73e8803e31fe0751b5ac3402a49ec56c17ed6c30fcd77c5640a76abb8a1f2c9f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

466037c5c19ff0b34797fca5d4e3a78c.exe
Size

143KB
MD5

466037c5c19ff0b34797fca5d4e3a78c
SHA1

956c917846c4d073b736dc5d9fe394f9f2d525f5
SHA256

73e8803e31fe0751b5ac3402a49ec56c17ed6c30fcd77c5640a76abb8a1f2c9f
SHA512

8ab40ef3f95b23d229119e25d495f27e7055420975eeb3fb242babf7ba414f20faea3790764a8affa5bdbd495b343f6f8015b280bfaba0905010724822ccb305
SSDEEP

3072:GqOHjyAc//////jCwo0icTt/q7iqccqfQzgAt8Hw6FogKD3:jOHTc//////X1kmydVSHzm3

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	iyuv_32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	iyuv_32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	iyuv_32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	iyuv_32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}	iyuv_32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\iyuv_32.exe /i"	iyuv_32.exe

Executes dropped EXE 27 IoCs

pid	Process
3124	iyuv_32.exe
624	iyuv_32.exe
1756	iyuv_32.exe
4848	iyuv_32.exe
2688	iyuv_32.exe
2792	iyuv_32.exe
3940	iyuv_32.exe
3576	iyuv_32.exe
2776	iyuv_32.exe
1224	iyuv_32.exe
2824	iyuv_32.exe
3620	iyuv_32.exe
3052	iyuv_32.exe
1752	iyuv_32.exe
5116	iyuv_32.exe
2700	iyuv_32.exe
968	reg.exe
2752	iyuv_32.exe
2672	iyuv_32.exe
2076	iyuv_32.exe
564	iyuv_32.exe
2840	reg.exe
1788	reg.exe
3408	iyuv_32.exe
2552	reg.exe
3004	reg.exe
2980	cmd.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\iyuv_32.exe	466037c5c19ff0b34797fca5d4e3a78c.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	reg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	reg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	reg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	466037c5c19ff0b34797fca5d4e3a78c.exe
File created	C:\Windows\SysWOW64\_deleteme.bat	466037c5c19ff0b34797fca5d4e3a78c.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	reg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	reg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	reg.exe
File created	C:\Windows\SysWOW64\c_l6505.nls	466037c5c19ff0b34797fca5d4e3a78c.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\iyuv_32.exe	466037c5c19ff0b34797fca5d4e3a78c.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe
File created	C:\Windows\SysWOW64\_Setup.bat	cmd.exe
File created	C:\Windows\SysWOW64\_Setup.bat	iyuv_32.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2428	466037c5c19ff0b34797fca5d4e3a78c.exe
2428	466037c5c19ff0b34797fca5d4e3a78c.exe
3124	iyuv_32.exe
3124	iyuv_32.exe
624	iyuv_32.exe
624	iyuv_32.exe
1756	iyuv_32.exe
1756	iyuv_32.exe
4848	iyuv_32.exe
4848	iyuv_32.exe
2688	iyuv_32.exe
2688	iyuv_32.exe
2792	iyuv_32.exe
2792	iyuv_32.exe
3940	iyuv_32.exe
3940	iyuv_32.exe
3576	iyuv_32.exe
3576	iyuv_32.exe
2776	iyuv_32.exe
2776	iyuv_32.exe
1224	iyuv_32.exe
1224	iyuv_32.exe
2824	iyuv_32.exe
2824	iyuv_32.exe
3620	iyuv_32.exe
3620	iyuv_32.exe
3052	iyuv_32.exe
3052	iyuv_32.exe
1752	iyuv_32.exe
1752	iyuv_32.exe
5116	reg.exe
5116	reg.exe
2700	iyuv_32.exe
2700	iyuv_32.exe
968	reg.exe
968	reg.exe
2752	iyuv_32.exe
2752	iyuv_32.exe
2672	iyuv_32.exe
2672	iyuv_32.exe
2076	iyuv_32.exe
2076	iyuv_32.exe
564	iyuv_32.exe
564	iyuv_32.exe
2840	reg.exe
2840	reg.exe
1788	reg.exe
1788	reg.exe
3408	iyuv_32.exe
3408	iyuv_32.exe
2552	reg.exe
2552	reg.exe
3004	reg.exe
3004	reg.exe
2980	cmd.exe
2980	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2720	2428	466037c5c19ff0b34797fca5d4e3a78c.exe	95
