Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe
Resource
win10v2004-20240226-en
General
-
Target
3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe
-
Size
111KB
-
MD5
ef019e8914bd613e0f4839e5b7c848d1
-
SHA1
cbe8bbf68529c05f1c6e719ac472f2c066e10038
-
SHA256
3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e
-
SHA512
0caea7168b1a22ed31a007e5992d33a7ed6bccbef0ba2745e462c98b9faefef74458d84a5716789deca4e87b8fd8271134a4af76cfed956d2c3c32044b15073e
-
SSDEEP
1536:TYDrUowZUcK/rNfK8vtlTsYJjzZ9LCKJqByJx3RDPiMrVvsa1TrWzoX+KcqpHPXr:EkycMiotJTJDLRdJxLpWzoX9pHD1oX
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (83) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation uWoQEYok.exe -
Executes dropped EXE 2 IoCs
pid Process 3324 MKQgQcUM.exe 2912 uWoQEYok.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MKQgQcUM.exe = "C:\\Users\\Admin\\xksEcwIU\\MKQgQcUM.exe" 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uWoQEYok.exe = "C:\\ProgramData\\hOUcYIwQ\\uWoQEYok.exe" 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MKQgQcUM.exe = "C:\\Users\\Admin\\xksEcwIU\\MKQgQcUM.exe" MKQgQcUM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uWoQEYok.exe = "C:\\ProgramData\\hOUcYIwQ\\uWoQEYok.exe" uWoQEYok.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pskoUskk.exe = "C:\\Users\\Admin\\uKMQUQso\\pskoUskk.exe" 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hqMUEYEw.exe = "C:\\ProgramData\\PuEIoIcQ\\hqMUEYEw.exe" 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe uWoQEYok.exe File created C:\Windows\SysWOW64\shell32.dll.exe uWoQEYok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3304 932 WerFault.exe 122 2748 964 WerFault.exe 124 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 4032 reg.exe 5752 reg.exe 3412 reg.exe 5812 reg.exe 4388 Process not Found 216 reg.exe 6120 reg.exe 3304 reg.exe 5220 reg.exe 5432 reg.exe 5152 reg.exe 5852 reg.exe 3408 reg.exe 3972 reg.exe 5836 reg.exe 1580 reg.exe 3404 reg.exe 2772 reg.exe 5252 reg.exe 3040 reg.exe 5640 reg.exe 3836 reg.exe 2248 reg.exe 464 reg.exe 6092 reg.exe 5252 reg.exe 5676 reg.exe 5092 reg.exe 5848 reg.exe 3548 reg.exe 3604 reg.exe 2828 reg.exe 5272 reg.exe 2744 reg.exe 2276 reg.exe 5532 Process not Found 2972 reg.exe 3676 reg.exe 244 reg.exe 5700 reg.exe 5636 Process not Found 4616 reg.exe 5676 reg.exe 3276 reg.exe 2304 reg.exe 5960 reg.exe 2248 reg.exe 3676 reg.exe 5312 Process not Found 876 reg.exe 884 reg.exe 5840 reg.exe 3764 reg.exe 6036 reg.exe 5268 reg.exe 4836 reg.exe 4888 reg.exe 1776 reg.exe 5180 reg.exe 964 reg.exe 5720 reg.exe 4416 reg.exe 5332 reg.exe 3888 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1172 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1172 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1172 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1172 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 3400 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 3400 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 3400 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 3400 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 3600 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 3600 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 3600 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 3600 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1956 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1956 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1956 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1956 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2276 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2276 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2276 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2276 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2852 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2852 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2852 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2852 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1804 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1804 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1804 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1804 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1624 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1624 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1624 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1624 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2848 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2848 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2848 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2848 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1668 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1668 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1668 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1668 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1756 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1756 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1756 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1756 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1520 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1520 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1520 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 1520 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2248 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2248 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2248 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 2248 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2912 uWoQEYok.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe 2912 uWoQEYok.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 640 wrote to memory of 3324 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 94 PID 640 wrote to memory of 3324 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 94 PID 640 wrote to memory of 3324 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 94 PID 640 wrote to memory of 2912 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 95 PID 640 wrote to memory of 2912 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 95 PID 640 wrote to memory of 2912 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 95 PID 640 wrote to memory of 3036 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 96 PID 640 wrote to memory of 3036 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 96 PID 640 wrote to memory of 3036 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 96 PID 640 wrote to memory of 1756 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 98 PID 640 wrote to memory of 1756 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 98 PID 640 wrote to memory of 1756 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 98 PID 640 wrote to memory of 3588 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 99 PID 640 wrote to memory of 3588 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 99 PID 640 wrote to memory of 3588 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 99 PID 640 wrote to memory of 4504 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 100 PID 640 wrote to memory of 4504 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 100 PID 640 wrote to memory of 4504 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 100 PID 640 wrote to memory of 924 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 101 PID 640 wrote to memory of 924 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 101 PID 640 wrote to memory of 924 640 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 101 PID 3036 wrote to memory of 2212 3036 cmd.exe 106 PID 3036 wrote to memory of 2212 3036 cmd.exe 106 PID 3036 wrote to memory of 2212 3036 cmd.exe 106 PID 924 wrote to memory of 3116 924 cmd.exe 107 PID 924 wrote to memory of 3116 924 cmd.exe 107 PID 924 wrote to memory of 3116 924 cmd.exe 107 PID 2212 wrote to memory of 1808 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 109 PID 2212 wrote to memory of 1808 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 109 PID 2212 wrote to memory of 1808 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 109 PID 2212 wrote to memory of 3888 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 111 PID 2212 wrote to memory of 3888 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 111 PID 2212 wrote to memory of 3888 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 111 PID 2212 wrote to memory of 2248 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 112 PID 2212 wrote to memory of 2248 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 112 PID 2212 wrote to memory of 2248 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 112 PID 2212 wrote to memory of 1336 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 113 PID 2212 wrote to memory of 1336 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 113 PID 2212 wrote to memory of 1336 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 113 PID 2212 wrote to memory of 1596 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 114 PID 2212 wrote to memory of 1596 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 114 PID 2212 wrote to memory of 1596 2212 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 114 PID 1808 wrote to memory of 3064 1808 cmd.exe 119 PID 1808 wrote to memory of 3064 1808 cmd.exe 119 PID 1808 wrote to memory of 3064 1808 cmd.exe 119 PID 1596 wrote to memory of 4452 1596 cmd.exe 120 PID 1596 wrote to memory of 4452 1596 cmd.exe 120 PID 1596 wrote to memory of 4452 1596 cmd.exe 120 PID 1612 wrote to memory of 4432 1612 cmd.exe 165 PID 1612 wrote to memory of 4432 1612 cmd.exe 165 PID 1612 wrote to memory of 4432 1612 cmd.exe 165 PID 4608 wrote to memory of 2276 4608 cmd.exe 191 PID 4608 wrote to memory of 2276 4608 cmd.exe 191 PID 4608 wrote to memory of 2276 4608 cmd.exe 191 PID 4432 wrote to memory of 3004 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 186 PID 4432 wrote to memory of 3004 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 186 PID 4432 wrote to memory of 3004 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 186 PID 3004 wrote to memory of 1172 3004 cmd.exe 143 PID 3004 wrote to memory of 1172 3004 cmd.exe 143 PID 3004 wrote to memory of 1172 3004 cmd.exe 143 PID 4432 wrote to memory of 2036 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 144 PID 4432 wrote to memory of 2036 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 144 PID 4432 wrote to memory of 2036 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 144 PID 4432 wrote to memory of 1604 4432 3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe 145
