Analysis
-
max time kernel
36s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2025, 03:34
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral2
Sample
JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe
Resource
win11-20250410-en
General
-
Target
JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe
-
Size
832KB
-
MD5
c45c7c3be165367d7676c127dbdc2050
-
SHA1
0ca4bbd08beb9ce9e8bd6807113345389aa07588
-
SHA256
7be6ccadfe39aff45029a30fe34b3c87ac49ebbad791c34e2ff8bb30e7e07721
-
SHA512
d0aa1e6158da64512f9098ed1ae8d33d1882a1c23fb2c7bbbc3a3c0e331355d24dc302ef4f5b778d17f952fdd93adfd5e77fc81c73c5b119793b398edb43bbb3
-
SSDEEP
12288:0gkDxdkL+6JNgKVcRa+fpHyWs3OBH4pUYJPfZQ:qxsKXa+hHyWseBgzm
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wcycexrfgmi.exe -
Pykspa family
-
UAC bypass 3 TTPs 29 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tfotdhl.exe -
Detect Pykspa worm 2 IoCs
resource yara_rule behavioral1/files/0x0024000000022f12-4.dat family_pykspa behavioral1/files/0x000a000000024204-86.dat family_pykspa -
Adds policy Run key to start application 2 TTPs 61 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfbtqhytoghwbozbebcb.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "trmdzpfztkkycoyzbxx.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "trmdzpfztkkycoyzbxx.exe" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "zvodxlzrjywikucbb.exe" tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bltbhrglwn = "rjzpdvsfyxknyhhidl.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snftmzmduifqrahf.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "zvodxlzrjywikucbb.exe" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trmdzpfztkkycoyzbxx.exe" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "vvsljbtplegwcqcfjhjjg.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trmdzpfztkkycoyzbxx.exe" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "gfbtqhytoghwbozbebcb.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "zvodxlzrjywikucbb.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trmdzpfztkkycoyzbxx.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "gfbtqhytoghwbozbebcb.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "gfbtqhytoghwbozbebcb.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "zvodxlzrjywikucbb.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "ifzpkzohaqpcfqzzav.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfbtqhytoghwbozbebcb.exe" tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "gfbtqhytoghwbozbebcb.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "gfbtqhytoghwbozbebcb.exe" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "ifzpkzohaqpcfqzzav.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "ifzpkzohaqpcfqzzav.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "vvsljbtplegwcqcfjhjjg.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trmdzpfztkkycoyzbxx.exe" tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bltbhrglwn = "ezslcxxnjlbhvhkomxsle.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfbtqhytoghwbozbebcb.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvodxlzrjywikucbb.exe" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cjotwdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rjzpdvsfyxknyhhidl.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqznvdpbkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvodxlzrjywikucbb.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kdtfwhshwidmls = "snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cjotwdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvmdsljxrrfjvfgieng.exe" wcycexrfgmi.exe -
Disables RegEdit via registry modification 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tfotdhl.exe Set value (int) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wcycexrfgmi.exe Set value (int) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tfotdhl.exe Set value (int) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wcycexrfgmi.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation snftmzmduifqrahf.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation ifzpkzohaqpcfqzzav.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation snftmzmduifqrahf.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation snftmzmduifqrahf.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation wcycexrfgmi.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation snftmzmduifqrahf.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation snftmzmduifqrahf.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation ifzpkzohaqpcfqzzav.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation snftmzmduifqrahf.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation snftmzmduifqrahf.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation ifzpkzohaqpcfqzzav.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation ifzpkzohaqpcfqzzav.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation ifzpkzohaqpcfqzzav.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation snftmzmduifqrahf.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation ifzpkzohaqpcfqzzav.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation wcycexrfgmi.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation ifzpkzohaqpcfqzzav.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation snftmzmduifqrahf.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation gfbtqhytoghwbozbebcb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation vvsljbtplegwcqcfjhjjg.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation zvodxlzrjywikucbb.exe Key value queried \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation trmdzpfztkkycoyzbxx.exe -
Executes dropped EXE 64 IoCs
pid Process 4688 wcycexrfgmi.exe 4864 ifzpkzohaqpcfqzzav.exe 4972 vvsljbtplegwcqcfjhjjg.exe 1760 wcycexrfgmi.exe 2728 zvodxlzrjywikucbb.exe 5288 snftmzmduifqrahf.exe 3624 gfbtqhytoghwbozbebcb.exe 3388 trmdzpfztkkycoyzbxx.exe 1300 wcycexrfgmi.exe 6112 wcycexrfgmi.exe 4136 zvodxlzrjywikucbb.exe 3540 zvodxlzrjywikucbb.exe 2236 wcycexrfgmi.exe 1924 tfotdhl.exe 5764 tfotdhl.exe 4432 ifzpkzohaqpcfqzzav.exe 5996 ifzpkzohaqpcfqzzav.exe 5768 trmdzpfztkkycoyzbxx.exe 2700 trmdzpfztkkycoyzbxx.exe 4312 wcycexrfgmi.exe 5516 wcycexrfgmi.exe 4980 snftmzmduifqrahf.exe 2624 vvsljbtplegwcqcfjhjjg.exe 5392 snftmzmduifqrahf.exe 5360 ifzpkzohaqpcfqzzav.exe 3080 vvsljbtplegwcqcfjhjjg.exe 4872 zvodxlzrjywikucbb.exe 3880 ifzpkzohaqpcfqzzav.exe 4968 zvodxlzrjywikucbb.exe 1760 wcycexrfgmi.exe 5988 wcycexrfgmi.exe 4344 wcycexrfgmi.exe 2908 wcycexrfgmi.exe 5760 vvsljbtplegwcqcfjhjjg.exe 3020 ifzpkzohaqpcfqzzav.exe 2996 vvsljbtplegwcqcfjhjjg.exe 2932 ifzpkzohaqpcfqzzav.exe 5124 wcycexrfgmi.exe 2368 wcycexrfgmi.exe 5804 vvsljbtplegwcqcfjhjjg.exe 3856 trmdzpfztkkycoyzbxx.exe 5620 wcycexrfgmi.exe 3748 vvsljbtplegwcqcfjhjjg.exe 1096 gfbtqhytoghwbozbebcb.exe 5476 ifzpkzohaqpcfqzzav.exe 2752 wcycexrfgmi.exe 6096 trmdzpfztkkycoyzbxx.exe 5636 wcycexrfgmi.exe 1660 gfbtqhytoghwbozbebcb.exe 4616 ifzpkzohaqpcfqzzav.exe 1708 wcycexrfgmi.exe 5104 zvodxlzrjywikucbb.exe 5316 gfbtqhytoghwbozbebcb.exe 5304 gfbtqhytoghwbozbebcb.exe 2792 gfbtqhytoghwbozbebcb.exe 5616 zvodxlzrjywikucbb.exe 5832 zvodxlzrjywikucbb.exe 1148 wcycexrfgmi.exe 1964 wcycexrfgmi.exe 4880 wcycexrfgmi.exe 1536 ifzpkzohaqpcfqzzav.exe 5124 snftmzmduifqrahf.exe 4176 gfbtqhytoghwbozbebcb.exe 1352 vvsljbtplegwcqcfjhjjg.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc tfotdhl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager tfotdhl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys tfotdhl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc tfotdhl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power tfotdhl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys tfotdhl.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "trmdzpfztkkycoyzbxx.exe ." tfotdhl.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\snftmzmduifqrahf = "gfbtqhytoghwbozbebcb.exe ." tfotdhl.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\snftmzmduifqrahf = "vvsljbtplegwcqcfjhjjg.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "ifzpkzohaqpcfqzzav.exe ." tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "ifzpkzohaqpcfqzzav.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\snftmzmduifqrahf = "snftmzmduifqrahf.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "ifzpkzohaqpcfqzzav.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\snftmzmduifqrahf = "gfbtqhytoghwbozbebcb.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zvodxlzrjywikucbb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snftmzmduifqrahf.exe ." tfotdhl.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\snftmzmduifqrahf = "vvsljbtplegwcqcfjhjjg.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nhyldpbrhuqaaio = "snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\iryfkthlv = "brftfvqbspabkrpo.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "trmdzpfztkkycoyzbxx.exe ." tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ifzpkzohaqpcfqzzav = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe" tfotdhl.