Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe
Resource
win10v2004-20240508-en
General
-
Target
156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe
-
Size
205KB
-
MD5
718aa9360c9b9167fba74e98a4269156
-
SHA1
ff2e1027a12c8be2b4efccf03e4bc1bbb934330f
-
SHA256
156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60
-
SHA512
44f636a161ad26935c878d6d86368f361c8c21088339f80430e9dcdeca8eb71c345509dfe97e388b954c93369a25940fe7e0814595ebd84ac98482f322c995ad
-
SSDEEP
6144:IQa17oXxiEh/yJghcs8wmlWwBTy1n71+KlKbMyC5Blp3kKyHSO32xwArJikpkVOZ:I7eBhh/yJghcs8wmlWwBTy1n71+KlKbA
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\International\Geo\Nation pagkEMoc.exe -
Executes dropped EXE 2 IoCs
pid Process 1256 pagkEMoc.exe 1964 JSIYcoYA.exe -
Loads dropped DLL 20 IoCs
pid Process 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JSIYcoYA.exe = "C:\\ProgramData\\iIEcUIUU\\JSIYcoYA.exe" JSIYcoYA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\pagkEMoc.exe = "C:\\Users\\Admin\\eCQcYYcc\\pagkEMoc.exe" 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JSIYcoYA.exe = "C:\\ProgramData\\iIEcUIUU\\JSIYcoYA.exe" 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\pagkEMoc.exe = "C:\\Users\\Admin\\eCQcYYcc\\pagkEMoc.exe" pagkEMoc.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico pagkEMoc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2596 reg.exe 2784 reg.exe 2848 reg.exe 2920 reg.exe 1600 reg.exe 2432 reg.exe 2636 reg.exe 1736 reg.exe 3008 reg.exe 956 reg.exe 2552 reg.exe 2092 reg.exe 2348 reg.exe 1532 reg.exe 2552 reg.exe 1452 reg.exe 1800 reg.exe 1436 reg.exe 2648 reg.exe 1716 reg.exe 1436 reg.exe 2760 reg.exe 2924 reg.exe 2180 reg.exe 2688 reg.exe 3056 reg.exe 2648 reg.exe 2224 reg.exe 2676 reg.exe 1548 reg.exe 2324 reg.exe 552 reg.exe 2344 reg.exe 2508 reg.exe 2208 reg.exe 2860 reg.exe 2164 reg.exe 340 reg.exe 644 reg.exe 2648 reg.exe 2496 reg.exe 1556 reg.exe 2456 reg.exe 752 reg.exe 1756 reg.exe 2344 reg.exe 2780 reg.exe 2824 reg.exe 2212 reg.exe 1508 reg.exe 980 reg.exe 976 reg.exe 2484 reg.exe 876 reg.exe 1768 reg.exe 1920 reg.exe 2668 reg.exe 2700 reg.exe 1708 reg.exe 1892 reg.exe 1312 reg.exe 2236 reg.exe 1520 reg.exe 2256 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1008 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1008 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1272 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1272 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1172 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1172 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1304 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1304 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1180 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1180 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2628 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2628 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 468 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 468 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2476 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2476 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 952 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 952 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1312 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1312 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1304 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1304 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 572 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 572 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1556 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1556 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 328 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 328 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 484 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 484 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2196 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2196 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2712 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2712 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2720 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2720 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2796 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2796 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1608 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1608 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 828 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 828 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 320 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 320 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2600 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2600 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 908 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 908 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2796 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2796 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1656 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1656 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2004 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2004 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1908 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1908 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1304 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1304 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1256 pagkEMoc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe 1256 pagkEMoc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1256 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 28 PID 1920 wrote to memory of 1256 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 28 PID 1920 wrote to memory of 1256 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 28 PID 1920 wrote to memory of 1256 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 28 PID 1920 wrote to memory of 1964 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 29 PID 1920 wrote to memory of 1964 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 29 PID 1920 wrote to memory of 1964 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 29 PID 1920 wrote to memory of 1964 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 29 PID 1920 wrote to memory of 2640 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 30 PID 1920 wrote to memory of 2640 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 30 PID 1920 wrote to memory of 2640 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 30 PID 1920 wrote to memory of 2640 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 30 PID 2640 wrote to memory of 2704 2640 cmd.exe 32 PID 2640 wrote to memory of 2704 2640 cmd.exe 32 PID 2640 wrote to memory of 2704 2640 cmd.exe 32 PID 2640 wrote to memory of 2704 2640 cmd.exe 32 PID 1920 wrote to memory of 2688 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 33 PID 1920 wrote to memory of 2688 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 33 PID 1920 wrote to memory of 2688 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 33 PID 1920 wrote to memory of 2688 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 33 PID 1920 wrote to memory of 2648 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 34 PID 1920 wrote to memory of 2648 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 34 PID 1920 wrote to memory of 2648 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 34 PID 1920 wrote to memory of 2648 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 34 PID 1920 wrote to memory of 2616 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 35 PID 1920 wrote to memory of 2616 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 35 PID 1920 wrote to memory of 2616 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 35 PID 1920 wrote to memory of 2616 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 35 PID 1920 wrote to memory of 2524 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 38 PID 1920 wrote to memory of 2524 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 38 PID 1920 wrote to memory of 2524 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 38 PID 1920 wrote to memory of 2524 1920 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 38 PID 2524 wrote to memory of 2492 2524 cmd.exe 41 PID 2524 wrote to memory of 2492 2524 cmd.exe 41 PID 2524 wrote to memory of 2492 2524 cmd.exe 41 PID 2524 wrote to memory of 2492 2524 cmd.exe 41 PID 2704 wrote to memory of 1692 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 42 PID 2704 wrote to memory of 1692 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 42 PID 2704 wrote to memory of 1692 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 42 PID 2704 wrote to memory of 1692 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 42 PID 1692 wrote to memory of 1008 1692 cmd.exe 44 PID 1692 wrote to memory of 1008 1692 cmd.exe 44 PID 1692 wrote to memory of 1008 1692 cmd.exe 44 PID 1692 wrote to memory of 1008 1692 cmd.exe 44 PID 2704 wrote to memory of 940 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 45 PID 2704 wrote to memory of 940 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 45 PID 2704 wrote to memory of 940 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 45 PID 2704 wrote to memory of 940 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 45 PID 2704 wrote to memory of 1452 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 46 PID 2704 wrote to memory of 1452 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 46 PID 2704 wrote to memory of 1452 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 46 PID 2704 wrote to memory of 1452 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 46 PID 2704 wrote to memory of 1572 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 47 PID 2704 wrote to memory of 1572 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 47 PID 2704 wrote to memory of 1572 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 47 PID 2704 wrote to memory of 1572 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 47 PID 2704 wrote to memory of 748 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 48 PID 2704 wrote to memory of 748 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 48 PID 2704 wrote to memory of 748 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 48 PID 2704 wrote to memory of 748 2704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 48 PID 748 wrote to memory of 2136 748 cmd.exe 53 PID 748 wrote to memory of 2136 748 cmd.exe 53 PID 748 wrote to memory of 2136 748 cmd.exe 53 PID 748 wrote to memory of 2136 748 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe"C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\eCQcYYcc\pagkEMoc.exe"C:\Users\Admin\eCQcYYcc\pagkEMoc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1256
