Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 16:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe
- Size 4.2MB
- Sample260804-tltmvadd62
- SHA256 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201
- MD5 d713f2e3b6233abd21dc31ce75ffdd03
- SHA1 4ffb8d4b65b504d3304645e8dacc1ff0b6fa1e4d
- SHA512 436fdc7c075791e6829efead8eef7a871c25179d2cb6f3284bab0baaf18d3bf3be2e14656744be0f4c520d258ec788dde14ecf6aa8bc52f3b995d924cd8c03c4
- SSDEEP 98304:wGs9KtY58zdogbD4wVAXsUoFY5L3fVEZe5c6lXrT7Nh6vkQNc:wb5DVE2l1
- TLSH T1DD264A42BECB0DE6DEC627B430D372367338FD658A9D5E2B7A04C93465136C0AD2AB45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Blocks application from running via registry modification 64 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\27 = "SystemPropertiesProtection.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\42 = "netplwiz.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\57 = "cscript.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "secpol.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\35 = "resmon.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\36 = "taskschd.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\38 = "printmanagement.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\40 = "comexp.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\55 = "diskpart.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\32 = "SndVol.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\34 = "msra.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\41 = "azman.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "wmimgmt.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\45 = "verifier.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\60 = "wbemtest.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "devmgmt.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\46 = "odbcad32.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\53 = "net1.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\58 = "powershell_ise.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\63 = "write.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "compmgmt.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\33 = "mstsc.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\54 = "bcdedit.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\56 = "wscript.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "eventvwr.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "taskmgr.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "certmgr.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "control.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "lusrmgr.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "eventvwr.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\29 = "SystemPropertiesPerformance.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\31 = "WindowsSecurity.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\61 = "notepad.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\62 = "wordpad.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "cmd.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "services.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "dfrgui.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "cleanmgr.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\43 = "msinfo32.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\50 = "runas.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "perfmon.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "msconfig.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\26 = "SystemPropertiesAdvanced.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\47 = "cacls.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\59 = "wmic.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\30 = "SystemSettings.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\37 = "fsmgmt.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\39 = "wf.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\44 = "sigverif.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\48 = "icacls.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\49 = "takeown.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "perfmon.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "regedit.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "regedt32.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "reg.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "pwsh.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "diskmgmt.msc" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\64 = "mspaint.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "mmc.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\28 = "SystemPropertiesRemote.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\51 = "sc.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\65 = "calc.exe" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe - Disables Task Manager via registry modification
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6112 cmd.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5732 wrote to memory of 6112 5732 8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe"C:\Users\Admin\AppData\Local\Temp\8f97884e824acff63040b93acd3ba9e8e9eea3f3da1799f5a5d3a1a9bae70201.exe"1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
- Executes a command shell one-liner
PID:6112
-