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trmdzpfztkkycoyzbxx.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "zvodxlzrjywikucbb.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zvodxlzrjywikucbb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trmdzpfztkkycoyzbxx.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zvodxlzrjywikucbb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snftmzmduifqrahf.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thtfpdwfupyxej = "C:\\Users\\Admin\\AppData\\Local\\Temp\\izodqhdphfrtdlkke.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ifzpkzohaqpcfqzzav = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nhyldpbrhuqaaio = "snftmzmduifqrahf.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ifzpkzohaqpcfqzzav = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "trmdzpfztkkycoyzbxx.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trmdzpfztkkycoyzbxx.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nhyldpbrhuqaaio = "vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "vvsljbtplegwcqcfjhjjg.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfbtqhytoghwbozbebcb.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zvodxlzrjywikucbb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nhyldpbrhuqaaio = "ifzpkzohaqpcfqzzav.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "vvsljbtplegwcqcfjhjjg.exe" tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nhyldpbrhuqaaio = "trmdzpfztkkycoyzbxx.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "vvsljbtplegwcqcfjhjjg.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvsljbtplegwcqcfjhjjg.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ifzpkzohaqpcfqzzav = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfbtqhytoghwbozbebcb.exe" tfotdhl.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nhyldpbrhuqaaio = "snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zvodxlzrjywikucbb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trmdzpfztkkycoyzbxx.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trmdzpfztkkycoyzbxx.exe ." tfotdhl.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nhyldpbrhuqaaio = "trmdzpfztkkycoyzbxx.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nhyldpbrhuqaaio = "vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\snftmzmduifqrahf = "trmdzpfztkkycoyzbxx.exe ." tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "vvsljbtplegwcqcfjhjjg.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zvodxlzrjywikucbb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe ." tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbpzoxgtgqjq = "trmdzpfztkkycoyzbxx.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ifzpkzohaqpcfqzzav = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snftmzmduifqrahf.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\snftmzmduifqrahf = "ifzpkzohaqpcfqzzav.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "zvodxlzrjywikucbb.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ifzpkzohaqpcfqzzav = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe" wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zvodxlzrjywikucbb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvodxlzrjywikucbb.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tfpzhtkrexeb = "brftfvqbspabkrpo.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzpkzohaqpcfqzzav.exe ." tfotdhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "snftmzmduifqrahf.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\snftmzmduifqrahf = "gfbtqhytoghwbozbebcb.exe ." tfotdhl.exe Set value (str) \REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tfpzhtkrexeb = "ezslcxxnjlbhvhkomxsle.exe ." wcycexrfgmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jbqbrblznysay = "zvodxlzrjywikucbb.exe ." wcycexrfgmi.exe -
Checks whether UAC is enabled 1 TTPs 34 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tfotdhl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tfotdhl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 4 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wcycexrfgmi.exe -
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 39 www.whatismyip.ca 48 whatismyip.everdot.org 53 www.whatismyip.ca 25 whatismyipaddress.com 27 www.whatismyip.ca 29 whatismyip.everdot.org 35 whatismyip.everdot.org 36 www.showmyipaddress.com -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\snftmzmduifqrahf.exe tfotdhl.exe File opened for modification C:\Windows\SysWOW64\zvodxlzrjywikucbb.exe tfotdhl.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\ifzpkzohaqpcfqzzav.exe tfotdhl.exe File opened for modification C:\Windows\SysWOW64\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\snftmzmduifqrahf.exe tfotdhl.exe File opened for modification C:\Windows\SysWOW64\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\vvsljbtplegwcqcfjhjjg.exe tfotdhl.exe File opened for modification C:\Windows\SysWOW64\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\trmdzpfztkkycoyzbxx.exe tfotdhl.exe File opened for modification C:\Windows\SysWOW64\fnstzzzdhisqeaufrxhpuvbbb.jku tfotdhl.exe File opened for modification C:\Windows\SysWOW64\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe tfotdhl.exe File opened for modification C:\Windows\SysWOW64\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe tfotdhl.exe File opened for modification C:\Windows\SysWOW64\zvodxlzrjywikucbb.exe tfotdhl.exe File opened for modification C:\Windows\SysWOW64\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\SysWOW64\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\fnstzzzdhisqeaufrxhpuvbbb.jku tfotdhl.exe File created C:\Program Files (x86)\fnstzzzdhisqeaufrxhpuvbbb.jku tfotdhl.exe File opened for modification C:\Program Files (x86)\kdtfwhshwidmlsxtqhcvlxozkzoavedkpliz.ndp tfotdhl.exe File created C:\Program Files (x86)\kdtfwhshwidmlsxtqhcvlxozkzoavedkpliz.ndp tfotdhl.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File created C:\Windows\kdtfwhshwidmlsxtqhcvlxozkzoavedkpliz.ndp tfotdhl.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe tfotdhl.exe File opened for modification C:\Windows\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe tfotdhl.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe tfotdhl.exe File opened for modification C:\Windows\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe tfotdhl.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe tfotdhl.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\mnlfexqnkehyfuhlqpstrl.exe wcycexrfgmi.exe File opened for modification C:\Windows\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\mnlfexqnkehyfuhlqpstrl.exe tfotdhl.exe File opened for modification C:\Windows\trmdzpfztkkycoyzbxx.exe tfotdhl.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe wcycexrfgmi.exe File opened for modification C:\Windows\zvodxlzrjywikucbb.exe wcycexrfgmi.exe File opened for modification C:\Windows\snftmzmduifqrahf.exe tfotdhl.exe File opened for modification C:\Windows\ifzpkzohaqpcfqzzav.exe wcycexrfgmi.exe File opened for modification C:\Windows\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\trmdzpfztkkycoyzbxx.exe wcycexrfgmi.exe File opened for modification C:\Windows\fnstzzzdhisqeaufrxhpuvbbb.jku tfotdhl.exe File opened for modification C:\Windows\vvsljbtplegwcqcfjhjjg.exe wcycexrfgmi.exe File opened for modification C:\Windows\gfbtqhytoghwbozbebcb.exe wcycexrfgmi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifzpkzohaqpcfqzzav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brftfvqbspabkrpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ezslcxxnjlbhvhkomxsle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifzpkzohaqpcfqzzav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trmdzpfztkkycoyzbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifzpkzohaqpcfqzzav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snftmzmduifqrahf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language