Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 23:30
Static task
static1
Behavioral task
behavioral1
Sample
fffa4c215f0dd3181e3e6f721880c1c0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fffa4c215f0dd3181e3e6f721880c1c0.exe
Resource
win10v2004-20231215-en
General
-
Target
fffa4c215f0dd3181e3e6f721880c1c0.exe
-
Size
484KB
-
MD5
fffa4c215f0dd3181e3e6f721880c1c0
-
SHA1
620e3af2ab5d95e851c677fae094a45e341fef91
-
SHA256
8fce5a28b41f6df9e20d6b99367be1c0066847c8ea784ba295cc5a31e04dff57
-
SHA512
2173d0136a5288538588818f900e779430875ef39c802d18b42000ffd417aef055d28713d8259185e8c21d0720247a88c7e8e8b91a837bdb9418aecb944c3736
-
SSDEEP
12288:ogczz3vNC1G7ddxMm6GY21RBvsub93qCDd:ogcPNcG5MmLzsubNqi
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 58 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" backgroundTaskHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation nIQksMwA.exe -
Executes dropped EXE 3 IoCs
pid Process 3616 CSUIMgwU.exe 3420 nIQksMwA.exe 2380 aaUAEkoo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SYYsQsQQ.exe = "C:\\Users\\Admin\\ruQUYswA\\SYYsQsQQ.exe" fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JmwwwMMQ.exe = "C:\\ProgramData\\VWUIAMIg\\JmwwwMMQ.exe" fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CSUIMgwU.exe = "C:\\Users\\Admin\\WgcMQsQQ\\CSUIMgwU.exe" fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nIQksMwA.exe = "C:\\ProgramData\\lsIQcsMQ\\nIQksMwA.exe" fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CSUIMgwU.exe = "C:\\Users\\Admin\\WgcMQsQQ\\CSUIMgwU.exe" CSUIMgwU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nIQksMwA.exe = "C:\\ProgramData\\lsIQcsMQ\\nIQksMwA.exe" nIQksMwA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nIQksMwA.exe = "C:\\ProgramData\\lsIQcsMQ\\nIQksMwA.exe" aaUAEkoo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fffa4c215f0dd3181e3e6f721880c1c0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\WgcMQsQQ aaUAEkoo.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\WgcMQsQQ\CSUIMgwU aaUAEkoo.exe File created C:\Windows\SysWOW64\shell32.dll.exe nIQksMwA.exe File opened for modification C:\Windows\SysWOW64\sheExpandPing.mpg nIQksMwA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 1124 4088 WerFault.exe 395 2412 3688 WerFault.exe 396 3672 3172 WerFault.exe 397 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 3544 reg.exe 3268 reg.exe 2692 reg.exe 5048 reg.exe 3028 reg.exe 4300 reg.exe 380 reg.exe 4872 reg.exe 1364 reg.exe 3480 reg.exe 2948 reg.exe 3040 reg.exe 4344 reg.exe 4272 reg.exe 4964 reg.exe 4544 reg.exe 4964 reg.exe 3156 reg.exe 724 reg.exe 1308 reg.exe 3324 reg.exe 4924 reg.exe 3168 reg.exe 4796 reg.exe 4280 reg.exe 4008 reg.exe 4372 reg.exe 4696 reg.exe 3684 reg.exe 1188 reg.exe 2088 reg.exe 1352 reg.exe 4864 reg.exe 3196 reg.exe 384 reg.exe 2368 reg.exe 2980 reg.exe 4976 reg.exe 1804 reg.exe 3324 reg.exe 3580 reg.exe 1916 reg.exe 5068 reg.exe 3308 reg.exe 2624 reg.exe 4724 reg.exe 560 reg.exe 2060 reg.exe 2292 reg.exe 1908 reg.exe 2344 reg.exe 2876 reg.exe 2756 reg.exe 1976 reg.exe 2004 reg.exe 628 reg.exe 2328 reg.exe 60 reg.exe 2748 reg.exe 724 reg.exe 3080 reg.exe 2888 reg.exe 4936 reg.exe 4452 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 1800 fffa4c215f0dd3181e3e6f721880c1c0.exe 1800 fffa4c215f0dd3181e3e6f721880c1c0.exe 1800 fffa4c215f0dd3181e3e6f721880c1c0.exe 1800 fffa4c215f0dd3181e3e6f721880c1c0.exe 776 fffa4c215f0dd3181e3e6f721880c1c0.exe 776 fffa4c215f0dd3181e3e6f721880c1c0.exe 776 fffa4c215f0dd3181e3e6f721880c1c0.exe 776 fffa4c215f0dd3181e3e6f721880c1c0.exe 1664 fffa4c215f0dd3181e3e6f721880c1c0.exe 1664 fffa4c215f0dd3181e3e6f721880c1c0.exe 1664 fffa4c215f0dd3181e3e6f721880c1c0.exe 1664 fffa4c215f0dd3181e3e6f721880c1c0.exe 3332 fffa4c215f0dd3181e3e6f721880c1c0.exe 3332 fffa4c215f0dd3181e3e6f721880c1c0.exe 3332 fffa4c215f0dd3181e3e6f721880c1c0.exe 3332 fffa4c215f0dd3181e3e6f721880c1c0.exe 4964 fffa4c215f0dd3181e3e6f721880c1c0.exe 4964 fffa4c215f0dd3181e3e6f721880c1c0.exe 4964 fffa4c215f0dd3181e3e6f721880c1c0.exe 4964 fffa4c215f0dd3181e3e6f721880c1c0.exe 4692 fffa4c215f0dd3181e3e6f721880c1c0.exe 4692 fffa4c215f0dd3181e3e6f721880c1c0.exe 4692 fffa4c215f0dd3181e3e6f721880c1c0.exe 4692 fffa4c215f0dd3181e3e6f721880c1c0.exe 4888 fffa4c215f0dd3181e3e6f721880c1c0.exe 4888 fffa4c215f0dd3181e3e6f721880c1c0.exe 4888 fffa4c215f0dd3181e3e6f721880c1c0.exe 4888 fffa4c215f0dd3181e3e6f721880c1c0.exe 3648 fffa4c215f0dd3181e3e6f721880c1c0.exe 3648 fffa4c215f0dd3181e3e6f721880c1c0.exe 3648 fffa4c215f0dd3181e3e6f721880c1c0.exe 3648 fffa4c215f0dd3181e3e6f721880c1c0.exe 3784 fffa4c215f0dd3181e3e6f721880c1c0.exe 3784 fffa4c215f0dd3181e3e6f721880c1c0.exe 3784 fffa4c215f0dd3181e3e6f721880c1c0.exe 3784 fffa4c215f0dd3181e3e6f721880c1c0.exe 2348 cmd.exe 2348 cmd.exe 2348 cmd.exe 2348 cmd.exe 4372 fffa4c215f0dd3181e3e6f721880c1c0.exe 4372 fffa4c215f0dd3181e3e6f721880c1c0.exe 4372 fffa4c215f0dd3181e3e6f721880c1c0.exe 4372 fffa4c215f0dd3181e3e6f721880c1c0.exe 4088 fffa4c215f0dd3181e3e6f721880c1c0.exe 4088 fffa4c215f0dd3181e3e6f721880c1c0.exe 4088 fffa4c215f0dd3181e3e6f721880c1c0.exe 4088 fffa4c215f0dd3181e3e6f721880c1c0.exe 1824 fffa4c215f0dd3181e3e6f721880c1c0.exe 1824 fffa4c215f0dd3181e3e6f721880c1c0.exe 1824 fffa4c215f0dd3181e3e6f721880c1c0.exe 1824 fffa4c215f0dd3181e3e6f721880c1c0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3420 nIQksMwA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe 3420 nIQksMwA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 3616 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 90 PID 2880 wrote to memory of 3616 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 90 PID 2880 wrote to memory of 3616 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 90 PID 2880 wrote to memory of 3420 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 91 PID 2880 wrote to memory of 3420 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 91 PID 2880 wrote to memory of 3420 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 91 PID 2880 wrote to memory of 1628 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 94 PID 2880 wrote to memory of 1628 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 94 PID 2880 wrote to memory of 1628 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 94 PID 2880 wrote to memory of 2060 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 96 PID 2880 wrote to memory of 2060 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 96 PID 2880 wrote to memory of 2060 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 96 PID 2880 wrote to memory of 628 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 97 PID 2880 wrote to memory of 628 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 97 PID 2880 wrote to memory of 628 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 97 PID 1628 wrote to memory of 4004 1628 cmd.exe 98 PID 1628 wrote to memory of 4004 1628 cmd.exe 98 PID 1628 wrote to memory of 4004 1628 cmd.exe 98 PID 2880 wrote to memory of 3836 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 99 PID 2880 wrote to memory of 3836 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 99 PID 2880 wrote to memory of 3836 2880 fffa4c215f0dd3181e3e6f721880c1c0.exe 99 PID 4004 wrote to memory of 1328 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 103 PID 4004 wrote to memory of 1328 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 103 PID 4004 wrote to memory of 1328 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 103 PID 4004 wrote to memory of 60 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 105 PID 4004 wrote to memory of 60 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 105 PID 4004 wrote to memory of 60 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 105 PID 4004 wrote to memory of 1188 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 106 PID 4004 wrote to memory of 1188 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 106 PID 4004 wrote to memory of 1188 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 106 PID 4004 wrote to memory of 2328 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 107 PID 4004 wrote to memory of 2328 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 107 PID 4004 wrote to memory of 2328 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 107 PID 1328 wrote to memory of 1244 1328 cmd.exe 111 PID 1328 wrote to memory of 1244 1328 cmd.exe 111 PID 1328 wrote to memory of 1244 1328 cmd.exe 111 PID 4004 wrote to memory of 2212 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 112 PID 4004 wrote to memory of 2212 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 112 PID 4004 wrote to memory of 2212 4004 fffa4c215f0dd3181e3e6f721880c1c0.exe 112 PID 1244 wrote to memory of 3600 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 114 PID 1244 wrote to memory of 3600 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 114 PID 1244 wrote to memory of 3600 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 114 PID 1244 wrote to memory of 2292 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 116 PID 1244 wrote to memory of 2292 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 116 PID 1244 wrote to memory of 2292 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 116 PID 1244 wrote to memory of 3544 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 117 PID 1244 wrote to memory of 3544 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 117 PID 1244 wrote to memory of 3544 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 117 PID 1244 wrote to memory of 1396 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 118 PID 1244 wrote to memory of 1396 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 118 PID 1244 wrote to memory of 1396 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 118 PID 1244 wrote to memory of 2248 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 119 PID 1244 wrote to memory of 2248 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 119 PID 1244 wrote to memory of 2248 1244 fffa4c215f0dd3181e3e6f721880c1c0.exe 119 PID 2212 wrote to memory of 3172 2212 cmd.exe 124 PID 2212 wrote to memory of 3172 2212 cmd.exe 124 PID 2212 wrote to memory of 3172 2212 cmd.exe 124 PID 3600 wrote to memory of 1800 3600 cmd.exe 125 PID 3600 wrote to memory of 1800 3600 cmd.exe 125 PID 3600 wrote to memory of 1800 3600 cmd.exe 125 PID 2248 wrote to memory of 4256 2248 cmd.exe 126 PID 2248 wrote to memory of 4256 2248 cmd.exe 126 PID 2248 wrote to memory of 4256 2248 cmd.exe 126 PID 1800 wrote to memory of 4724 1800 fffa4c215f0dd3181e3e6f721880c1c0.exe 127 -
