Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe
Resource
win10v2004-20240508-en
General
-
Target
156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe
-
Size
205KB
-
MD5
718aa9360c9b9167fba74e98a4269156
-
SHA1
ff2e1027a12c8be2b4efccf03e4bc1bbb934330f
-
SHA256
156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60
-
SHA512
44f636a161ad26935c878d6d86368f361c8c21088339f80430e9dcdeca8eb71c345509dfe97e388b954c93369a25940fe7e0814595ebd84ac98482f322c995ad
-
SSDEEP
6144:IQa17oXxiEh/yJghcs8wmlWwBTy1n71+KlKbMyC5Blp3kKyHSO32xwArJikpkVOZ:I7eBhh/yJghcs8wmlWwBTy1n71+KlKbA
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (74) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation pococoIE.exe -
Executes dropped EXE 2 IoCs
pid Process 3400 pococoIE.exe 744 BeIIUIwE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pococoIE.exe = "C:\\Users\\Admin\\eeIkUIoE\\pococoIE.exe" 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BeIIUIwE.exe = "C:\\ProgramData\\CIUQoQsg\\BeIIUIwE.exe" 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pococoIE.exe = "C:\\Users\\Admin\\eeIkUIoE\\pococoIE.exe" pococoIE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BeIIUIwE.exe = "C:\\ProgramData\\CIUQoQsg\\BeIIUIwE.exe" BeIIUIwE.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IiEgkQIM.exe = "C:\\Users\\Admin\\JkAAAEwU\\IiEgkQIM.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SUEAAIsM.exe = "C:\\ProgramData\\lAoMQcsw\\SUEAAIsM.exe" Process not Found -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe pococoIE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2504 1448 Process not Found 1866 2072 3288 Process not Found 1867 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 1692 reg.exe 400 Process not Found 3112 reg.exe 5072 reg.exe 4980 reg.exe 4972 reg.exe 4064 reg.exe 4748 reg.exe 3344 reg.exe 632 reg.exe 2216 reg.exe 1368 reg.exe 4412 reg.exe 4996 reg.exe 4624 reg.exe 1620 reg.exe 1904 Process not Found 4388 reg.exe 1764 reg.exe 3020 reg.exe 4728 reg.exe 4252 reg.exe 2532 reg.exe 1940 reg.exe 2412 reg.exe 4956 reg.exe 4992 reg.exe 4620 reg.exe 2544 reg.exe 988 reg.exe 2772 Process not Found 3692 reg.exe 4980 reg.exe 4884 reg.exe 2476 Process not Found 436 reg.exe 1056 reg.exe 1552 Process not Found 4428 Process not Found 1756 reg.exe 740 reg.exe 3212 reg.exe 3632 reg.exe 2752 reg.exe 1544 reg.exe 4592 reg.exe 4612 reg.exe 536 reg.exe 3244 reg.exe 1004 reg.exe 736 reg.exe 4984 reg.exe 412 reg.exe 4964 Process not Found 1652 Process not Found 4404 reg.exe 760 Process not Found 1368 reg.exe 2468 reg.exe 1944 reg.exe 3244 reg.exe 2908 reg.exe 5060 reg.exe 4704 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1956 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1956 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1956 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1956 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2380 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2380 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2380 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2380 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2312 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2312 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2312 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2312 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4712 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4712 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4712 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4712 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4320 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4320 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4320 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4320 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4704 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 592 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 592 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 592 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 592 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2280 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2280 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2280 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 2280 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1620 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1620 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1620 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1620 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4500 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4500 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4500 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4500 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4804 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4804 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4804 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 4804 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 752 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 752 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 752 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 752 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1824 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1824 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1824 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 1824 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3400 pococoIE.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe 3400 pococoIE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 3400 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 81 PID 2472 wrote to memory of 3400 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 81 PID 2472 wrote to memory of 3400 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 81 PID 2472 wrote to memory of 744 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 82 PID 2472 wrote to memory of 744 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 82 PID 2472 wrote to memory of 744 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 82 PID 2472 wrote to memory of 116 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 83 PID 2472 wrote to memory of 116 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 83 PID 2472 wrote to memory of 116 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 83 PID 2472 wrote to memory of 2276 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 85 PID 2472 wrote to memory of 2276 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 85 PID 2472 wrote to memory of 2276 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 85 PID 2472 wrote to memory of 4064 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 86 PID 2472 wrote to memory of 4064 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 86 PID 2472 wrote to memory of 4064 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 86 PID 2472 wrote to memory of 3112 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 87 PID 2472 wrote to memory of 3112 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 87 PID 2472 wrote to memory of 3112 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 87 PID 2472 wrote to memory of 1520 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 88 PID 2472 wrote to memory of 1520 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 88 PID 2472 wrote to memory of 1520 2472 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 88 PID 116 wrote to memory of 3036 116 cmd.exe 90 PID 116 wrote to memory of 3036 116 cmd.exe 90 PID 116 wrote to memory of 3036 116 cmd.exe 90 PID 1520 wrote to memory of 3656 1520 cmd.exe 94 PID 1520 wrote to memory of 3656 1520 cmd.exe 94 PID 1520 wrote to memory of 3656 1520 cmd.exe 94 PID 3036 wrote to memory of 3520 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 95 PID 3036 wrote to memory of 3520 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 95 PID 3036 wrote to memory of 3520 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 95 PID 3520 wrote to memory of 4924 3520 cmd.exe 97 PID 3520 wrote to memory of 4924 3520 cmd.exe 97 PID 3520 wrote to memory of 4924 3520 cmd.exe 97 PID 3036 wrote to memory of 2076 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 98 PID 3036 wrote to memory of 2076 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 98 PID 3036 wrote to memory of 2076 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 98 PID 3036 wrote to memory of 4208 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 99 PID 3036 wrote to memory of 4208 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 99 PID 3036 wrote to memory of 4208 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 99 PID 3036 wrote to memory of 4780 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 100 PID 3036 wrote to memory of 4780 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 100 PID 3036 wrote to memory of 4780 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 100 PID 3036 wrote to memory of 4108 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 101 PID 3036 wrote to memory of 4108 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 101 PID 3036 wrote to memory of 4108 3036 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 101 PID 4108 wrote to memory of 2704 4108 cmd.exe 106 PID 4108 wrote to memory of 2704 4108 cmd.exe 106 PID 4108 wrote to memory of 