Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
24-02-2021 23:50
Static task
static1
Behavioral task
behavioral1
Sample
sample31.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
sample31.exe
Resource
win10v20201028
General
-
Target
sample31.exe
-
Size
532KB
-
MD5
ec85dd4cc9423d9b2c4b006d597739cb
-
SHA1
49e68aeaa48bac451f082bd1bd1c7c52d1f17f61
-
SHA256
002dafd16a8e118d9f2e5e48f6d212a3b68407aed511147fd85ad97ac3502cd8
-
SHA512
3e5e9ee7a5fb22d0aa90a8610ba74cda38aee60a909e5aea37673001238601f99b3ec0fbbcd4569417f2c11560f82f894950ebe68f00ed2740175156717569b8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
sample31.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\JAQgEgYI\\tsMgcIoM.exe," sample31.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\JAQgEgYI\\tsMgcIoM.exe," sample31.exe -
Modifies visibility of file extensions in Explorer 2 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
YUYEwcAM.exetsMgcIoM.exeXqUAEYYE.exepid process 1972 YUYEwcAM.exe 904 tsMgcIoM.exe 1412 XqUAEYYE.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
tsMgcIoM.exedescription ioc process File created C:\Users\Admin\Pictures\UnregisterTest.png.exe tsMgcIoM.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tsMgcIoM.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\International\Geo\Nation tsMgcIoM.exe -
Loads dropped DLL 16 IoCs
Processes:
sample31.exetsMgcIoM.exepid process 1636 sample31.exe 1636 sample31.exe 1636 sample31.exe 1636 sample31.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
sample31.exeYUYEwcAM.exetsMgcIoM.exeXqUAEYYE.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\YUYEwcAM.exe = "C:\\Users\\Admin\\fqMgUMkA\\YUYEwcAM.exe" sample31.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tsMgcIoM.exe = "C:\\ProgramData\\JAQgEgYI\\tsMgcIoM.exe" sample31.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\YUYEwcAM.exe = "C:\\Users\\Admin\\fqMgUMkA\\YUYEwcAM.exe" YUYEwcAM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tsMgcIoM.exe = "C:\\ProgramData\\JAQgEgYI\\tsMgcIoM.exe" tsMgcIoM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tsMgcIoM.exe = "C:\\ProgramData\\JAQgEgYI\\tsMgcIoM.exe" XqUAEYYE.exe -
Processes:
sample31.exesample31.exesample31.execmd.execmd.execmd.execmd.execmd.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sample31.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sample31.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sample31.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sample31.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sample31.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sample31.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe -
Drops file in System32 directory 2 IoCs
Processes:
XqUAEYYE.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\fqMgUMkA XqUAEYYE.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\fqMgUMkA\YUYEwcAM XqUAEYYE.exe -
Drops file in Windows directory 1 IoCs
Processes:
tsMgcIoM.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico tsMgcIoM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1656 reg.exe 1760 reg.exe 1864 reg.exe 756 reg.exe 1036 reg.exe 1888 reg.exe 952 reg.exe 660 reg.exe 1656 reg.exe 1036 reg.exe 440 reg.exe 1292 reg.exe 1232 reg.exe 1232 reg.exe 1184 reg.exe 1036 reg.exe 1516 reg.exe 300 reg.exe 2020 reg.exe 872 reg.exe 1184 reg.exe 2020 reg.exe 268 reg.exe 564 reg.exe 524 reg.exe 1760 reg.exe 1328 reg.exe 1516 reg.exe 324 reg.exe 2032 reg.exe 572 reg.exe 984 reg.exe 1828 reg.exe 1052 reg.exe 1960 reg.exe 1688 reg.exe 1640 reg.exe 1960 reg.exe 1828 reg.exe 1056 reg.exe 1832 reg.exe 976 reg.exe 836 reg.exe 1732 reg.exe 808 reg.exe 1804 reg.exe 1636 reg.exe 2032 reg.exe 1280 reg.exe 808 reg.exe 976 reg.exe 288 reg.exe 1832 reg.exe 2032 reg.exe 1012 reg.exe 660 reg.exe 688 reg.exe 2032 reg.exe 2032 reg.exe 1292 reg.exe 1796 reg.exe 1460 reg.exe 1788 reg.exe 400 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sample31.exesample31.exesample31.exesample31.exesample31.exesample31.exesample31.exesample31.exesample31.exesample31.exesample31.execonhost.execmd.execonhost.exereg.execscript.exesample31.exesample31.exereg.execonhost.execonhost.exesample31.exereg.exesample31.exesample31.exesample31.execonhost.exesample31.execonhost.exereg.exepid process 1636 sample31.exe 1636 sample31.exe 1828 sample31.exe 1828 sample31.exe 660 sample31.exe 660 sample31.exe 1456 sample31.exe 1456 sample31.exe 1380 sample31.exe 1380 sample31.exe 1732 sample31.exe 1732 sample31.exe 1036 sample31.exe 1036 sample31.exe 752 sample31.exe 752 sample31.exe 1476 sample31.exe 1476 sample31.exe 1620 sample31.exe 1620 sample31.exe 548 sample31.exe 548 sample31.exe 1976 1976 300 conhost.exe 300 conhost.exe 1732 1732 548 cmd.exe 548 cmd.exe 1280 conhost.exe 1280 conhost.exe 872 reg.exe 872 reg.exe 1832 cscript.exe 1832 cscript.exe 1760 sample31.exe 1760 sample31.exe 528 sample31.exe 528 sample31.exe 836 reg.exe 836 reg.exe 572 conhost.exe 572 conhost.exe 316 conhost.exe 316 conhost.exe 872 sample31.exe 872 sample31.exe 976 reg.exe 976 reg.exe 1960 sample31.exe 1960 sample31.exe 1636 sample31.exe 1636 sample31.exe 1828 sample31.exe 1828 sample31.exe 1960 conhost.exe 1960 conhost.exe 1888 sample31.exe 1888 sample31.exe 1084 conhost.exe 1084 conhost.exe 1036 reg.exe 1036 reg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
tsMgcIoM.exepid process 904 tsMgcIoM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
tsMgcIoM.exepid process 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe 904 tsMgcIoM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
sample31.execmd.exesample31.execmd.execmd.exesample31.execmd.exedescription pid process target process PID 1636 wrote to memory of 1972 1636 sample31.exe YUYEwcAM.exe PID 1636 wrote to memory of 1972 1636 sample31.exe YUYEwcAM.exe PID 1636 wrote to memory of 1972 1636 sample31.exe YUYEwcAM.exe PID 1636 wrote to memory of 1972 1636 sample31.exe YUYEwcAM.exe PID 1636 wrote to memory of 904 1636 sample31.exe tsMgcIoM.exe PID 1636 wrote to memory of 904 1636 sample31.exe tsMgcIoM.exe PID 1636 wrote to memory of 904 1636 sample31.exe tsMgcIoM.exe PID 1636 wrote to memory of 904 1636 sample31.exe tsMgcIoM.exe PID 1636 wrote to memory of 1056 1636 sample31.exe cmd.exe PID 1636 wrote to memory of 1056 1636 sample31.exe cmd.exe PID 1636 wrote to memory of 1056 1636 sample31.exe cmd.exe PID 1636 wrote to memory of 1056 1636 sample31.exe cmd.exe PID 1056 wrote to memory of 1828 1056 cmd.exe sample31.exe PID 1056 wrote to memory of 1828 1056 cmd.exe sample31.exe PID 1056 wrote to memory of 1828 1056 cmd.exe sample31.exe PID 1056 wrote to memory of 1828 1056 cmd.exe sample31.exe PID 1636 wrote to memory of 