System policy modification 1 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fffa4c215f0dd3181e3e6f721880c1c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fffa4c215f0dd3181e3e6f721880c1c0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exe"C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\WgcMQsQQ\CSUIMgwU.exe"C:\Users\Admin\WgcMQsQQ\CSUIMgwU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3616
-
-
C:\ProgramData\lsIQcsMQ\nIQksMwA.exe"C:\ProgramData\lsIQcsMQ\nIQksMwA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3420
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c03⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"4⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c05⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"6⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c07⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"8⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c09⤵
- Suspicious behavior: EnumeratesProcesses
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"10⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c011⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"12⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c013⤵
- Suspicious behavior: EnumeratesProcesses
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"14⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c015⤵
- Suspicious behavior: EnumeratesProcesses
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"16⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c017⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"18⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c019⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"20⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c021⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"22⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c023⤵
- Suspicious behavior: EnumeratesProcesses
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"24⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c025⤵PID:2348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"26⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c027⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"28⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c029⤵
- Suspicious behavior: EnumeratesProcesses
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"30⤵
- Modifies visibility of file extensions in Explorer
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c031⤵
- Suspicious behavior: EnumeratesProcesses
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"32⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c033⤵PID:5080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"34⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c035⤵PID:3836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"36⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c037⤵PID:560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"38⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c039⤵PID:2276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"40⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c041⤵PID:4148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"42⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c043⤵PID:2508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"44⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c045⤵PID:4484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"46⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c047⤵
- Modifies visibility of file extensions in Explorer
PID:60 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"48⤵
- Modifies visibility of file extensions in Explorer
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c049⤵PID:3672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"50⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c051⤵
- Adds Run key to start application
PID:4580 -
C:\Users\Admin\ruQUYswA\SYYsQsQQ.exe"C:\Users\Admin\ruQUYswA\SYYsQsQQ.exe"52⤵PID:4088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 32853⤵
- Program crash
PID:1124
-
-
-
C:\ProgramData\VWUIAMIg\JmwwwMMQ.exe"C:\ProgramData\VWUIAMIg\JmwwwMMQ.exe"52⤵PID:3688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 22453⤵
- Program crash
PID:2412
