Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 02:53
Static task
static1
Behavioral task
behavioral1
Sample
bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe
Resource
win10v2004-20240508-en
General
-
Target
bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe
-
Size
202KB
-
MD5
83212286efbe470d44ef30291a7c88f3
-
SHA1
16add5720310f81d19b4f497b623213994235231
-
SHA256
bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a
-
SHA512
f8335b3ee45034583215148579477d6598591ba528ae698dcc11470d6469d4f93d7caceaf7585ecfc861b8f93437b74764b1fd34183344d08119007a8f0f8d57
-
SSDEEP
3072:ALNN8Z/1brq96vFlVQxOwCmDgL25WVqFLDMVLWzDNJJeAXF:BZ9a96tz/56sVeLDMVLGZJJj
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation xkAoMIoI.exe -
Executes dropped EXE 2 IoCs
pid Process 408 xkAoMIoI.exe 3320 PkccEIMs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PkccEIMs.exe = "C:\\ProgramData\\OwUgIQYk\\PkccEIMs.exe" PkccEIMs.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xkAoMIoI.exe = "C:\\Users\\Admin\\vigoEIwM\\xkAoMIoI.exe" bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PkccEIMs.exe = "C:\\ProgramData\\OwUgIQYk\\PkccEIMs.exe" bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xkAoMIoI.exe = "C:\\Users\\Admin\\vigoEIwM\\xkAoMIoI.exe" xkAoMIoI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 1172 reg.exe 4332 reg.exe 3624 reg.exe 2720 reg.exe 3140 reg.exe 4936 reg.exe 684 reg.exe 864 reg.exe 3808 reg.exe 4380 reg.exe 1508 reg.exe 4968 reg.exe 4028 reg.exe 1128 reg.exe 3140 reg.exe 2732 reg.exe 3556 reg.exe 1664 reg.exe 1128 reg.exe 4588 reg.exe 3676 Process not Found 3256 Process not Found 1268 reg.exe 4484 reg.exe 2004 reg.exe 3444 reg.exe 2448 reg.exe 1128 reg.exe 3444 reg.exe 116 reg.exe 4484 reg.exe 4268 reg.exe 1776 reg.exe 5096 reg.exe 1524 reg.exe 3872 reg.exe 5044 Process not Found 544 Process not Found 1392 reg.exe 1392 reg.exe 2612 reg.exe 836 reg.exe 4100 Process not Found 4512 reg.exe 4152 reg.exe 4432 reg.exe 3068 Process not Found 1952 Process not Found 1544 reg.exe 4652 reg.exe 3668 reg.exe 3508 reg.exe 3660 reg.exe 3628 Process not Found 1544 reg.exe 1560 reg.exe 1776 reg.exe 3228 reg.exe 2612 reg.exe 4192 reg.exe 376 reg.exe 3292 reg.exe 1392 Process not Found 1676 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2948 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2948 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2948 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2948 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2084 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2084 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2084 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2084 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3092 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3092 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3092 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3092 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1352 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1352 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1352 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1352 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2712 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2712 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2712 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2712 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 644 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 644 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 644 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 644 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 5044 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 5044 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 5044 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 5044 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1760 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1760 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1760 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1760 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3648 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3648 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3648 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3648 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1676 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1676 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1676 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1676 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1304 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1304 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1304 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 1304 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3848 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3848 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3848 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 3848 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2924 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2924 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2924 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 2924 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 408 xkAoMIoI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe 408 xkAoMIoI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 408 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 89 PID 4584 wrote to memory of 408 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 89 PID 4584 wrote to memory of 408 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 89 PID 4584 wrote to memory of 3320 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 91 PID 4584 wrote to memory of 3320 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 91 PID 4584 wrote to memory of 3320 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 91 PID 4584 wrote to memory of 3188 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 92 PID 4584 wrote to memory of 3188 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 92 PID 4584 wrote to memory of 3188 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 92 PID 4584 wrote to memory of 404 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 94 PID 4584 wrote to memory of 404 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 94 PID 4584 wrote to memory of 404 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 94 PID 4584 wrote to memory of 2928 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 95 PID 4584 wrote to memory of 2928 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 95 PID 4584 wrote to memory of 2928 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 95 PID 4584 wrote to memory of 1468 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 96 PID 4584 wrote to memory of 1468 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 96 PID 4584 wrote to memory of 1468 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 96 PID 4584 wrote to memory of 2792 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 97 PID 4584 wrote to memory of 2792 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 97 PID 4584 wrote to memory of 2792 4584 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 97 PID 3188 wrote to memory of 4100 3188 cmd.exe 102 PID 3188 wrote to memory of 4100 3188 cmd.exe 102 PID 3188 wrote to memory of 4100 3188 cmd.exe 102 PID 2792 wrote to memory of 468 2792 cmd.exe 103 PID 2792 wrote to memory of 468 2792 cmd.exe 103 PID 2792 wrote to memory of 468 2792 cmd.exe 103 PID 4100 wrote to memory of 3732 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 105 PID 4100 wrote to memory of 3732 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 105 PID 4100 wrote to memory of 3732 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 105 PID 3732 wrote to memory of 116 3732 cmd.exe 107 PID 3732 wrote to memory of 116 3732 cmd.exe 107 PID 3732 wrote to memory of 116 3732 cmd.exe 107 PID 4100 wrote to memory of 4816 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 108 PID 4100 wrote to memory of 4816 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 108 PID 4100 wrote to memory of 4816 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 108 PID 4100 wrote to memory of 4064 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 109 PID 4100 wrote to memory of 4064 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 109 PID 4100 wrote to memory of 4064 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 109 PID 4100 wrote to memory of 5068 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 110 PID 4100 wrote to memory of 5068 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 110 PID 4100 wrote to memory of 5068 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 110 PID 4100 wrote to memory of 4520 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 111 PID 4100 wrote to memory of 4520 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 111 PID 4100 wrote to memory of 4520 4100 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 111 PID 4520 wrote to