2704 4108 cmd.exe 106 PID 4924 wrote to memory of 3288 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 107 PID 4924 wrote to memory of 3288 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 107 PID 4924 wrote to memory of 3288 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 107 PID 3288 wrote to memory of 1956 3288 cmd.exe 109 PID 3288 wrote to memory of 1956 3288 cmd.exe 109 PID 3288 wrote to memory of 1956 3288 cmd.exe 109 PID 4924 wrote to memory of 3456 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 110 PID 4924 wrote to memory of 3456 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 110 PID 4924 wrote to memory of 3456 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 110 PID 4924 wrote to memory of 3968 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 111 PID 4924 wrote to memory of 3968 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 111 PID 4924 wrote to memory of 3968 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 111 PID 4924 wrote to memory of 3708 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 112 PID 4924 wrote to memory of 3708 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 112 PID 4924 wrote to memory of 3708 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 112 PID 4924 wrote to memory of 2368 4924 156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe"C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\eeIkUIoE\pococoIE.exe"C:\Users\Admin\eeIkUIoE\pococoIE.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3400
-
-
C:\ProgramData\CIUQoQsg\BeIIUIwE.exe"C:\ProgramData\CIUQoQsg\BeIIUIwE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"2⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab603⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"4⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab605⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"6⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab607⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"8⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab609⤵
- Suspicious behavior: EnumeratesProcesses
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"10⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6011⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"12⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6013⤵
- Suspicious behavior: EnumeratesProcesses
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"14⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6015⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"16⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6017⤵
- Suspicious behavior: EnumeratesProcesses
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"18⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6019⤵
- Suspicious behavior: EnumeratesProcesses
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"20⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6021⤵
- Suspicious behavior: EnumeratesProcesses
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"22⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6023⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"24⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6025⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"26⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6027⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"28⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6029⤵
- Suspicious behavior: EnumeratesProcesses
PID:752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"30⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6031⤵
- Suspicious behavior: EnumeratesProcesses
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"32⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6033⤵PID:1580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"34⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6035⤵PID:3288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"36⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6037⤵PID:3932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"38⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6039⤵PID:2572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"40⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6041⤵PID:2628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"42⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6043⤵PID:4032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"44⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6045⤵PID:1932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"46⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6047⤵PID:3812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"48⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6049⤵PID:4884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"50⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6051⤵PID:4748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"52⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6053⤵PID:2912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"54⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6055⤵PID:4856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"56⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6057⤵PID:4032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"58⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6059⤵PID:4288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"60⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6061⤵PID:436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"62⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6063⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"64⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6065⤵PID:856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"66⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6067⤵PID:3656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"68⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6069⤵PID:4856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"70⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6071⤵PID:2132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"72⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6073⤵PID:4064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"74⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6075⤵PID:3228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"76⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6077⤵PID:4600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"78⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6079⤵PID:4136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"80⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6081⤵PID:2884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"82⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6083⤵PID:4472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"84⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6085⤵PID:4264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"86⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6087⤵PID:1540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"88⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6089⤵PID:4148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"90⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6091⤵PID:2628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"92⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6093⤵PID:3020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"94⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6095⤵PID:4288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"96⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6097⤵PID:4776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"98⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab6099⤵PID:3448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"100⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60101⤵PID:5100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"102⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60103⤵PID:3564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"104⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60105⤵PID:4112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"106⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60107⤵PID:592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"108⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60109⤵PID:2148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"110⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60111⤵PID:4976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"112⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60113⤵PID:2236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"114⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60115⤵PID:1892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"116⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60117⤵PID:400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"118⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60119⤵PID:2400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"120⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60.exeC:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60121⤵PID:4364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156324b5a086c455a11bbcedaab64f41c420eace360588b8fe81e94b78adab60"122⤵PID:4396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-