-
-
C:\ProgramData\iIEcUIUU\JSIYcoYA.exe"C:\ProgramData\iIEcUIUU\JSIYcoYA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1964
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"2⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab603⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"4⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab605⤵
- Suspicious behavior: EnumeratesProcesses
PID:1008 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"6⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab607⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"8⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab609⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"10⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6011⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"12⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6013⤵
- Suspicious behavior: EnumeratesProcesses
PID:1180 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"14⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6015⤵
- Suspicious behavior: EnumeratesProcesses
PID:2628 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"16⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6017⤵
- Suspicious behavior: EnumeratesProcesses
PID:468 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"18⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6019⤵
- Suspicious behavior: EnumeratesProcesses
PID:2476 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"20⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6021⤵
- Suspicious behavior: EnumeratesProcesses
PID:952 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"22⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6023⤵
- Suspicious behavior: EnumeratesProcesses
PID:1312 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"24⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6025⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"26⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6027⤵
- Suspicious behavior: EnumeratesProcesses
PID:572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"28⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6029⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"30⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6031⤵
- Suspicious behavior: EnumeratesProcesses
PID:328 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"32⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6033⤵
- Suspicious behavior: EnumeratesProcesses
PID:484 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"34⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6035⤵
- Suspicious behavior: EnumeratesProcesses
PID:2196 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"36⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6037⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"38⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6039⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"40⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6041⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"42⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6043⤵
- Suspicious behavior: EnumeratesProcesses
PID:1608 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"44⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6045⤵
- Suspicious behavior: EnumeratesProcesses
PID:828 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"46⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6047⤵
- Suspicious behavior: EnumeratesProcesses
PID:320 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"48⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6049⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"50⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6051⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"52⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6053⤵
- Suspicious behavior: EnumeratesProcesses
PID:908 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"54⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6055⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"56⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6057⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"58⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6059⤵
- Suspicious behavior: EnumeratesProcesses
PID:2004 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"60⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6061⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"62⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6063⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"64⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6065⤵PID:2144
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"66⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6067⤵PID:2248
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"68⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6069⤵PID:1524
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"70⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6071⤵PID:1628
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"72⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6073⤵PID:688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"74⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6075⤵PID:2688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"76⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6077⤵PID:1936
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"78⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6079⤵PID:2180
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"80⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6081⤵PID:1232
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"82⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6083⤵PID:1272
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"84⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6085⤵PID:3008
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"86⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6087⤵PID:864
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"88⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6089⤵PID:2952
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"90⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6091⤵PID:2224
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"92⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6093⤵PID:2652
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"94⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6095⤵PID:2172
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"96⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6097⤵PID:2232
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"98⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6099⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"100⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60101⤵PID:1180
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"102⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60103⤵PID:1008
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"104⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60105⤵PID:1096
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"106⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60107⤵PID:2400
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"108⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60109⤵PID:2960
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"110⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60111⤵PID:2996
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"112⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60113⤵PID:2076
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"114⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60115⤵PID:1548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"116⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60117⤵PID:3068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"118⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60119⤵PID:860
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"120⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60121⤵PID:2844
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-