Cuckoo Sandbox

be6b1d2c2d620cef_Windowsdef.txt "C:\Users\Administrator\AppData\Local\Temp\be6b1d2c2d620cef_Windowsdef.txt"
1928
- cmd.exe cmd /c ""C:\Users\ADMINI~1\AppData\Local\Temp\uyhZp.bat" "
  1712
  - reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Administrator\AppData\Roaming\Directory\Windowsdef.exe" /f
    1120

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default file network process services registry synchronisation iexplore office pdf

Cuckoo

We're processing your submission... This could take a few seconds.