izodqhdphfrtdlkke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjzpdvsfyxknyhhidl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvsljbtplegwcqcfjhjjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trmdzpfztkkycoyzbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trmdzpfztkkycoyzbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gfbtqhytoghwbozbebcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trmdzpfztkkycoyzbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvsljbtplegwcqcfjhjjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gfbtqhytoghwbozbebcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ezslcxxnjlbhvhkomxsle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvsljbtplegwcqcfjhjjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvsljbtplegwcqcfjhjjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brftfvqbspabkrpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvsljbtplegwcqcfjhjjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjbtjdcrmnchufhkhrld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvsljbtplegwcqcfjhjjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvmdsljxrrfjvfgieng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvmdsljxrrfjvfgieng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcycexrfgmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trmdzpfztkkycoyzbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvsljbtplegwcqcfjhjjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifzpkzohaqpcfqzzav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifzpkzohaqpcfqzzav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snftmzmduifqrahf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gfbtqhytoghwbozbebcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvsljbtplegwcqcfjhjjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snftmzmduifqrahf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gfbtqhytoghwbozbebcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gfbtqhytoghwbozbebcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gfbtqhytoghwbozbebcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snftmzmduifqrahf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trmdzpfztkkycoyzbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifzpkzohaqpcfqzzav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifzpkzohaqpcfqzzav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trmdzpfztkkycoyzbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trmdzpfztkkycoyzbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifzpkzohaqpcfqzzav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gfbtqhytoghwbozbebcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvsljbtplegwcqcfjhjjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snftmzmduifqrahf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvodxlzrjywikucbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snftmzmduifqrahf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trmdzpfztkkycoyzbxx.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 1924 tfotdhl.exe 1924 tfotdhl.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 1924 tfotdhl.exe 1924 tfotdhl.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1924 tfotdhl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5816 wrote to memory of 4688 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 91 PID 5816 wrote to memory of 4688 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 91 PID 5816 wrote to memory of 4688 5816 JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe 91 PID 5372 wrote to memory of 4864 5372 cmd.exe 94 PID 5372 wrote to memory of 4864 5372 cmd.exe 94 PID 5372 wrote to memory of 4864 5372 cmd.exe 94 PID 4900 wrote to memory of 4972 4900 cmd.exe 97 PID 4900 wrote to memory of 4972 4900 cmd.exe 97 PID 4900 wrote to memory of 4972 4900 cmd.exe 97 PID 4972 wrote to memory of 1760 4972 vvsljbtplegwcqcfjhjjg.exe 101 PID 4972 wrote to memory of 1760 4972 vvsljbtplegwcqcfjhjjg.exe 101 PID 4972 wrote to memory of 1760 4972 vvsljbtplegwcqcfjhjjg.exe 101 PID 4976 wrote to memory of 2728 4976 cmd.exe 168 PID 4976 wrote to memory of 2728 4976 cmd.exe 168 PID 4976 wrote to memory of 2728 4976 cmd.exe 168 PID 5752 wrote to memory of 5288 5752 cmd.exe 106 PID 5752 wrote to memory of 5288 5752 cmd.exe 106 PID 5752 wrote to memory of 5288 5752 cmd.exe 106 PID 4736 wrote to memory of 3624 4736 cmd.exe 109 PID 4736 wrote to memory of 3624 4736 cmd.exe 109 PID 4736 wrote to memory of 3624 4736 cmd.exe 109 PID 1184 wrote to memory of 3388 1184 cmd.exe 110 PID 1184 wrote to memory of 3388 1184 cmd.exe 110 PID 1184 wrote to memory of 3388 1184 cmd.exe 110 PID 5288 wrote to memory of 1300 5288 snftmzmduifqrahf.exe 111 PID 5288 wrote to memory of 1300 5288 snftmzmduifqrahf.exe 111 PID 5288 wrote to memory of 1300 5288 snftmzmduifqrahf.exe 111 PID 3388 wrote to memory of 6112 3388 trmdzpfztkkycoyzbxx.exe 114 PID 3388 wrote to memory of 6112 3388 trmdzpfztkkycoyzbxx.exe 114 PID 3388 wrote to memory of 6112 3388 trmdzpfztkkycoyzbxx.exe 114 PID 3528 wrote to memory of 4136 3528 cmd.exe 115 PID 3528 wrote to memory of 4136 3528 cmd.exe 115 PID 3528 wrote to memory of 4136 3528 cmd.exe 115 PID 1644 wrote to memory of 3540 1644 cmd.exe 118 PID 1644 wrote to memory of 3540 1644 cmd.exe 118 PID 1644 wrote to memory of 3540 1644 cmd.exe 118 PID 3540 wrote to memory of 2236 3540 zvodxlzrjywikucbb.exe 119 PID 3540 wrote to memory of 2236 3540 zvodxlzrjywikucbb.exe 119 PID 3540 wrote to memory of 2236 3540 zvodxlzrjywikucbb.exe 119 PID 4688 wrote to memory of 1924 4688 wcycexrfgmi.exe 122 PID 4688 wrote to memory of 1924 4688 wcycexrfgmi.exe 122 PID 4688 wrote to memory of 1924 4688 wcycexrfgmi.exe 122 PID 4688 wrote to memory of 5764 4688 wcycexrfgmi.exe 123 PID 4688 wrote to memory of 5764 4688 wcycexrfgmi.exe 123 PID 4688 wrote to memory of 5764 4688 wcycexrfgmi.exe 123 PID 2072 wrote to memory of 4432 2072 cmd.exe 132 PID 2072 wrote to memory of 4432 2072 cmd.exe 132 PID 2072 wrote to memory of 4432 2072 cmd.exe 132 PID 1668 wrote to memory of 5996 1668 cmd.exe 197 PID 1668 wrote to memory of 5996 1668 cmd.exe 197 PID 1668 wrote to memory of 5996 1668 cmd.exe 197 PID 1372 wrote to memory of 5768 1372 cmd.exe 135 PID 1372 wrote to memory of 5768 1372 cmd.exe 135 PID 1372 wrote to memory of 5768 1372 cmd.exe 135 PID 1708 wrote to memory of 2700 1708 cmd.exe 286 PID 1708 wrote to memory of 2700 1708 cmd.exe 286 PID 1708 wrote to memory of 2700 1708 cmd.exe 286 PID 5768 wrote to memory of 4312 5768 trmdzpfztkkycoyzbxx.exe 145 PID 5768 wrote to memory of 4312 5768 trmdzpfztkkycoyzbxx.exe 145 PID 5768 wrote to memory of 4312 5768 trmdzpfztkkycoyzbxx.exe 145 PID 2700 wrote to memory of 5516 2700 trmdzpfztkkycoyzbxx.exe 147 PID 2700 wrote to memory of 5516 2700 trmdzpfztkkycoyzbxx.exe 147 PID 2700 wrote to memory of 5516 2700 trmdzpfztkkycoyzbxx.exe 147 PID 3712 wrote to memory of 4980 3712 cmd.exe 156 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wcycexrfgmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tfotdhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tfotdhl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wcycexrfgmi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wcycexrfgmi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c45c7c3be165367d7676c127dbdc2050.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_c45c7c3be165367d7676c127dbdc2050.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\tfotdhl.exe"C:\Users\Admin\AppData\Local\Temp\tfotdhl.exe" "-C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1924
-
-
C:\Users\Admin\AppData\Local\Temp\tfotdhl.exe"C:\Users\Admin\AppData\Local\Temp\tfotdhl.exe" "-C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:5764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵
- Executes dropped EXE
PID:1760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe .1⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\snftmzmduifqrahf.exe*."3⤵
- Executes dropped EXE
PID:1300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵
- Executes dropped EXE
PID:3624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵
- Executes dropped EXE
PID:6112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵
- Executes dropped EXE
PID:4136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵
- Executes dropped EXE
PID:2236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵
- Executes dropped EXE
PID:5996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵
- Executes dropped EXE
PID:4432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵
- Executes dropped EXE
PID:4312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵
- Executes dropped EXE
PID:5516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵
- Executes dropped EXE
PID:4980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:2636
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵
- Executes dropped EXE
PID:5392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:1328
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:3652
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵
- Executes dropped EXE
PID:5988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵
- Executes dropped EXE
PID:3880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵
- Executes dropped EXE
PID:4344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵
- Executes dropped EXE
PID:2908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵
- Executes dropped EXE
PID:2996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵
- Executes dropped EXE
PID:5760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵
- Executes dropped EXE
PID:2368
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵
- Executes dropped EXE
PID:5124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:2052
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵
- Executes dropped EXE
PID:5804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:3640
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵
- Executes dropped EXE
PID:5620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:388
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵
- Executes dropped EXE
PID:3748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:1088
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵
- Executes dropped EXE
PID:2752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵
- Executes dropped EXE
PID:5476
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵
- Executes dropped EXE
PID:5636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵
- Executes dropped EXE
PID:1660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe1⤵PID:5088
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe2⤵
- Executes dropped EXE
PID:5104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:4904
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵
- Executes dropped EXE
PID:5316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:3484
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵
- Executes dropped EXE
PID:5304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:4604
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵
- Executes dropped EXE
PID:1148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:5016
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵
- Executes dropped EXE
PID:1964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:4376
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵
- Executes dropped EXE
PID:4880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:5844
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵
- Executes dropped EXE
PID:1536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:2136
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵
- Executes dropped EXE
PID:5124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:4288
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:1080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:4320
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:5988
-
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
PID:4040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:1332
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:3804
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:5292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:5264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵
- Executes dropped EXE
PID:1352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:2368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:4240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵
- Checks computer location settings
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:4384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:4192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:4628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:2700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:4664
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:5260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:5796
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:4908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:3692
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:1148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:4696
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:4344
-
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:3080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵PID:2748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:1428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵
- System Location Discovery: System Language Discovery
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:4480
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:4684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe .1⤵PID:4732
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe .2⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\snftmzmduifqrahf.exe*."3⤵PID:532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:3632
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:5288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:3912
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:3924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:5996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:2524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:2640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:1184
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:3260
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:3104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe .1⤵PID:2744
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\snftmzmduifqrahf.exe*."3⤵PID:5928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:3052
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:5460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:3952
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:4856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:2780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵
- System Location Discovery: System Language Discovery
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:1548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:4188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:3880
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:5244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:3704
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:4912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:4212
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:4604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:5016
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:4768
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:3008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵
- Checks computer location settings
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:1340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:5060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:2316
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:2908
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:5684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:4592
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:5508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:1596
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:5468
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:1296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:4884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:1184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵
- Checks computer location settings
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:5308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:4940
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:3844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:4456
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:1640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:5552
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:5876
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:4856
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:2564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:5304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:3952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:2756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:5716
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:3972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:4616
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:5616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:368
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:1348
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:4888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:4736
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1536
-
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:3744
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:1568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:636
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:2936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:3056
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:388 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:5176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:2904
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:4400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:4780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:1084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:1812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:5116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:5756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:5328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:5052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:3804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:1636
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:1332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:2348
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:5636
-
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:5516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:5988
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:5928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:5272
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:1808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:5964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵
- Checks computer location settings
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:2760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:3192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵
- Checks computer location settings
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:5640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:4296
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:2792
-
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:5540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:2560
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:3916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:2736
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:4856
-
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:1544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:1708
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:3692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:4628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System policy modification
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:6080
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4844
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4320
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:2052
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4964
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5564
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5608
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:1088
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:1124
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4748
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:1032
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5760
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:880
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5696
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5804
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:544
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4484
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:508
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5160
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4684
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4552
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5288
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5104
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:676
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5996
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4904
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4816
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:3916
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5756
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4604
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4632
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:508
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:4612
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:1724
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5468
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:3652
-
-
C:\Users\Admin\AppData\Local\Temp\ejmpq.exe"C:\Users\Admin\AppData\Local\Temp\ejmpq.exe" "-C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe"4⤵PID:5476
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:1012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵
- Checks computer location settings
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c brftfvqbspabkrpo.exe1⤵PID:6092
-
C:\Windows\brftfvqbspabkrpo.exebrftfvqbspabkrpo.exe2⤵PID:4792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c brftfvqbspabkrpo.exe .1⤵PID:1760
-
C:\Windows\brftfvqbspabkrpo.exebrftfvqbspabkrpo.exe .2⤵
- System Location Discovery: System Language Discovery
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\brftfvqbspabkrpo.exe*."3⤵PID:2260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c izodqhdphfrtdlkke.exe1⤵PID:5900
-
C:\Windows\izodqhdphfrtdlkke.exeizodqhdphfrtdlkke.exe2⤵
- System Location Discovery: System Language Discovery
PID:5972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:2452
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:4192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ezslcxxnjlbhvhkomxsle.exe .1⤵PID:4956
-
C:\Windows\ezslcxxnjlbhvhkomxsle.exeezslcxxnjlbhvhkomxsle.exe .2⤵
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ezslcxxnjlbhvhkomxsle.exe*."3⤵PID:3748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\pjbtjdcrmnchufhkhrld.exe1⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\pjbtjdcrmnchufhkhrld.exeC:\Users\Admin\AppData\Local\Temp\pjbtjdcrmnchufhkhrld.exe2⤵PID:856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:5352
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- System Location Discovery: System Language Discovery
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:5880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\rjzpdvsfyxknyhhidl.exe .1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\rjzpdvsfyxknyhhidl.exeC:\Users\Admin\AppData\Local\Temp\rjzpdvsfyxknyhhidl.exe .2⤵
- System Location Discovery: System Language Discovery
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\rjzpdvsfyxknyhhidl.exe*."3⤵PID:740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:3088
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:5552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:2996
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:368
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe1⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exeC:\Users\Admin\AppData\Local\Temp\brftfvqbspabkrpo.exe2⤵
- System Location Discovery: System Language Discovery
PID:3192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:4888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:5772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\izodqhdphfrtdlkke.exe .1⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\izodqhdphfrtdlkke.exeC:\Users\Admin\AppData\Local\Temp\izodqhdphfrtdlkke.exe .2⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\izodqhdphfrtdlkke.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:3344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:4284
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:4820
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:4480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:5700
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1080
-
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:880 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:2692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:372
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:4964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:1520
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:5532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:6092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵
- System Location Discovery: System Language Discovery
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:428
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:4612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c brftfvqbspabkrpo.exe1⤵PID:3856
-
C:\Windows\brftfvqbspabkrpo.exebrftfvqbspabkrpo.exe2⤵PID:4872
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:2484
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pjbtjdcrmnchufhkhrld.exe .1⤵PID:5008
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:2700
-
-
C:\Windows\pjbtjdcrmnchufhkhrld.exepjbtjdcrmnchufhkhrld.exe .2⤵
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\pjbtjdcrmnchufhkhrld.exe*."3⤵PID:4008
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:2796
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:3908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cvmdsljxrrfjvfgieng.exe1⤵PID:5564
-
C:\Windows\cvmdsljxrrfjvfgieng.execvmdsljxrrfjvfgieng.exe2⤵
- System Location Discovery: System Language Discovery
PID:3080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c brftfvqbspabkrpo.exe .1⤵PID:5872
-
C:\Windows\brftfvqbspabkrpo.exebrftfvqbspabkrpo.exe .2⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\brftfvqbspabkrpo.exe*."3⤵PID:912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe1⤵PID:5352
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe2⤵PID:4304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:4968
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\izodqhdphfrtdlkke.exe1⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\izodqhdphfrtdlkke.exeC:\Users\Admin\AppData\Local\Temp\izodqhdphfrtdlkke.exe2⤵PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:1976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exe .1⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exeC:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exe .2⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ezslcxxnjlbhvhkomxsle.exe*."3⤵PID:3488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:3680