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe"C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\xksEcwIU\MKQgQcUM.exe"C:\Users\Admin\xksEcwIU\MKQgQcUM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3324
-
-
C:\ProgramData\hOUcYIwQ\uWoQEYok.exe"C:\ProgramData\hOUcYIwQ\uWoQEYok.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"2⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"4⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e5⤵
- Adds Run key to start application
PID:3064 -
C:\Users\Admin\uKMQUQso\pskoUskk.exe"C:\Users\Admin\uKMQUQso\pskoUskk.exe"6⤵PID:932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 2247⤵
- Program crash
PID:3304
-
-
-
C:\ProgramData\PuEIoIcQ\hqMUEYEw.exe"C:\ProgramData\PuEIoIcQ\hqMUEYEw.exe"6⤵PID:964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2247⤵
- Program crash
PID:2748
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"6⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"8⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"10⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e11⤵
- Suspicious behavior: EnumeratesProcesses
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"12⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"14⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"16⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"18⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"20⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"22⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"24⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"26⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"28⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"30⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"32⤵PID:408
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"34⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e35⤵PID:4856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"36⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e37⤵PID:856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"38⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e39⤵PID:3004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"40⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e41⤵PID:1968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"42⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e43⤵PID:1772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"44⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e45⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"46⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e47⤵PID:4600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"48⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e49⤵PID:744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"50⤵PID:3836
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵PID:3240
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e51⤵PID:3096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"52⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e53⤵PID:3676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"54⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e55⤵PID:408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"56⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e57⤵PID:3304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"58⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e59⤵PID:3116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"60⤵PID:4912
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e61⤵PID:5064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"62⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e63⤵PID:4476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"64⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e65⤵PID:3528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"66⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e67⤵PID:2492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"68⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e69⤵PID:1272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"70⤵PID:1680
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e71⤵PID:3400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"72⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e73⤵PID:3604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"74⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e75⤵PID:2772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"76⤵PID:4040
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e77⤵PID:2492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"78⤵PID:4656
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵PID:1772
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e79⤵PID:1416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"80⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e81⤵PID:5212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"82⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e83⤵PID:5516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"84⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e85⤵PID:5808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"86⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e87⤵PID:216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"88⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e89⤵PID:5308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"90⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e91⤵PID:5616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"92⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e93⤵PID:6084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"94⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e95⤵PID:5416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"96⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e97⤵PID:3548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"98⤵PID:5792
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:3004
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e99⤵PID:5972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"100⤵PID:5268
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:5404
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e101⤵PID:5056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"102⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e103⤵PID:5644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"104⤵PID:5524
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:5928
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e105⤵PID:5560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"106⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e107⤵PID:5516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"108⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e109⤵PID:5720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"110⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e111⤵PID:5780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"112⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e113⤵PID:5528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"114⤵PID:5124
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:1416
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e115⤵PID:980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"116⤵PID:5360
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:4628
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e117⤵PID:3496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"118⤵PID:5276
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:5608
-
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e119⤵PID:5440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"120⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e.exeC:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e121⤵PID:6140
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3aebcdd50b20739ee3298a4401641da74c6e00bfb0eaf84c93f9e4e9e5e8fc3e"122⤵PID:2064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-