PID 2428 wrote to memory of 2720	2428	466037c5c19ff0b34797fca5d4e3a78c.exe	95
PID 2428 wrote to memory of 2720	2428	466037c5c19ff0b34797fca5d4e3a78c.exe	95
PID 2720 wrote to memory of 4904	2720	cmd.exe	94
PID 2720 wrote to memory of 4904	2720	cmd.exe	94
PID 2720 wrote to memory of 4904	2720	cmd.exe	94
PID 2720 wrote to memory of 1248	2720	cmd.exe	92
PID 2720 wrote to memory of 1248	2720	cmd.exe	92
PID 2720 wrote to memory of 1248	2720	cmd.exe	92
PID 2428 wrote to memory of 440	2428	466037c5c19ff0b34797fca5d4e3a78c.exe	96
PID 2428 wrote to memory of 440	2428	466037c5c19ff0b34797fca5d4e3a78c.exe	96
PID 2428 wrote to memory of 440	2428	466037c5c19ff0b34797fca5d4e3a78c.exe	96
PID 2428 wrote to memory of 3124	2428	466037c5c19ff0b34797fca5d4e3a78c.exe	98
PID 2428 wrote to memory of 3124	2428	466037c5c19ff0b34797fca5d4e3a78c.exe	98
PID 2428 wrote to memory of 3124	2428	466037c5c19ff0b34797fca5d4e3a78c.exe	98
PID 3124 wrote to memory of 1288	3124	iyuv_32.exe	99
PID 3124 wrote to memory of 1288	3124	iyuv_32.exe	99
PID 3124 wrote to memory of 1288	3124	iyuv_32.exe	99
PID 1288 wrote to memory of 4644	1288	cmd.exe	102
PID 1288 wrote to memory of 4644	1288	cmd.exe	102
PID 1288 wrote to memory of 4644	1288	cmd.exe	102
PID 1288 wrote to memory of 4760	1288	cmd.exe	101
PID 1288 wrote to memory of 4760	1288	cmd.exe	101
PID 1288 wrote to memory of 4760	1288	cmd.exe	101
PID 3124 wrote to memory of 624	3124	iyuv_32.exe	103
PID 3124 wrote to memory of 624	3124	iyuv_32.exe	103
PID 3124 wrote to memory of 624	3124	iyuv_32.exe	103
PID 624 wrote to memory of 1368	624	iyuv_32.exe	104
PID 624 wrote to memory of 1368	624	iyuv_32.exe	104
PID 624 wrote to memory of 1368	624	iyuv_32.exe	104
PID 1368 wrote to memory of 4092	1368	cmd.exe	106
PID 1368 wrote to memory of 4092	1368	cmd.exe	106
PID 1368 wrote to memory of 4092	1368	cmd.exe	106
PID 1368 wrote to memory of 1424	1368	cmd.exe	107
PID 1368 wrote to memory of 1424	1368	cmd.exe	107
PID 1368 wrote to memory of 1424	1368	cmd.exe	107
PID 624 wrote to memory of 1756	624	iyuv_32.exe	108
PID 624 wrote to memory of 1756	624	iyuv_32.exe	108
PID 624 wrote to memory of 1756	624	iyuv_32.exe	108
PID 1756 wrote to memory of 548	1756	iyuv_32.exe	109
PID 1756 wrote to memory of 548	1756	iyuv_32.exe	109
PID 1756 wrote to memory of 548	1756	iyuv_32.exe	109
PID 548 wrote to memory of 1192	548	cmd.exe	111
PID 548 wrote to memory of 1192	548	cmd.exe	111
PID 548 wrote to memory of 1192	548	cmd.exe	111
PID 548 wrote to memory of 1224	548	cmd.exe	112
PID 548 wrote to memory of 1224	548	cmd.exe	112
PID 548 wrote to memory of 1224	548	cmd.exe	112
PID 1756 wrote to memory of 4848	1756	iyuv_32.exe	116
PID 1756 wrote to memory of 4848	1756	iyuv_32.exe	116
PID 1756 wrote to memory of 4848	1756	iyuv_32.exe	116
PID 4848 wrote to memory of 2552	4848	iyuv_32.exe	117
PID 4848 wrote to memory of 2552	4848	iyuv_32.exe	117
PID 4848 wrote to memory of 2552	4848	iyuv_32.exe	117
PID 2552 wrote to memory of 3368	2552	cmd.exe	119
PID 2552 wrote to memory of 3368	2552	cmd.exe	119
PID 2552 wrote to memory of 3368	2552	cmd.exe	119
PID 2552 wrote to memory of 1448	2552	cmd.exe	121
PID 2552 wrote to memory of 1448	2552	cmd.exe	121
PID 2552 wrote to memory of 1448	2552	cmd.exe	121
PID 4848 wrote to memory of 2688	4848	iyuv_32.exe	122
PID 4848 wrote to memory of 2688	4848	iyuv_32.exe	122
PID 4848 wrote to memory of 2688	4848	iyuv_32.exe	122
PID 2688 wrote to memory of 2296	2688	iyuv_32.exe	124

C:\Users\Admin\AppData\Local\Temp\466037c5c19ff0b34797fca5d4e3a78c.exe
"C:\Users\Admin\AppData\Local\Temp\466037c5c19ff0b34797fca5d4e3a78c.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_deleteme.bat
  2⤵
  PID:440
- C:\Windows\SysWOW64\iyuv_32.exe
  C:\Windows\system32\iyuv_32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
      4⤵
      PID:4760
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
      4⤵
      Modifies Installed Components in the registry
      PID:4644
- - C:\Windows\SysWOW64\iyuv_32.exe
    C:\Windows\system32\iyuv_32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1368
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        5⤵
        Modifies Installed Components in the registry
        
        PID:4092
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        5⤵
        
        PID:1424
  - - C:\Windows\SysWOW64\iyuv_32.exe
      C:\Windows\system32\iyuv_32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:548
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        6⤵
        Modifies Installed Components in the registry
        
        PID:1192
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        6⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        7⤵
        
        PID:4892
    - - C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4848
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        7⤵
        Modifies Installed Components in the registry
        
        PID:3368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        7⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        8⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        8⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        7⤵
        
        PID:4928
      - C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        7⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        8⤵
        Modifies Installed Components in the registry
        
        PID:3044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        8⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        8⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        9⤵
        Modifies Installed Components in the registry
        
        PID:4604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        10⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        11⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        11⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        10⤵
        Modifies Installed Components in the registry
        
        PID:2200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        9⤵
        
        PID:3024
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        11⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        11⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        9⤵
        
        PID:800
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3576
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2776
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        13⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        14⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        14⤵
        Modifies Installed Components in the registry
        
        PID:5048
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        14⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        15⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        14⤵
        
        PID:380
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3620
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        15⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        16⤵
        
        PID:800
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        17⤵
        Modifies Installed Components in the registry
        
        PID:3468
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        17⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        17⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        16⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        17⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        18⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        19⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        18⤵
        
        PID:448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        19⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        19⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2700
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        18⤵
        
        PID:968
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2752
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2672
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2076
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:564
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        23⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        24⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3408
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        26⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        27⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        28⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        29⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        30⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        31⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        32⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        33⤵
        
        PID:628
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        34⤵
        
        PID:632
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        35⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        36⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        37⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        38⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        39⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        40⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        41⤵
        
        PID:400
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        42⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        43⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        44⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        45⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        46⤵
        
        PID:800
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        47⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        48⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        49⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        50⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        51⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        52⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        53⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        54⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        55⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        56⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        57⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        57⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        58⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        59⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        60⤵
        
        PID:848
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        61⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        62⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        63⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        64⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        65⤵
        Modifies Installed Components in the registry
        
        PID:1224
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        66⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        67⤵
        Modifies Installed Components in the registry
        