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:3556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exe1⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exeC:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exe2⤵PID:5720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:4996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exe .1⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exeC:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exe .2⤵
- System Location Discovery: System Language Discovery
PID:636 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\cvmdsljxrrfjvfgieng.exe*."3⤵PID:880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:4176
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:2748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:4400
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:5708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:2628
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:4124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:4136
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:2308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:4632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:1308
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:3652
-
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:3656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:5988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:1728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:2904
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:2756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:1800
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:5436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:5476
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:4300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:5880
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:3952
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:912
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe .1⤵PID:4664
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe .2⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\snftmzmduifqrahf.exe*."3⤵PID:4324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:4748
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:2512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:5096
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:2712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:5928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:3588
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:4400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:4404
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:5708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:3744
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1812
-
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:4448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:5956
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:3472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:4344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:2076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:4984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:4940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵PID:4884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:4812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:1332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:6100
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:4192
-
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:1792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:6096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe1⤵PID:1796
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe2⤵PID:5360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:1172
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:5044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:5632
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:3388
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1772
-
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:3852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:2956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:5312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:6008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:3840
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:4448
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:4904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:2984
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:4372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:5008
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:4884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:5360
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:6080
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:4688
-
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:2004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:1720
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:5988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:3656
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:4684
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:5328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:5212
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:5668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:5844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:1380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:2980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:4324
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:3608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:4432
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:4952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:3524
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:5904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe .1⤵PID:3220
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe .2⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\snftmzmduifqrahf.exe*."3⤵PID:4448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:2724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:2984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:5564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵PID:3952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rjzpdvsfyxknyhhidl.exe1⤵PID:5880
-
C:\Windows\rjzpdvsfyxknyhhidl.exerjzpdvsfyxknyhhidl.exe2⤵PID:1556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cvmdsljxrrfjvfgieng.exe .1⤵PID:1636
-
C:\Windows\cvmdsljxrrfjvfgieng.execvmdsljxrrfjvfgieng.exe .2⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\cvmdsljxrrfjvfgieng.exe*."3⤵PID:4944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c izodqhdphfrtdlkke.exe1⤵PID:1800
-
C:\Windows\izodqhdphfrtdlkke.exeizodqhdphfrtdlkke.exe2⤵PID:1752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ezslcxxnjlbhvhkomxsle.exe .1⤵PID:3284
-
C:\Windows\ezslcxxnjlbhvhkomxsle.exeezslcxxnjlbhvhkomxsle.exe .2⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ezslcxxnjlbhvhkomxsle.exe*."3⤵PID:3896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\pjbtjdcrmnchufhkhrld.exe1⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\pjbtjdcrmnchufhkhrld.exeC:\Users\Admin\AppData\Local\Temp\pjbtjdcrmnchufhkhrld.exe2⤵PID:2788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:2524
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:2712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\rjzpdvsfyxknyhhidl.exe .1⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\rjzpdvsfyxknyhhidl.exeC:\Users\Admin\AppData\Local\Temp\rjzpdvsfyxknyhhidl.exe .2⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\rjzpdvsfyxknyhhidl.exe*."3⤵PID:4908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:2312
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exe1⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exeC:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exe2⤵PID:5580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:1728
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:5096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:2452
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:4952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exe .1⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exeC:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exe .2⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\cvmdsljxrrfjvfgieng.exe*."3⤵PID:2308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:4204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:5920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:1860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:5860
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:4984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:5104