memory of 4008 4520 cmd.exe 116 PID 4520 wrote to memory of 4008 4520 cmd.exe 116 PID 4520 wrote to memory of 4008 4520 cmd.exe 116 PID 116 wrote to memory of 1792 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 118 PID 116 wrote to memory of 1792 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 118 PID 116 wrote to memory of 1792 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 118 PID 1792 wrote to memory of 2948 1792 cmd.exe 120 PID 1792 wrote to memory of 2948 1792 cmd.exe 120 PID 1792 wrote to memory of 2948 1792 cmd.exe 120 PID 116 wrote to memory of 4268 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 121 PID 116 wrote to memory of 4268 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 121 PID 116 wrote to memory of 4268 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 121 PID 116 wrote to memory of 4264 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 122 PID 116 wrote to memory of 4264 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 122 PID 116 wrote to memory of 4264 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 122 PID 116 wrote to memory of 4996 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 123 PID 116 wrote to memory of 4996 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 123 PID 116 wrote to memory of 4996 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 123 PID 116 wrote to memory of 3064 116 bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe"C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\vigoEIwM\xkAoMIoI.exe"C:\Users\Admin\vigoEIwM\xkAoMIoI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:408
-
-
C:\ProgramData\OwUgIQYk\PkccEIMs.exe"C:\ProgramData\OwUgIQYk\PkccEIMs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3320
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"2⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"4⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"6⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"8⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"10⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a11⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"12⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"14⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"16⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a17⤵
- Suspicious behavior: EnumeratesProcesses
PID:644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"18⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a19⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"20⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"22⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"24⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"26⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"28⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a29⤵
- Suspicious behavior: EnumeratesProcesses
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"30⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"32⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a33⤵PID:4968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"34⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a35⤵PID:3760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"36⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a37⤵PID:4532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"38⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a39⤵PID:888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"40⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a41⤵PID:3212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"42⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a43⤵PID:4028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"44⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a45⤵PID:2368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"46⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a47⤵PID:4652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"48⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a49⤵PID:4524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"50⤵PID:1656
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵PID:3052
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a51⤵PID:4308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"52⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a53⤵PID:3172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"54⤵PID:1128
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵PID:388
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a55⤵PID:4580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"56⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a57⤵PID:4400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"58⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a59⤵PID:3808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"60⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a61⤵PID:4344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"62⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a63⤵PID:3048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"64⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a65⤵PID:2976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"66⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a67⤵PID:1864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"68⤵PID:3172
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a69⤵PID:4492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"70⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a71⤵PID:432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"72⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a73⤵PID:3680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"74⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a75⤵PID:3456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"76⤵PID:2004
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵PID:4804
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a77⤵PID:2180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"78⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a79⤵PID:2096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"80⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a81⤵PID:3408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"82⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a83⤵PID:3732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"84⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a85⤵PID:2036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"86⤵PID:4640
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a87⤵PID:1036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"88⤵PID:5000
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:3872
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a89⤵PID:4056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"90⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a91⤵PID:4200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"92⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a93⤵PID:3564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"94⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a95⤵PID:3692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"96⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a97⤵PID:3040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"98⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a99⤵PID:1800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"100⤵PID:4484
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a101⤵PID:3680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"102⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a103⤵PID:416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"104⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a105⤵PID:1668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"106⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a107⤵PID:2448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"108⤵PID:4804
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:3564
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a109⤵PID:2216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"110⤵PID:5068
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a111⤵PID:2096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"112⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a113⤵PID:2744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"114⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a115⤵PID:4464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"116⤵PID:4640
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:3808
-
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a117⤵PID:3052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"118⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a119⤵PID:4752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"120⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a.exeC:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a121⤵PID:2744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bd2ade6ebc661038dad404c6c5e8fcdb47d34d651d0e8b642cc5cc2daa1bf39a"122⤵PID:2184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-