmd.exe 53 PID 2072 wrote to memory of 1340 2072 cmd.exe 53 PID 2072 wrote to memory of 1340 2072 cmd.exe 53 PID 2072 wrote to memory of 1340 2072 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\OEcccAAE\HCokgkog.exe"C:\Users\Admin\OEcccAAE\HCokgkog.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1412
-
-
C:\ProgramData\ESIYoMMo\cIEMUgAI.exe"C:\ProgramData\ESIYoMMo\cIEMUgAI.exe"2⤵
- Modifies extensions of user files
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
PID:408
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2664 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"6⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2088 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"8⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"10⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"12⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1324 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"14⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"16⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2696 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"18⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"20⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1544 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"22⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"24⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"26⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"28⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2580 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"30⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"32⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"34⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1548 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"36⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex37⤵
- Suspicious behavior: EnumeratesProcesses
PID:544 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"38⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex39⤵
- Suspicious behavior: EnumeratesProcesses
PID:1152 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"40⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2136 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"42⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex43⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"44⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex45⤵
- Suspicious behavior: EnumeratesProcesses
PID:956 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"46⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"48⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2984 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"50⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"52⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2516 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"54⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex55⤵
- Suspicious behavior: EnumeratesProcesses
PID:968 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"56⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"58⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"60⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2156 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"62⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex63⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"64⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex65⤵PID:2544
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"66⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex67⤵PID:1608
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"68⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex69⤵PID:544
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"70⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex71⤵PID:1060
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"72⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex73⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"74⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex75⤵PID:536
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"76⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex77⤵PID:2064
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"78⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex79⤵PID:2016
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"80⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex81⤵PID:2376
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"82⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex83⤵PID:1104
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"84⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex85⤵PID:2172
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"86⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex87⤵PID:936
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"88⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex89⤵PID:992
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"90⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex91⤵PID:1576
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"92⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex93⤵PID:1776
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"94⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex95⤵PID:1700
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"96⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex97⤵PID:1000
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"98⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex99⤵PID:1360
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"100⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex101⤵PID:2284
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"102⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex103⤵PID:2932
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"104⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex105⤵PID:1488
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"106⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex107⤵PID:1096
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"108⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex109⤵PID:2492
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"110⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex111⤵PID:1632
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"112⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex113⤵PID:2876
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"114⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex115⤵PID:2196
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"116⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex117⤵PID:2308
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"118⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex119⤵PID:2504
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"120⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex121⤵PID:2016
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\e4d99b4c2398c9exeexeexeex"122⤵PID:3040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-