netwire | ad902cad4ec5f7457b5ff521631739e506a5207e8475980b5c408b190a39ff3b

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.CMY3U.wm.exe
Size 309KB
Sample261018-13q2lsbs21
SHA256 ad902cad4ec5f7457b5ff521631739e506a5207e8475980b5c408b190a39ff3b
MD5 fa2da1ec0dabf6700bc265af95d017bd
SHA1 f4ee53a4c3b0b3a4e44a50fa80a214bd59179b54
SHA512 919d79e654ed05a0004a69759b6721984426a2394a84c7b5ecb939c09b01ea81b642414dbda790d9d265eaeb67fe306aac92fbcd2044f6519c27b38e947ce9dd
SSDEEP 6144:f9gFQQZp06ZyWgv33YBsOdoZVEfoMVHZvrUZ:1glnjZHgvnQsOTfoMVRrUZ
TLSH
T166645A99B702329ECC57C0F18A949F6CAE962F670F06C1D36853E5C9A93C587FE140B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery netwire persistence rat stealer upx

Malware Config

Extracted

Family

netwire

185.227.83.45:3380

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Victors
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/4276-12-0x0000000000400000-0x000000000042F000-memory.dmp	netwire
behavioral1/memory/4276-36-0x0000000000400000-0x000000000042F000-memory.dmp	netwire

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 4276	1416	firefox.exe	91
PID 3328 set thread context of 4460	3328	firefox.exe	104

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4276-7-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/4276-10-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/4276-12-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/4276-36-0x0000000000400000-0x000000000042F000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4256	jaffacakes118_Trojan.Win32.CMY3U.wm.exe
4256	jaffacakes118_Trojan.Win32.CMY3U.wm.exe
1416	firefox.exe
1416	firefox.exe
3328	firefox.exe
3328	firefox.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4256	jaffacakes118_Trojan.Win32.CMY3U.wm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	jaffacakes118_Trojan.Win32.CMY3U.wm.exe
Token: SeDebugPrivilege	1416	firefox.exe
Token: SeDebugPrivilege	3328	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5016	4256	jaffacakes118_Trojan.Win32.CMY3U.wm.exe	85
PID 5016 wrote to memory of 1416	5016	cmd.exe	87
PID 1416 wrote to memory of 4804	1416	firefox.exe	88
PID 4804 wrote to memory of 3872	4804	cmd.exe	90
PID 1416 wrote to memory of 4276	1416	firefox.exe	91
PID 1416 wrote to memory of 4276	1416	firefox.exe	91
PID 1416 wrote to memory of 4276	1416	firefox.exe	91
PID 1416 wrote to memory of 4276	1416	firefox.exe	91
PID 1416 wrote to memory of 2728	1416	firefox.exe	92
PID 2728 wrote to memory of 2504	2728	cmd.exe	94
PID 1664 wrote to memory of 1476	1664	cmd.exe	97
PID 1664 wrote to memory of 1864	1664	cmd.exe	98
PID 1864 wrote to memory of 3328	1864	cmd.exe	99
PID 3328 wrote to memory of 2856	3328	firefox.exe	100
PID 2856 wrote to memory of 1816	2856	cmd.exe	102
PID 3328 wrote to memory of 1684	3328	firefox.exe	103
PID 3328 wrote to memory of 4460	3328	firefox.exe	104
PID 3328 wrote to memory of 4460	3328	firefox.exe	104
PID 3328 wrote to memory of 4460	3328	firefox.exe	104
PID 3328 wrote to memory of 4460	3328	firefox.exe	104
PID 3328 wrote to memory of 3324	3328	firefox.exe	105
PID 3324 wrote to memory of 1856	3324	cmd.exe	107
PID 1416 wrote to memory of 3056	1416	firefox.exe	110
PID 3056 wrote to memory of 876	3056	cmd.exe	112
PID 3328 wrote to memory of 3136	3328	firefox.exe	115
PID 3136 wrote to memory of 4584	3136	cmd.exe	117
PID 1416 wrote to memory of 4768	1416	firefox.exe	118
PID 4768 wrote to memory of 4544	4768	cmd.exe	120
PID 3328 wrote to memory of 3088	3328	firefox.exe	121
PID 3088 wrote to memory of 3300	3088	cmd.exe	123
PID 1416 wrote to memory of 1568	1416	firefox.exe	125
PID 1568 wrote to memory of 1552	1568	cmd.exe	127
PID 3328 wrote to memory of 2360	3328	firefox.exe	128
PID 2360 wrote to memory of 3728	2360	cmd.exe	130
PID 1416 wrote to memory of 528	1416	firefox.exe	131
PID 528 wrote to memory of 1772	528	cmd.exe	133
PID 3328 wrote to memory of 2812	3328	firefox.exe	136
PID 2812 wrote to memory of 5020	2812	cmd.exe	138
PID 1416 wrote to memory of 2724	1416	firefox.exe	139
PID 2724 wrote to memory of 2404	2724	cmd.exe	141
PID 3328 wrote to memory of 3216	3328	firefox.exe	142
PID 3216 wrote to memory of 2292	3216	cmd.exe	144
PID 1416 wrote to memory of 2768	1416	firefox.exe	145
PID 2768 wrote to memory of 4772	2768	cmd.exe	147
PID 3328 wrote to memory of 3480	3328	firefox.exe	148
PID 3480 wrote to memory of 3952	3480	cmd.exe	150
PID 1416 wrote to memory of 3408	1416	firefox.exe	151
PID 3408 wrote to memory of 2760	3408	cmd.exe	153
PID 3328 wrote to memory of 1680	3328	firefox.exe	154
PID 1680 wrote to memory of 4608	1680	cmd.exe	156
PID 1416 wrote to memory of 2644	1416	firefox.exe	157
PID 2644 wrote to memory of 2192	2644	cmd.exe	159
PID 3328 wrote to memory of 3148	3328	firefox.exe	160
PID 3148 wrote to memory of 2888	3148	cmd.exe	162
PID 1416 wrote to memory of 1480	1416	firefox.exe	163
PID 1480 wrote to memory of 4504	1480	cmd.exe	165
PID 3328 wrote to memory of 3868	3328	firefox.exe	166
PID 3868 wrote to memory of 1728	3868	cmd.exe	168
PID 1416 wrote to memory of 2956	1416	firefox.exe	169
PID 2956 wrote to memory of 2164	2956	cmd.exe	171
PID 3328 wrote to memory of 1932	3328	firefox.exe	172
PID 1932 wrote to memory of 3944	1932	cmd.exe	174
PID 1416 wrote to memory of 2032	1416	firefox.exe	175
PID 2032 wrote to memory of 2200	2032	cmd.exe	177

