de3158d3c422bfa23f087e8b74ee1dd6809c3016b04c8d4232fd1ccba2390e02

Analysis

max time kernel
34s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ExitLag.bylilmoon.exe
Size

28KB
MD5

6b61a9ffe1dc6b0ea8ee38206a81b97a
SHA1

269bdc249efd8f82ada9761805ce81676fc3ebc7
SHA256

de3158d3c422bfa23f087e8b74ee1dd6809c3016b04c8d4232fd1ccba2390e02
SHA512

a6824bab3847a90c3553b3fa7a231d0f952f63778dca7c12ec764825c32adf20c569526d7feeb2bc4c6b508c788e41221250776d9d33826e7079c1a3477b1911
SSDEEP

384:lPOQktXi0HiONHHsqbX7FKJ2uLnTV0iWTtURgV8Dpu8fjjJcJ0KLQbH6u0WTvEas:x8LsqcDRbsV8DpzCJ0hbj0WAn

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe
1728	ExitLag.bylilmoon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2228	1728	ExitLag.bylilmoon.exe	29
PID 1728 wrote to memory of 2228	1728	ExitLag.bylilmoon.exe	29
PID 1728 wrote to memory of 2228	1728	ExitLag.bylilmoon.exe	29
PID 1728 wrote to memory of 2228	1728	ExitLag.bylilmoon.exe	29
PID 1728 wrote to memory of 2416	1728	ExitLag.bylilmoon.exe	30
PID 1728 wrote to memory of 2416	1728	ExitLag.bylilmoon.exe	30
PID 1728 wrote to memory of 2416	1728	ExitLag.bylilmoon.exe	30
PID 1728 wrote to memory of 2416	1728	ExitLag.bylilmoon.exe	30
PID 2416 wrote to memory of 1760	2416	cmd.exe	31
PID 2416 wrote to memory of 1760	2416	cmd.exe	31
PID 2416 wrote to memory of 1760	2416	cmd.exe	31
PID 2416 wrote to memory of 1760	2416	cmd.exe	31
PID 1728 wrote to memory of 2012	1728	ExitLag.bylilmoon.exe	32
PID 1728 wrote to memory of 2012	1728	ExitLag.bylilmoon.exe	32
PID 1728 wrote to memory of 2012	1728	ExitLag.bylilmoon.exe	32
PID 1728 wrote to memory of 2012	1728	ExitLag.bylilmoon.exe	32
PID 1728 wrote to memory of 2432	1728	ExitLag.bylilmoon.exe	33
PID 1728 wrote to memory of 2432	1728	ExitLag.bylilmoon.exe	33
PID 1728 wrote to memory of 2432	1728	ExitLag.bylilmoon.exe	33
PID 1728 wrote to memory of 2432	1728	ExitLag.bylilmoon.exe	33
PID 2432 wrote to memory of 2916	2432	cmd.exe	34
PID 2432 wrote to memory of 2916	2432	cmd.exe	34
PID 2432 wrote to memory of 2916	2432	cmd.exe	34
PID 2432 wrote to memory of 2916	2432	cmd.exe	34
PID 1728 wrote to memory of 2772	1728	ExitLag.bylilmoon.exe	35
PID 1728 wrote to memory of 2772	1728	ExitLag.bylilmoon.exe	35
PID 1728 wrote to memory of 2772	1728	ExitLag.bylilmoon.exe	35
PID 1728 wrote to memory of 2772	1728	ExitLag.bylilmoon.exe	35
PID 1728 wrote to memory of 1244	1728	ExitLag.bylilmoon.exe	36
PID 1728 wrote to memory of 1244	1728	ExitLag.bylilmoon.exe	36
PID 1728 wrote to memory of 1244	1728	ExitLag.bylilmoon.exe	36
PID 1728 wrote to memory of 1244	1728	ExitLag.bylilmoon.exe	36
PID 1244 wrote to memory of 2136	1244	cmd.exe	37
PID 1244 wrote to memory of 2136	1244	cmd.exe	37
PID 1244 wrote to memory of 2136	1244	cmd.exe	37
PID 1244 wrote to memory of 2136	1244	cmd.exe	37
PID 1728 wrote to memory of 1300	1728	ExitLag.bylilmoon.exe	38
PID 1728 wrote to memory of 1300	1728	ExitLag.bylilmoon.exe	38
PID 1728 wrote to memory of 1300	1728	ExitLag.bylilmoon.exe	38
PID 1728 wrote to memory of 1300	1728	ExitLag.bylilmoon.exe	38
PID 1728 wrote to memory of 2736	1728	ExitLag.bylilmoon.exe	39
PID 1728 wrote to memory of 2736	1728	ExitLag.bylilmoon.exe	39
PID 1728 wrote to memory of 2736	1728	ExitLag.bylilmoon.exe	39
PID 1728 wrote to memory of 2736	1728	ExitLag.bylilmoon.exe	39
PID 2736 wrote to memory of 2648	2736	cmd.exe	40
PID 2736 wrote to memory of 2648	2736	cmd.exe	40
PID 2736 wrote to memory of 2648	2736	cmd.exe	40
PID 2736 wrote to memory of 2648	2736	cmd.exe	40
PID 1728 wrote to memory of 2600	1728	ExitLag.bylilmoon.exe	41
PID 1728 wrote to memory of 2600	1728	ExitLag.bylilmoon.exe	41
PID 1728 wrote to memory of 2600	1728	ExitLag.bylilmoon.exe	41
PID 1728 wrote to memory of 2600	1728	ExitLag.bylilmoon.exe	41
PID 1728 wrote to memory of 2616	1728	ExitLag.bylilmoon.exe	42
PID 1728 wrote to memory of 2616	1728	ExitLag.bylilmoon.exe	42
PID 1728 wrote to memory of 2616	1728	ExitLag.bylilmoon.exe	42
PID 1728 wrote to memory of 2616	1728	ExitLag.bylilmoon.exe	42
PID 2616 wrote to memory of 2756	2616	cmd.exe	43
PID 2616 wrote to memory of 2756	2616	cmd.exe	43
PID 2616 wrote to memory of 2756	2616	cmd.exe	43
PID 2616 wrote to memory of 2756	2616	cmd.exe	43
PID 1728 wrote to memory of 2624	1728	ExitLag.bylilmoon.exe	44
PID 1728 wrote to memory of 2624	1728	ExitLag.bylilmoon.exe	44
PID 1728 wrote to memory of 2624	1728	ExitLag.bylilmoon.exe	44
PID 1728 wrote to memory of 2624	1728	ExitLag.bylilmoon.exe	44

C:\Users\Admin\AppData\Local\Temp\ExitLag.bylilmoon.exe
"C:\Users\Admin\AppData\Local\Temp\ExitLag.bylilmoon.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2500
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2784
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2604
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2488
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2836
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2364
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1124
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2992
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2740
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:880
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1344
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1964
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:3032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2472
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:676
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:452
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:308
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1488
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1860
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1864
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:788
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2312
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1988
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1328
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:988
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:908
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1184
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2928
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2020
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1416
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:1732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE con cols=100 lines=10
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\mode.com
    MODE con cols=100 lines=10
    3⤵
    PID:2164

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads