Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 21:17
Static task
static1
Behavioral task
behavioral1
Sample
4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe
Resource
win10v2004-20241007-en
General
-
Target
4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe
-
Size
1.5MB
-
MD5
a287ee08d969e3069191497790366824
-
SHA1
8b461d3521e08c31822137ad87202e67a3f231c4
-
SHA256
4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291
-
SHA512
3ffb7169a9ba9c97549f8b9e1d4efaac2b5e8375c553e9164841a571ea08d4f158d36345fbdd3104940c9aa8aa1b60f69efe95bfdbf74842e52b2ab9f8b22c2e
-
SSDEEP
24576:/WHd6k7pY1gqELvNR4zugCNvbgk50Au3i0r41aBilXICEp1mPYIoFeitY:jaIgqETNR4zbCFpG/341aUlYCEp4YFFC
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation lWYgEQEE.exe -
Executes dropped EXE 3 IoCs
pid Process 4252 HugoQgEk.exe 4172 lWYgEQEE.exe 1116 igcckQEo.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lWYgEQEE.exe = "C:\\ProgramData\\taswkokg\\lWYgEQEE.exe" igcckQEo.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HugoQgEk.exe = "C:\\Users\\Admin\\tsMwAAEs\\HugoQgEk.exe" 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lWYgEQEE.exe = "C:\\ProgramData\\taswkokg\\lWYgEQEE.exe" 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HugoQgEk.exe = "C:\\Users\\Admin\\tsMwAAEs\\HugoQgEk.exe" HugoQgEk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lWYgEQEE.exe = "C:\\ProgramData\\taswkokg\\lWYgEQEE.exe" lWYgEQEE.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\tsMwAAEs\HugoQgEk igcckQEo.exe File created C:\Windows\SysWOW64\shell32.dll.exe lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\sheEnableDismount.zip lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\sheOutCompare.docx lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\sheSelectProtect.docx lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\sheUnprotectBlock.xlsx lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\sheUnregisterNew.mpg lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\sheCopyHide.doc lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\shePublishCompress.docx lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\tsMwAAEs igcckQEo.exe File opened for modification C:\Windows\SysWOW64\sheCopyTest.wma lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\sheProtectStop.docx lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\sheTestCompare.ppt lWYgEQEE.exe File opened for modification C:\Windows\SysWOW64\sheWaitAdd.docx lWYgEQEE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lWYgEQEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 3660 reg.exe 4416 reg.exe 3040 reg.exe 4220 reg.exe 5060 reg.exe 4752 reg.exe 4996 reg.exe 2260 reg.exe 3876 reg.exe 436 reg.exe 1132 reg.exe 1732 reg.exe 4092 reg.exe 4968 reg.exe 816 reg.exe 1660 reg.exe 460 reg.exe 2760 reg.exe 3876 reg.exe 1320 reg.exe 2288 reg.exe 948 reg.exe 4700 reg.exe 5064 reg.exe 1628 reg.exe 2244 reg.exe 4304 reg.exe 4804 reg.exe 4428 reg.exe 1824 reg.exe 3500 reg.exe 3772 reg.exe 3592 reg.exe 2812 reg.exe 4936 reg.exe 2760 reg.exe 4372 reg.exe 1852 reg.exe 4704 reg.exe 1628 reg.exe 3852 reg.exe 4380 reg.exe 4864 reg.exe 1424 reg.exe 4332 reg.exe 2760 reg.exe 2112 reg.exe 4980 reg.exe 3592 reg.exe 3232 reg.exe 2024 reg.exe 4880 reg.exe 3772 reg.exe 2140 reg.exe 1656 reg.exe 3388 reg.exe 3812 reg.exe 2688 reg.exe 3368 reg.exe 4448 reg.exe 2292 reg.exe 4784 reg.exe 4996 reg.exe 436 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1120 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1120 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1120 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1120 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3016 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3016 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3016 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 3016 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4444 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4444 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4444 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4444 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1812 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1812 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1812 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1812 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1428 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1428 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1428 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1428 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 2560 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 2560 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 2560 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 2560 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 544 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 544 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 544 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 544 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1404 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1404 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1404 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 1404 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4100 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4100 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4100 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4100 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4268 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4268 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4268 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4268 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4812 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4812 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4812 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4812 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 4112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 5092 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 5092 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 5092 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 5092 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4172 lWYgEQEE.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe 4172 lWYgEQEE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3112 wrote to memory of 4252 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 84 PID 3112 wrote to memory of 4252 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 84 PID 3112 wrote to memory of 4252 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 84 PID 3112 wrote to memory of 4172 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 85 PID 3112 wrote to memory of 4172 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 85 PID 3112 wrote to memory of 4172 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 85 PID 3112 wrote to memory of 3388 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 88 PID 3112 wrote to memory of 3388 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 88 PID 3112 wrote to memory of 3388 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 88 PID 3388 wrote to memory of 2356 3388 cmd.exe 90 PID 3388 wrote to memory of 2356 3388 cmd.exe 90 PID 3388 wrote to memory of 2356 3388 cmd.exe 90 PID 3112 wrote to memory of 1852 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 91 PID 3112 wrote to memory of 1852 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 91 PID 3112 wrote to memory of 1852 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 91 PID 3112 wrote to memory of 1664 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 92 PID 3112 wrote to memory of 1664 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 92 PID 3112 wrote to memory of 1664 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 92 PID 3112 wrote to memory of 2412 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 93 PID 3112 wrote to memory of 2412 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 93 PID 3112 wrote to memory of 2412 3112 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 93 PID 2356 wrote to memory of 3596 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 97 PID 2356 wrote to memory of 3596 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 97 PID 2356 wrote to memory of 3596 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 97 PID 2356 wrote to memory of 2032 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 99 PID 2356 wrote to memory of 2032 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 99 PID 2356 wrote to memory of 2032 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 99 PID 2356 wrote to memory of 2320 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 100 PID 2356 wrote to memory of 2320 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 100 PID 2356 wrote to memory of 2320 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 100 PID 2356 wrote to memory of 1932 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 101 PID 2356 wrote to memory of 1932 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 101 PID 2356 wrote to memory of 1932 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 101 PID 2356 wrote to memory of 4412 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 104 PID 2356 wrote to memory of 4412 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 104 PID 2356 wrote to memory of 4412 2356 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 104 PID 3596 wrote to memory of 3668 3596 cmd.exe 107 PID 3596 wrote to memory of 3668 3596 cmd.exe 107 PID 3596 wrote to memory of 3668 3596 cmd.exe 107 PID 4412 wrote to memory of 2960 4412 cmd.exe 108 PID 4412 wrote to memory of 2960 4412 cmd.exe 108 PID 4412 wrote to memory of 2960 4412 cmd.exe 108 PID 3668 wrote to memory of 2740 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 110 PID 3668 wrote to memory of 2740 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 110 PID 3668 wrote to memory of 2740 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 110 PID 3668 wrote to memory of 4532 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 112 PID 3668 wrote to memory of 4532 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 112 PID 3668 wrote to memory of 4532 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 112 PID 3668 wrote to memory of 2288 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 113 PID 3668 wrote to memory of 2288 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 113 PID 3668 wrote to memory of 2288 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 113 PID 3668 wrote to memory of 3876 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 114 PID 3668 wrote to memory of 3876 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 114 PID 3668 wrote to memory of 3876 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 114 PID 3668 wrote to memory of 4160 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 115 PID 3668 wrote to memory of 4160 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 115 PID 3668 wrote to memory of 4160 3668 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 115 PID 2740 wrote to memory of 1120 2740 cmd.exe 120 PID 2740 wrote to memory of 1120 2740 cmd.exe 120 PID 2740 wrote to memory of 1120 2740 cmd.exe 120 PID 4160 wrote to memory of 2140 4160 cmd.exe 121 PID 4160 wrote to memory of 2140 4160 cmd.exe 121 PID 4160 wrote to memory of 2140 4160 cmd.exe 121 PID 1120 wrote to memory of 4536 1120 4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe"C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\tsMwAAEs\HugoQgEk.exe"C:\Users\Admin\tsMwAAEs\HugoQgEk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4252
-
-
C:\ProgramData\taswkokg\lWYgEQEE.exe"C:\ProgramData\taswkokg\lWYgEQEE.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4172
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"2⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac72913⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"4⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac72915⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"6⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac72917⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"8⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac72919⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"10⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729111⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"12⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729113⤵
- Suspicious behavior: EnumeratesProcesses
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"14⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729115⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"16⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729117⤵
- Suspicious behavior: EnumeratesProcesses
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"18⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729119⤵
- Suspicious behavior: EnumeratesProcesses
PID:544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"20⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729121⤵
- Suspicious behavior: EnumeratesProcesses
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"22⤵PID:2424
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵PID:1828
-
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729123⤵
- Suspicious behavior: EnumeratesProcesses
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"24⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729125⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"26⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729127⤵
- Suspicious behavior: EnumeratesProcesses
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"28⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729129⤵
- Suspicious behavior: EnumeratesProcesses
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"30⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729131⤵
- Suspicious behavior: EnumeratesProcesses
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"32⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729133⤵PID:5048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"34⤵
- System Location Discovery: System Language Discovery
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729135⤵PID:4764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"36⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729137⤵PID:4912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"38⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729139⤵
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"40⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729141⤵
- System Location Discovery: System Language Discovery
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"42⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729143⤵PID:1688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"44⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729145⤵PID:2220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"46⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729147⤵PID:2588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"48⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729149⤵PID:3428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"50⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729151⤵PID:3968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"52⤵PID:3528
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729153⤵PID:596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"54⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729155⤵PID:1320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"56⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729157⤵
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"58⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729159⤵PID:3968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"60⤵
- System Location Discovery: System Language Discovery
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729161⤵PID:3992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"62⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729163⤵PID:3064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"64⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729165⤵PID:2016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"66⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729167⤵PID:2684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"68⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729169⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"70⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729171⤵PID:5016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"72⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵PID:5048
-
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729173⤵PID:4932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"74⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729175⤵PID:1792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"76⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729177⤵PID:2744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"78⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729179⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"80⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729181⤵PID:3936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"82⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729183⤵PID:2588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"84⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729185⤵PID:2984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"86⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729187⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"88⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729189⤵PID:2460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"90⤵
- System Location Discovery: System Language Discovery
PID:3156 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:2792
-
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729191⤵PID:4132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"92⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729193⤵PID:3308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"94⤵PID:1072
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵PID:2568
-
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729195⤵PID:2776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"96⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729197⤵PID:3476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"98⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac729199⤵PID:2808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"100⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291101⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"102⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291103⤵PID:1716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"104⤵PID:544
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:1756
-
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291105⤵PID:2264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"106⤵
- System Location Discovery: System Language Discovery
PID:4980 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:3528
-
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291107⤵PID:2984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"108⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291109⤵PID:4856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"110⤵
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291111⤵PID:2936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"112⤵
- System Location Discovery: System Language Discovery
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291113⤵PID:3592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"114⤵PID:2584
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:440
-
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291115⤵PID:3112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"116⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291117⤵PID:4808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"118⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291119⤵PID:5084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"120⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291.exeC:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291121⤵PID:2456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4684ed29993f94294385dd0e30b0a3228f20f4d867fe8e2b91e27456e1ac7291"122⤵PID:1428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-