Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 02:53
Static task
static1
Behavioral task
behavioral1
Sample
bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe
Resource
win10v2004-20240508-en
General
-
Target
bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe
-
Size
202KB
-
MD5
83212286efbe470d44ef30291a7c88f3
-
SHA1
16add5720310f81d19b4f497b623213994235231
-
SHA256
bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a
-
SHA512
f8335b3ee45034583215148579477d6598591ba528ae698dcc11470d6469d4f93d7caceaf7585ecfc861b8f93437b74764b1fd34183344d08119007a8f0f8d57
-
SSDEEP
3072:ALNN8Z/1brq96vFlVQxOwCmDgL25WVqFLDMVLWzDNJJeAXF:BZ9a96tz/56sVeLDMVLGZJJj
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (65) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\International\Geo\Nation JAEcQAEg.exe -
Executes dropped EXE 2 IoCs
pid Process 2220 cwQAAkQE.exe 2828 JAEcQAEg.exe -
Loads dropped DLL 20 IoCs
pid Process 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe 2220 cwQAAkQE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwQAAkQE.exe = "C:\\Users\\Admin\\EukAAUsg\\cwQAAkQE.exe" bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JAEcQAEg.exe = "C:\\ProgramData\\SAIEwAIM\\JAEcQAEg.exe" bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwQAAkQE.exe = "C:\\Users\\Admin\\EukAAUsg\\cwQAAkQE.exe" cwQAAkQE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JAEcQAEg.exe = "C:\\ProgramData\\SAIEwAIM\\JAEcQAEg.exe" JAEcQAEg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeccggYc.exe = "C:\\Users\\Admin\\gKIMcsIA\\qeccggYc.exe" bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lmcQkcww.exe = "C:\\ProgramData\\WaIoUkEM\\lmcQkcww.exe" bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2384 2636 WerFault.exe 678 2624 2768 WerFault.exe 680 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2968 reg.exe 1556 reg.exe 1772 reg.exe 2696 reg.exe 1976 reg.exe 2976 reg.exe 2360 reg.exe 760 reg.exe 1304 reg.exe 1072 reg.exe 2004 reg.exe 1800 reg.exe 2308 reg.exe 1348 reg.exe 2536 reg.exe 2968 reg.exe 1452 reg.exe 1592 reg.exe 2700 reg.exe 1516 reg.exe 556 reg.exe 2104 reg.exe 2664 reg.exe 1684 reg.exe 2104 reg.exe 2288 reg.exe 1648 reg.exe 1520 reg.exe 2136 reg.exe 568 reg.exe 2980 reg.exe 2976 reg.exe 2756 reg.exe 2064 reg.exe 1948 reg.exe 1988 reg.exe 304 reg.exe 2688 reg.exe 304 reg.exe 976 reg.exe 1332 reg.exe 1996 reg.exe 1756 reg.exe 1768 reg.exe 944 reg.exe 2464 reg.exe 2036 reg.exe 2512 reg.exe 2600 reg.exe 1976 reg.exe 1592 reg.exe 2128 reg.exe 692 reg.exe 2620 reg.exe 1288 reg.exe 768 reg.exe 1352 reg.exe 2016 reg.exe 692 reg.exe 2104 reg.exe 2468 reg.exe 3004 reg.exe 2692 reg.exe 2864 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2864 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2864 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2456 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2456 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 644 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 644 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1348 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1348 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1756 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1756 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2780 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2780 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2620 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2620 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1652 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1652 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2144 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2144 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 752 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 752 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1576 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1576 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1760 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1760 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2780 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2780 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2620 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2620 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1600 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1600 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2440 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2440 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2276 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2276 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1712 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1712 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2000 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2000 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2780 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2780 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2848 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2848 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1128 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1128 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2932 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2932 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2808 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2808 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2648 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2648 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 760 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 760 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2756 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2756 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1556 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1556 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2148 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2148 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2080 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2080 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2828 JAEcQAEg.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe 2828 JAEcQAEg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2220 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 28 PID 2416 wrote to memory of 2220 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 28 PID 2416 wrote to memory of 2220 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 28 PID 2416 wrote to memory of 2220 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 28 PID 2416 wrote to memory of 2828 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 29 PID 2416 wrote to memory of 2828 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 29 PID 2416 wrote to memory of 2828 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 29 PID 2416 wrote to memory of 2828 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 29 PID 2416 wrote to memory of 2728 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 30 PID 2416 wrote to memory of 2728 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 30 PID 2416 wrote to memory of 2728 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 30 PID 2416 wrote to memory of 2728 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 30 PID 2728 wrote to memory of 2668 2728 cmd.exe 33 PID 2728 wrote to memory of 2668 2728 cmd.exe 33 PID 2728 wrote to memory of 2668 2728 cmd.exe 33 PID 2728 wrote to memory of 2668 2728 cmd.exe 33 PID 2416 wrote to memory of 2712 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 32 PID 2416 wrote to memory of 2712 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 32 PID 2416 wrote to memory of 2712 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 32 PID 2416 wrote to memory of 2712 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 32 PID 2416 wrote to memory of 2672 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 34 PID 2416 wrote to memory of 2672 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 34 PID 2416 wrote to memory of 2672 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 34 PID 2416 wrote to memory of 2672 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 34 PID 2416 wrote to memory of 2548 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 36 PID 2416 wrote to memory of 2548 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 36 PID 2416 wrote to memory of 2548 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 36 PID 2416 wrote to memory of 2548 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 36 PID 2416 wrote to memory of 2648 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 38 PID 2416 wrote to memory of 2648 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 38 PID 2416 wrote to memory of 2648 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 38 PID 2416 wrote to memory of 2648 2416 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 38 PID 2648 wrote to memory of 2576 2648 cmd.exe 41 PID 2648 wrote to memory of 2576 2648 cmd.exe 41 PID 2648 wrote to memory of 2576 2648 cmd.exe 41 PID 2648 wrote to memory of 2576 2648 cmd.exe 41 PID 2668 wrote to memory of 2832 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 42 PID 2668 wrote to memory of 2832 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 