        PID:4476
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        68⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        69⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        70⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        71⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        72⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        73⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        74⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        75⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        76⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        77⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        78⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        78⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        77⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        78⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        79⤵
        
        PID:112
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        80⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        81⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        82⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        82⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        83⤵
        
        PID:408
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        83⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        81⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        82⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        83⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        84⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        85⤵
        
        PID:452
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        86⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        87⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        88⤵
        Modifies Installed Components in the registry
        
        PID:3960
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        89⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        90⤵
        
        PID:796
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        91⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        91⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        90⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        91⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        92⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        93⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        94⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        95⤵
        
        PID:800
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        96⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        97⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        98⤵
        
        PID:400
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        99⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        100⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        101⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\iyuv_32.exe
        
        C:\Windows\system32\iyuv_32.exe
        102⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        85⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        84⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        55⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        53⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        53⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        48⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        47⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        44⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        44⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        45⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        45⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        42⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        33⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        29⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        28⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        29⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        16⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        15⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        15⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        16⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
        17⤵
        
        PID:3000

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:1248

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Modifies Installed Components in the registry
PID:4904

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:3636

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Modifies Installed Components in the registry
PID:3864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:1708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:3344
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
    3⤵
    PID:1252
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  - Modifies Installed Components in the registry
  PID:2712

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:1368

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Modifies Installed Components in the registry
PID:2880

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4780

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:1584

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Modifies Installed Components in the registry
PID:4728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4604

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Modifies Installed Components in the registry
PID:1932
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:4336
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:2348

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:1912

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:3340

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:4224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:3552

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4012
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:2056
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
    3⤵
    PID:3936

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Modifies Installed Components in the registry
PID:3504

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2776
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:1292
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  - Modifies Installed Components in the registry
  PID:552
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:4496
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:4552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
    3⤵
    PID:368

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:3656

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:1224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:868
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:2832
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:2756

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
    3⤵
    PID:380

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Modifies Installed Components in the registry
PID:4364

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4472

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:3312

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Modifies Installed Components in the registry
PID:2744

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:1912
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:3636
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:4708

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:2508
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
    3⤵
    PID:2840

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:5092

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:2296

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:1156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:796

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4012

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1292

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:3292

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2408
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:5044
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:4476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
    3⤵
    PID:3848
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:4016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
    3⤵
    PID:4872
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
      4⤵
      PID:2832
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        5⤵
        
        PID:3648
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:3148

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4012

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:3320

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2756

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:5012
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:2080
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:4868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2196
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:3288
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:3052

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4660

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:3936

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:1992
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:2056
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:3124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
- Modifies Installed Components in the registry
PID:448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:3708

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:1224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:5012

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2228

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Modifies Installed Components in the registry
PID:2820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:1028

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2084

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:3428

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2360

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2640

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2908

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:468

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:4396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4856
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:740
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:3352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4296
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:3428
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:2360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:3024
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  - Modifies Installed Components in the registry
  PID:5116
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
    3⤵
    PID:3088

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5092

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2640

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2908

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:3128

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:4744

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4396
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:4472
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:4552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:1992
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:376
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
    3⤵
    PID:2776
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:924

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:868

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:1612

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4344

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:4024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4016

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4772

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4396
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:2884
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:4136

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2056

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:3124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4428
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:4716
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:4944

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:464

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Modifies Installed Components in the registry
PID:4224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2408
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:2508
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:1436

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:3088

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:4600

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2348

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:3396
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
  2⤵
  PID:2380
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
  2⤵
  PID:4860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2980

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2056

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4852

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2408

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:1256

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:5020

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:3396

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4688

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:3360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
- Modifies Installed Components in the registry
PID:2584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:1828

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2152

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:4404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:4692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:1448

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2080

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4508

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:3996

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:1612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2436

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4740

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:1248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:3108

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  PID:2104
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
    3⤵
    PID:4596
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
    3⤵
    PID:4496

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:4060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:376

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2404

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:1372

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:1224

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:1324

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4908

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4428

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:1968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:1420

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2116

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2968

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:5040

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:3052

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:4640

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2840

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:3352

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:4964

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4380

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:4456

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:2436

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:3996

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3004

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:3396

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4920

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:2184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:4368

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:1308

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:3276

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:976

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:1956

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /f
1⤵
PID:4056

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K108855D-B9JB-SW07-B3HV-J060BMM4BE92}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\iyuv_32.exe /i" /f
1⤵
PID:940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
557722e684fa69e90815bbcca4e6dd07

SHA1
67274c9f8eb0422225b83a78de5af7d1925aa537

SHA256
e906dca9d6364a8072daecc213c3a28cedcd9516707f6c32c0a49d4e1793ea85

SHA512
21b65c2194bf64e92b1bc4976a2cfd40e8479faae7a416f4f7cf1e845fc0e2c6e30dcb2a66ad24c8ae9b848714522b788b1045ff9083da7e4d8d0372fa519d2e

Download Submit
C:\Windows\SysWOW64\_deleteme.bat

Filesize
184B

MD5
5af335d8fb2d4acd9bf7f1e9018f312c

SHA1
f48d880c147f4cc8ea0279b7e2163f2cbffd0b12

SHA256
6127fa215b2089656ce416603796393a1151a7e50dfd639343e3443150b48cee

SHA512
b2a537f674b70b0bfa11e926871dc6d80959f5f820802f1af1b7184e32f0d67899c9c411b80cf6630a8b9a822043b3078e79bf46cb7c74b0a55f8e6ccbe8574b

Download Submit
C:\Windows\SysWOW64\c_l6505.nls

Filesize
978B

MD5
55cc3bed6ea0c0a9ce48fcf1a6cd4784

SHA1
08f6dc2ede80799146691e28020031174f157bce

SHA256
75a80386bdcdce73b0131625e226957104b2dbe5ed48fde8d8fddf80ce81b319

SHA512
cb1008d4e73ec5c8bf2de2ada1fc2173f3b424de1645ed891462cbeb044252789173b9497e844937ae52110b12e4a22b730b6cd8055b8cf6ce5085560ec63c82

Download Submit
C:\Windows\SysWOW64\iyuv_32.exe

Filesize
92KB

MD5
37a986bbe6bc497e8285dff665c71d88

SHA1
09147eedb798512e49161203d028ae9cd552e918

SHA256
2b0d54f58c2d47454b22e7435cf91e36bf60dd5d7827c7982da4a9217f7436e4

SHA512
b7dc8474fa038fe2c873784a56d478859e9b3acabeaad52fffa7732b284314f0e94451bf0412012e71b948dea0591bc1319455f1f651afb24d6cb93756223418

Download Submit
C:\Windows\SysWOW64\iyuv_32.exe

Filesize
143KB

MD5
466037c5c19ff0b34797fca5d4e3a78c

SHA1
956c917846c4d073b736dc5d9fe394f9f2d525f5

SHA256
73e8803e31fe0751b5ac3402a49ec56c17ed6c30fcd77c5640a76abb8a1f2c9f

SHA512
8ab40ef3f95b23d229119e25d495f27e7055420975eeb3fb242babf7ba414f20faea3790764a8affa5bdbd495b343f6f8015b280bfaba0905010724822ccb305

Download Submit
memory/400-192-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/564-118-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/624-23-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/628-168-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/632-171-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/800-207-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/848-249-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/968-98-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1156-189-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1224-63-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1248-222-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1288-153-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1308-210-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1308-255-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1436-177-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1672-180-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1752-83-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1756-28-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/1788-128-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2076-113-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2084-162-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2196-198-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2252-213-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2296-183-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2428-10-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2552-138-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2672-108-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2688-38-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2700-93-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2704-201-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2752-103-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2776-60-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2792-43-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2824-68-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2840-123-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2844-219-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2972-234-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2976-252-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2980-225-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/2980-148-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3004-143-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3004-186-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3052-78-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3124-18-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3292-237-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3352-174-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3408-133-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3576-53-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3620-73-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3652-216-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3864-243-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3888-258-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3888-231-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/3940-48-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/4404-246-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/4464-261-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/4496-228-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/4572-204-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/4592-195-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/4600-165-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/4848-33-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/4936-240-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/4972-158-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download
memory/5116-88-0x0000000000010000-0x000000000003B000-memory.dmp

Filesize
172KB

Download