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.CMY3U.wm.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.CMY3U.wm.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Roaming\mozilla firefox\firefox.exe
    "C:\Users\Admin\AppData\Roaming\mozilla firefox\firefox.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3872
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Roaming\mozilla firefox\firefox.exe"
      4⤵
      PID:4276
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:876
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4544
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1552
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:528
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2404
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2760
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2192
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4504
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2164
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2200
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4716
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4236
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:364
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3140
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3360
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:456
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:5056
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4972
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4392
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1616
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4932
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:5036
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3908
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2820
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2468
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1640
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1728
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2464
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2376
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2764
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3504
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1220
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2300
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2940
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1676
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2304
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1364
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4324
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2192
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3464
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2332
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3140
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3084
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1780
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1748
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3048
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4784
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:984
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4660
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4352
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2984
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:5056
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4608
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:808
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:972
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4764
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1784
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3808
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4336
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2836
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:748
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4324
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3908
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3648
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4396
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1832
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2584
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1012
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1144
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4600
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1356
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2264
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4900
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:5048
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4144
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1272
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3952
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1752
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:5064
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2140
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4120
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:8
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4272
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4644
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4504
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4904
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:772
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4700
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4380
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3292
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1088
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2332
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4152
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4488
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2352
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1852
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4724
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1892
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4268
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2480
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1056
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2212
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1808
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3912
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2408
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4476
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:884
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:620
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2288
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1728
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1048
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:888
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1180
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4316
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:100
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:464

C:\Windows\system32\cmd.exe
"cmd /c type C:\Users\Admin\AppData\Local\Temp\Update.txt | cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\Update.txt "
  2⤵
  PID:1476
- C:\Windows\system32\cmd.exe
  cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Users\Admin\AppData\Roaming\mozilla firefox\firefox.exe
    "C:\Users\Admin\AppData\Roaming\mozilla firefox\firefox.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1816
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Roaming\mozilla firefox\firefox.exe"
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Roaming\mozilla firefox\firefox.exe"
      4⤵
      PID:4460
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3324
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1856
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3136
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4584
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3088
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3300
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3728
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:5020
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3216
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2292
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3952
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1680
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4608
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3148
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2888
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1728
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3944
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4448
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4328
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3168
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:436
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4168
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:824
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1484
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4224
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1872
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3792
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1868
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3276
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4348
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3012
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2192
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1736
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1752
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:744
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4116
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:5008
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4984
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4892
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3544
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4996
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2312
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2580
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2568
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3908
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4036
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3096
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:452
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3824
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:732
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4964
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4676
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1156
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1812
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2000
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2500
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2180
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4712
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:5048
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1808
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4236
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4508
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3992
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2368
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4160
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5076
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2424
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3392
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4332
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2412
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3368
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:628
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4476
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3476
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1672
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4352
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4548
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4612
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1856
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1748
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:888
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4364
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2940
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1656
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3196
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2836
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:440
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2760
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2200
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1496
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:4788
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4916
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2556
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1732
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3960
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4260
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3684
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:5028
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4536
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4452
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3356
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3016
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4812
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3592
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1208
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3336
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:556
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:4672
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1324
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2240
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1144
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:5040
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4560
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:3796
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1880
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2472
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2220
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:2332
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4928
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5020
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:3772
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:5092
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1352
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.txt

Path C:\Users\Admin\AppData\Local\Temp\Update.txt
Size 70B
SHA256 20912c8103e6fa999131781ff70c22da11e1c4f6032b3cfe2414e9911310bb63
MD5 63b35170ddaf121ae8f24c453b43f529
SHA1 44c32ee0a0db6c7b1db964025e308c8e3bd856e3
SHA512 a1b3dc891c83cf1e67e4673063a9116a0847dc2e307e0061a91d88e7bc42882b8073e62fde48ce431a452535f2cbded0f824cd459ead0baa4a68066e64210874
TLSH
T1BEA0220382C8C2CE0C03802323B2B88E00E383803A802020C3000A8A20C8B80B0FCB00
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1416-4-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/1416-5-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/1416-31-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4256-0-0x00000000010C0000-0x00000000010D0000-memory.dmp

Download

memory/4256-1-0x0000000074B92000-0x0000000074B94000-memory.dmp

Download

memory/4276-7-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4276-10-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4276-12-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4276-36-0x0000000000400000-0x000000000042F000-memory.dmp

Download