42 PID 2668 wrote to memory of 2832 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 42 PID 2668 wrote to memory of 2832 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 42 PID 2832 wrote to memory of 2864 2832 cmd.exe 44 PID 2832 wrote to memory of 2864 2832 cmd.exe 44 PID 2832 wrote to memory of 2864 2832 cmd.exe 44 PID 2832 wrote to memory of 2864 2832 cmd.exe 44 PID 2668 wrote to memory of 3004 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 45 PID 2668 wrote to memory of 3004 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 45 PID 2668 wrote to memory of 3004 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 45 PID 2668 wrote to memory of 3004 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 45 PID 2668 wrote to memory of 3020 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 46 PID 2668 wrote to memory of 3020 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 46 PID 2668 wrote to memory of 3020 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 46 PID 2668 wrote to memory of 3020 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 46 PID 2668 wrote to memory of 2968 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 49 PID 2668 wrote to memory of 2968 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 49 PID 2668 wrote to memory of 2968 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 49 PID 2668 wrote to memory of 2968 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 49 PID 2668 wrote to memory of 2552 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 51 PID 2668 wrote to memory of 2552 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 51 PID 2668 wrote to memory of 2552 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 51 PID 2668 wrote to memory of 2552 2668 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 51 PID 2552 wrote to memory of 1684 2552 cmd.exe 53 PID 2552 wrote to memory of 1684 2552 cmd.exe 53 PID 2552 wrote to memory of 1684 2552 cmd.exe 53 PID 2552 wrote to memory of 1684 2552 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe"C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\EukAAUsg\cwQAAkQE.exe"C:\Users\Admin\EukAAUsg\cwQAAkQE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2220
-
-
C:\ProgramData\SAIEwAIM\JAEcQAEg.exe"C:\ProgramData\SAIEwAIM\JAEcQAEg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2828
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"2⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"4⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"6⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2456 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"8⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a9⤵
- Suspicious behavior: EnumeratesProcesses
PID:644 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"10⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"12⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"14⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"16⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"18⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"20⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2144 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"22⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a23⤵
- Suspicious behavior: EnumeratesProcesses
PID:752 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"24⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"26⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"28⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"30⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"32⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"34⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a35⤵
- Suspicious behavior: EnumeratesProcesses
PID:2440 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"36⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"38⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a39⤵
- Suspicious behavior: EnumeratesProcesses
PID:1712 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"40⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"42⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a43⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"44⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"46⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1128 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"48⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2932 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"50⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"52⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2648 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"54⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a55⤵
- Suspicious behavior: EnumeratesProcesses
PID:760 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"56⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a57⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"58⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a59⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"60⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2148 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"62⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2080 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"64⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a65⤵PID:1760
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"66⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a67⤵PID:2704
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"68⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a69⤵PID:1436
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"70⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a71⤵PID:344
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"72⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a73⤵PID:1604
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"74⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a75⤵PID:2928
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"76⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a77⤵PID:2632
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"78⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a79⤵PID:2976
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"80⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a81⤵PID:2836
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"82⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a83⤵PID:2744
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"84⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a85⤵PID:2288
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"86⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a87⤵PID:2008
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"88⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a89⤵PID:1348
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"90⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a91⤵PID:2868
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"92⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a93⤵PID:2584
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"94⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a95⤵PID:2648
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"96⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a97⤵PID:2856
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"98⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a99⤵PID:1584
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"100⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a101⤵PID:1156
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"102⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a103⤵PID:2992
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"104⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a105⤵PID:2888
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"106⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a107⤵PID:2024
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"108⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a109⤵
- Adds Run key to start application
PID:1992 -
C:\Users\Admin\gKIMcsIA\qeccggYc.exe"C:\Users\Admin\gKIMcsIA\qeccggYc.exe"110⤵PID:2636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 36111⤵
- Program crash
PID:2384
-
-
-
C:\ProgramData\WaIoUkEM\lmcQkcww.exe"C:\ProgramData\WaIoUkEM\lmcQkcww.exe"110⤵PID:2768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 36111⤵
- Program crash
PID:2624
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"110⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a111⤵PID:532
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"112⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a113⤵PID:444
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"114⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a115⤵PID:1816
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"116⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a117⤵PID:1380
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"118⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a119⤵PID:1876
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"120⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a121⤵PID:2764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"122⤵PID:1248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-