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:3448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe1⤵PID:2980
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:5176
-
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe2⤵PID:1136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe .1⤵PID:4436
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe .2⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\zvodxlzrjywikucbb.exe*."3⤵PID:880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:4832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:2352
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:2564
-
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:1752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:4752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:5708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:4780
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:2852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:2760
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:4900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:5280
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:2812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:3580
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:5876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:5508
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:4704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:4840
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:6016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:5628
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:6084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:1444
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:5996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:5052
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:5788
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:2980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:2028
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:2920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:4940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:5468
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1132
-
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:4500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:4996
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:5344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:3256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:3840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:4424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:2592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:5064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:3928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:3284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:3604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:5844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:5424
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:512
-
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:1720
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:4108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe1⤵PID:5876
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe2⤵PID:1728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:5624
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:5856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:4732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:1964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:4892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:3448
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:3412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:5828
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:4752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:2752
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:1348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:3128
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:5860
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:1908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:1560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:5268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:6096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:3096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:6092
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:2852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:1372
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:3788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe1⤵PID:1296
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe2⤵PID:5116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:1772
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1568
-
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:5000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:4428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:4744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:4664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:4968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:3560
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:1640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:5352
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:5124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe1⤵PID:4296
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe2⤵PID:3264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe .1⤵PID:3652
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe .2⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\snftmzmduifqrahf.exe*."3⤵PID:5956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:4696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:4716
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1012
-
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:2788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pjbtjdcrmnchufhkhrld.exe1⤵PID:2308
-
C:\Windows\pjbtjdcrmnchufhkhrld.exepjbtjdcrmnchufhkhrld.exe2⤵PID:5832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:3792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rjzpdvsfyxknyhhidl.exe .1⤵PID:1876
-
C:\Windows\rjzpdvsfyxknyhhidl.exerjzpdvsfyxknyhhidl.exe .2⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\rjzpdvsfyxknyhhidl.exe*."3⤵PID:372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:2204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c brftfvqbspabkrpo.exe1⤵PID:5480
-
C:\Windows\brftfvqbspabkrpo.exebrftfvqbspabkrpo.exe2⤵PID:3744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pjbtjdcrmnchufhkhrld.exe .1⤵PID:1644
-
C:\Windows\pjbtjdcrmnchufhkhrld.exepjbtjdcrmnchufhkhrld.exe .2⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\pjbtjdcrmnchufhkhrld.exe*."3⤵PID:5504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exe1⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exeC:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exe2⤵PID:5456
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exe .1⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exeC:\Users\Admin\AppData\Local\Temp\ezslcxxnjlbhvhkomxsle.exe .2⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ezslcxxnjlbhvhkomxsle.exe*."3⤵PID:4832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\rjzpdvsfyxknyhhidl.exe1⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\rjzpdvsfyxknyhhidl.exeC:\Users\Admin\AppData\Local\Temp\rjzpdvsfyxknyhhidl.exe2⤵PID:4020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:5116
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:2640
-
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:4780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exe .1⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exeC:\Users\Admin\AppData\Local\Temp\cvmdsljxrrfjvfgieng.exe .2⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\cvmdsljxrrfjvfgieng.exe*."3⤵PID:2236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:5392
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:4016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:5160
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:4500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe .1⤵PID:1728
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe .2⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\snftmzmduifqrahf.exe*."3⤵PID:3048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe1⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe2⤵PID:2452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:4772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:5428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:2436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:5760
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:3748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:4432
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:2512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:1724
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:2996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:5460
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:3792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:4480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:4684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:4996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .1⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exeC:\Users\Admin\AppData\Local\Temp\gfbtqhytoghwbozbebcb.exe .2⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\gfbtqhytoghwbozbebcb.exe*."3⤵PID:4956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:2204
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:5616
-
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:5212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe1⤵PID:1312
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe2⤵PID:3256
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:4552
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:5504
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:3556
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:6016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:3032
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:3852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe .1⤵PID:2524
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe .2⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\snftmzmduifqrahf.exe*."3⤵PID:5360
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:228
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:5056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:4772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c snftmzmduifqrahf.exe1⤵PID:4744
-
C:\Windows\snftmzmduifqrahf.exesnftmzmduifqrahf.exe2⤵PID:5788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe .2⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\snftmzmduifqrahf.exe*."3⤵PID:5064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵PID:1752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:6084
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:4996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:1044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:5604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe1⤵PID:3416
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe2⤵PID:5044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe .2⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:2824
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:3756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe1⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe2⤵PID:2696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:4056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe1⤵PID:368
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:5884
-
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe2⤵PID:5480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .2⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\ifzpkzohaqpcfqzzav.exe*."3⤵PID:2712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe1⤵PID:1072
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe2⤵PID:2808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ifzpkzohaqpcfqzzav.exe .1⤵PID:4992
-
C:\Windows\ifzpkzohaqpcfqzzav.exeifzpkzohaqpcfqzzav.exe .2⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\ifzpkzohaqpcfqzzav.exe*."3⤵PID:3788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:552
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:1920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vvsljbtplegwcqcfjhjjg.exe .1⤵PID:4872
-
C:\Windows\vvsljbtplegwcqcfjhjjg.exevvsljbtplegwcqcfjhjjg.exe .2⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\vvsljbtplegwcqcfjhjjg.exe*."3⤵PID:1640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe1⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exeC:\Users\Admin\AppData\Local\Temp\vvsljbtplegwcqcfjhjjg.exe2⤵PID:5940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .1⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exeC:\Users\Admin\AppData\Local\Temp\trmdzpfztkkycoyzbxx.exe .2⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\trmdzpfztkkycoyzbxx.exe*."3⤵PID:1364
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe1⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exeC:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe2⤵PID:3344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .1⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exeC:\Users\Admin\AppData\Local\Temp\zvodxlzrjywikucbb.exe .2⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\users\admin\appdata\local\temp\zvodxlzrjywikucbb.exe*."3⤵PID:2512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zvodxlzrjywikucbb.exe1⤵PID:1724
-
C:\Windows\zvodxlzrjywikucbb.exezvodxlzrjywikucbb.exe2⤵PID:5156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe .1⤵PID:5064
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe .2⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\trmdzpfztkkycoyzbxx.exe*."3⤵PID:6020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c trmdzpfztkkycoyzbxx.exe1⤵PID:1372
-
C:\Windows\trmdzpfztkkycoyzbxx.exetrmdzpfztkkycoyzbxx.exe2⤵PID:4108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gfbtqhytoghwbozbebcb.exe .1⤵PID:1768
-
C:\Windows\gfbtqhytoghwbozbebcb.exegfbtqhytoghwbozbebcb.exe .2⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe"C:\Users\Admin\AppData\Local\Temp\wcycexrfgmi.exe" "c:\windows\gfbtqhytoghwbozbebcb.exe*."3⤵PID:1460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe1⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exeC:\Users\Admin\AppData\Local\Temp\snftmzmduifqrahf.exe2⤵PID:4504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ifzpkzohaqpcfqzzav.exe .1⤵PID:2384
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD5a39386ad0ee355920372cb9ab66d7414
SHA148b9c894ca8a2be8d62bbf84b96ea44a897feb56
SHA25693abced5d5b948384bd04532bb47156e0778a8de6c88a2474fca070b04c10bcd
SHA5128c79fcd96f64559d61f288247bf21468bca7e4d36b581891731b1e4773581902e440055671b2075dab45b55cd357130323a976552af05031ec5eb35a23a66be0
-
Filesize
272B
MD5ad8dcaf81dd808da9fe533fe9d8bbd80
SHA18b649e1ea16e8de8db53b26ad8f0ec6c96621dc3
SHA256b6c9310dcf061e42a77ff3cf211fcc2b74ed64620986de85f22ff823015b9e1e
SHA512c971cbb9456799938556131f1233762a3b92f6da339c3e2a03f899aba870fc0e23f79ca06796097d5939c2e05d13c312ed557690689b8e2baf2282234ba6e316
-
Filesize
272B
MD5c7c16ba0ad68623f27a47e2870957f8d
SHA18ea2254a3d2082029b85699fa22a316a797a38ac
SHA256d997339a8d65d293bbdf06a018db13764ab64cbd4b9df413b9642e6d6dc3dc98
SHA5124252fdd0517d7a0f232fe1e448c6bd4e99c98443f09762c3819548269ad0c4ffdb5e721c4ad0a1bc5320203610cad7127c07f23a8951b5ff14a8e24173a1babe
-
Filesize
272B
MD5955bab5ab702922791a2c5ccd7a6a042
SHA17d1329240a84e679c654ec97868907453782560a
SHA2561ad3331e039f0770c1aef349746f18c525a0d1e47dcf1c95ad7e920f3be30944
SHA51247ae8252369292db8184b11c803237883ef50684b9154df9060776b6023d9461e3f914f583d2d55b7668f90b93351045c1186624b949d74eaa6b64e6b8f8e8d4
-
Filesize
272B
MD50634c50b7a388fadd8d1148a7369cef9
SHA1008b3741e8838cf4d1867d8833c579d4caa65a4b
SHA2567384078b38fc80757a00d49c6ded146ca46b0004dc71cbbcef345992ef0213f3
SHA512193980ab6fd46fc6811e21c239d3d3ef9a461d8de0df72bb9700c178ee32c5aa4eca2af1dd68b83160a5ee627e3b281d9785276beee24d0be331c6a57fde866b
-
Filesize
272B
MD58cb2728e73cf33d8da212cd8cb16962f
SHA16046fbba156bea7e394587a7796af8d1626131a4
SHA25635d3310b53829a2d6e3ae2bfc63ec500f52c43491eaec6171eb4d5e26a3a3645
SHA5128a8f8232cbfeda194cdb502af07dd5a94151790e0ef48d32c2be52b5ad04887c142a83facb7ba53980548b3a754bb8ed4ccbbfbe37516608c06e30d7f2c68225
-
Filesize
712KB
MD5d54c839cd3f9c13e2f65b9fea53f68d9
SHA138963222841896b25b894d08633ddee057f07b5a
SHA2566c8fd7f119877cd7260d19fe38d1a2d4c60bf2da15175b509ba0fb67cc007385
SHA512809fca4f57a68c2210568348e273ebcb122fd0836523b06e5b06afab2e8d81e73b18cc970d53d5b1a3474013c95906ac53f6bc87ee1d8351428597a373352989
-
Filesize
320KB
MD51dd5dd5561723f37ccc81e15ecdbf830
SHA1eeb9131c8d276ceb710d163e89fdc62b3e111971
SHA256c8c542ac3f6526d1501c2b9d6262bfa029a1ac0d9dd6b3c1965977abdd8bd126
SHA512b4881d7cd0c2ceeba067e13d23763e739389108d1269acd6c343dd308aa1fedde89da696a8482944342f44ea1094ea6b50021a15d4c6d03762ba032a9598bba5
-
Filesize
272B
MD597b42c4faf2850d9df9fcb3a90ca8d75
SHA11375d516cedd32960692efbe3da1e91f520383bb
SHA256000bd95d7682a752284b4a8aa594319d5edb4a51eb2931aa3e3ff4d021d2d6bd
SHA512f0e27d8fe1ee8f1adbf88d6a02785ed3ec96dbe9c4c924d2213e38a9e4604ccfce0172541449b7e17eb12d0113368127cacf0a83b28e46b0f23c1096fd585910
-
Filesize
3KB
MD5e1836595a7c814a2d4fed52db60166a0
SHA1441368a8e5031d330a1ce1a1fe13030a12005923
SHA25661c0601ecb78a18508ff1b47e9bd2d4908dca07908a2878fd494714017f3b869
SHA5125aa7c0ecb627dff68b1c54b4e04c965eb2473f1586e0061ec4c6dcb9b817b292d620283cf159b3a97ae770f9bb47e39dba3766a8aef0f9c3dc9af983b70c44d9
-
Filesize
832KB
MD5c45c7c3be165367d7676c127dbdc2050
SHA10ca4bbd08beb9ce9e8bd6807113345389aa07588
SHA2567be6ccadfe39aff45029a30fe34b3c87ac49ebbad791c34e2ff8bb30e7e07721
SHA512d0aa1e6158da64512f9098ed1ae8d33d1882a1c23fb2c7bbbc3a3c0e331355d24dc302ef4f5b778d17f952fdd93adfd5e77fc81c73c5b119793b398edb43bbb3