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"52⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c053⤵PID:5020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"54⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c055⤵PID:1048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"56⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c057⤵PID:1516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"58⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c059⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"60⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c061⤵PID:4052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"62⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c063⤵PID:4016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"64⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c065⤵PID:4028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"66⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c067⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"68⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c069⤵PID:3164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"70⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c071⤵PID:4924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"72⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c073⤵PID:3332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"74⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c075⤵PID:3028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"76⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c077⤵PID:1808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"78⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c079⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"80⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c081⤵PID:3232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"82⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c083⤵PID:2692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"84⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c085⤵PID:3480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"86⤵PID:668
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:3048
-
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c087⤵PID:1188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"88⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c089⤵PID:216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"90⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c091⤵PID:1100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"92⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c093⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"94⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c095⤵PID:2748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"96⤵
- Modifies visibility of file extensions in Explorer
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c097⤵PID:2960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"98⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c099⤵PID:4628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"100⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0101⤵PID:4052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"102⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0103⤵
- Modifies visibility of file extensions in Explorer
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"104⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0105⤵PID:3364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"106⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0107⤵PID:1628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"108⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0109⤵PID:1680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"110⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0111⤵PID:4412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"112⤵PID:4000
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
- UAC bypass
PID:2888
-
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0113⤵PID:2360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"114⤵PID:4248
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:4708
-
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0115⤵PID:2444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"116⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0117⤵PID:2608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"118⤵PID:3004
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
- Modifies visibility of file extensions in Explorer
PID:3528
-
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0119⤵PID:3688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"120⤵
- Modifies visibility of file extensions in Explorer
PID:2004 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:4628
-
-
C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0.exeC:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0121⤵
- Modifies visibility of file extensions in Explorer
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fffa4c215f0dd3181e3e6f721880c1c0"122⤵PID:3048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-