268 1636 sample31.exe reg.exe PID 1636 wrote to memory of 268 1636 sample31.exe reg.exe PID 1636 wrote to memory of 268 1636 sample31.exe reg.exe PID 1636 wrote to memory of 268 1636 sample31.exe reg.exe PID 1636 wrote to memory of 564 1636 sample31.exe reg.exe PID 1636 wrote to memory of 564 1636 sample31.exe reg.exe PID 1636 wrote to memory of 564 1636 sample31.exe reg.exe PID 1636 wrote to memory of 564 1636 sample31.exe reg.exe PID 1636 wrote to memory of 636 1636 sample31.exe reg.exe PID 1636 wrote to memory of 636 1636 sample31.exe reg.exe PID 1636 wrote to memory of 636 1636 sample31.exe reg.exe PID 1636 wrote to memory of 636 1636 sample31.exe reg.exe PID 1828 wrote to memory of 440 1828 sample31.exe cmd.exe PID 1828 wrote to memory of 440 1828 sample31.exe cmd.exe PID 1828 wrote to memory of 440 1828 sample31.exe cmd.exe PID 1828 wrote to memory of 440 1828 sample31.exe cmd.exe PID 440 wrote to memory of 660 440 cmd.exe sample31.exe PID 440 wrote to memory of 660 440 cmd.exe sample31.exe PID 440 wrote to memory of 660 440 cmd.exe sample31.exe PID 440 wrote to memory of 660 440 cmd.exe sample31.exe PID 1828 wrote to memory of 976 1828 sample31.exe reg.exe PID 1828 wrote to memory of 976 1828 sample31.exe reg.exe PID 1828 wrote to memory of 976 1828 sample31.exe reg.exe PID 1828 wrote to memory of 976 1828 sample31.exe reg.exe PID 1828 wrote to memory of 572 1828 sample31.exe reg.exe PID 1828 wrote to memory of 572 1828 sample31.exe reg.exe PID 1828 wrote to memory of 572 1828 sample31.exe reg.exe PID 1828 wrote to memory of 572 1828 sample31.exe reg.exe PID 1828 wrote to memory of 984 1828 sample31.exe reg.exe PID 1828 wrote to memory of 984 1828 sample31.exe reg.exe PID 1828 wrote to memory of 984 1828 sample31.exe reg.exe PID 1828 wrote to memory of 984 1828 sample31.exe reg.exe PID 1828 wrote to memory of 1280 1828 sample31.exe cmd.exe PID 1828 wrote to memory of 1280 1828 sample31.exe cmd.exe PID 1828 wrote to memory of 1280 1828 sample31.exe cmd.exe PID 1828 wrote to memory of 1280 1828 sample31.exe cmd.exe PID 1280 wrote to memory of 1924 1280 cmd.exe cscript.exe PID 1280 wrote to memory of 1924 1280 cmd.exe cscript.exe PID 1280 wrote to memory of 1924 1280 cmd.exe cscript.exe PID 1280 wrote to memory of 1924 1280 cmd.exe cscript.exe PID 660 wrote to memory of 1316 660 sample31.exe cmd.exe PID 660 wrote to memory of 1316 660 sample31.exe cmd.exe PID 660 wrote to memory of 1316 660 sample31.exe cmd.exe PID 660 wrote to memory of 1316 660 sample31.exe cmd.exe PID 1316 wrote to memory of 1456 1316 cmd.exe sample31.exe PID 1316 wrote to memory of 1456 1316 cmd.exe sample31.exe PID 1316 wrote to memory of 1456 1316 cmd.exe sample31.exe PID 1316 wrote to memory of 1456 1316 cmd.exe sample31.exe -
System policy modification 1 TTPs 16 IoCs
Processes:
cmd.execmd.exesample31.execmd.execmd.exesample31.exesample31.execmd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sample31.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System sample31.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System sample31.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System sample31.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sample31.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sample31.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample31.exe"C:\Users\Admin\AppData\Local\Temp\sample31.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\fqMgUMkA\YUYEwcAM.exe"C:\Users\Admin\fqMgUMkA\YUYEwcAM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\JAQgEgYI\tsMgcIoM.exe"C:\ProgramData\JAQgEgYI\tsMgcIoM.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample313⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample315⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample317⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"8⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample319⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"10⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3111⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"12⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3113⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"14⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3115⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"16⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3117⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dqscAcwE.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"18⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dMMYAcgg.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\OUwUwUsY.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\askYsIoI.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GqYQsQgQ.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hsUIowss.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dYgYkYgk.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XqkMEkQg.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample313⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"4⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample315⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"6⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample317⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"8⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample319⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"10⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"12⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"14⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"16⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3117⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"18⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"20⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3121⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"22⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3123⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"24⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"26⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"28⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"30⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3131⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"32⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"34⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"36⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3137⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"38⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3139⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"40⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3141⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"42⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"44⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"46⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"48⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3149⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"50⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"52⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"54⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"56⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"58⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"60⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"62⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"64⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"66⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"68⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"70⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3171⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"72⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"74⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"76⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"78⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"80⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"82⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"84⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"86⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"88⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"90⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"92⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"94⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"96⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"98⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample3199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"100⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample31101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"102⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample31103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"104⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample31105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"106⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample31107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"108⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample31109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"110⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample31111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sample31"112⤵
-
C:\Users\Admin\AppData\Local\Temp\sample31.exeC:\Users\Admin\AppData\Local\Temp\sample31113⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1114⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2114⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f114⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1112⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\oYAYckwQ.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""112⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs113⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f112⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2112⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1110⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sSkgEAMo.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""110⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs111⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f110⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2110⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XiUskYwc.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""108⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs109⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tGUcAcgI.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""106⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\zOcAEQUc.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""104⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hcwUUEUc.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""102⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\AwYkIUoM.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""100⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ASIoQkkc.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""98⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\eawUEoAQ.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""96⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\gwgcsoQs.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mEUUsoEE.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\DGccIUks.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""90⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\nKQoAkIo.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LCgosgUI.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""86⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RoQAMEIs.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""84⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\USIwUcEI.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""82⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\iUssokYM.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""80⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\kssocIMI.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""78⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\eaoUAoIA.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\UEwwkIwo.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""74⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FiQQMYcU.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JyggwMko.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\lwAEoUYM.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\vaAIcYME.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ggkEEwIk.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\IYcowcIk.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\kcswMosM.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""60⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\wyUokMkY.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\isUYUkoY.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dGQUkAcQ.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""54⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dIosogoo.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""52⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- Modifies registry key
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FAcEYEEk.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\vYswkwcg.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LycUkMsk.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SWMUMogs.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\aagsMMYw.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\YuEUcgYI.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\YOEEkUAw.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\yokAIMEg.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jSIMYAsc.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ZWckMQcE.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies registry key
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\TYcowkQU.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dAQkIwkE.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\MOcEAUcM.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\qAMUcIwQ.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\yEAMAoUo.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\iwEQIQEM.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\yGUkgQoE.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FUgoUscA.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\pEMcwkEU.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\pmUAUocI.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FGIsQkME.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EegIwUMk.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\gaIcEEkU.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CAUwUUUU.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\rsMYcYsI.bat" "C:\Users\Admin\AppData\Local\Temp\sample31.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\ProgramData\CCYEIUwI\XqUAEYYE.exeC:\ProgramData\CCYEIUwI\XqUAEYYE.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "448338002705606102245794920-956182012-14970473091273131251776888237-148930206"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-9713911601067468970-1382429686-27073023-1098247957-119408664-315786444-692195156"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1690671017-8685253901068513481-268039965-854083321-13963406487036995672111375743"1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "833733702-20824241551073313518471908202-4077726371139236266998347637-470772762"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "40253396616943099641728733827-3826341001772774091-19742175821722545661291275520"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1967162369-7723051341201667422715683856-10088887951235634710436362953-468909638"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-12394526611945081497428264133-482082454330472548-1735331340-1924304342-198714127"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1633956051762063631-1393033022-187442895318435307422311830481348411899-1691117409"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "12438242249881035451901856542-1200631573169022448-1533929323-534474848454649407"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "43297913857223030-109218685679387057237042406113887848431179974700728403862"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1303116703-19081160361223983431612586144-2107181214-1865107832-1685290435-768489084"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-542141967-1723828855217843622-1891229593-2007657439-1893563314-70528333-589489291"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1878367731787181732-2110622419-1190861906-712340039079714741164247832-790835762"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-18733632491668246926-1301681560-1477150879187131538511589550761754647953682055391"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1879068613-2908898894602401241101501378-1173630475420031414-13266919701827723915"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1063424334-119915368199760400-1991270463196198609019944404841983819795-1557404491"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-268926797895285074-4720304716259580263062219641728595958290762352-851422777"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "883315851-1516447638-12336316801825844188243822512255545738-2032283881348659707"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-756525250972843301529132242-2132739469-116990740-3888729762088732910-141007689"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1174896788391440893599404034-15490209181629192272-969445411468210609600011446"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1155837934461204156-918826055-1856263638-311524476-20371193721660145471170799282"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "40377404-1611242366-817426043225027713-1526908483-1707106889-6117273451346494003"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2421150551670819806-20584378821474137639993739290-8693913531898287207-942512231"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1379157689-10071740231433771927-1567655544-19502298021147834271475080614-614651837"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-388328371-2878662910190247431228627538-19843055111067950662-17971837-1646670974"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1661648417-46943986520314555441498413854-8485470691190526774455840912065695775"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "15647848151518764394684419125-1666926904-2010641841-711538770429035047-1226633505"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "940200524-3609163275325612511415640374-11742113320302441111846058060568806756"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1535127627-10255499092132711200-18986199991148510135799410086-720000315-1179362466"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "170859083918278785758214214661252462209807651777-1970568893-1757667669-976884887"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-14703306971551125946-1851083381-1694082180-13869373601241984992-156852676891465779"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-5614018451571805906681544784-181408655-1213606262180159326019321849232050767743"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-493982414-145362007612455408261818840771265631967-2094071481658382788529029836"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-4488831551961812002-1691429310-1990671813142921009810906879861421176155-555822047"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1231224766-1161529197-1805009100922225749-168101956111122328251626533614-1148733235"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1337670631-597433635100278467-1256044576-6895239818693779691889905207-1048009199"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1379437626-4704491681601668387-982792032-16038670011085158285-20121654061801583393"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2048984767-50955593296267756-522010408-7717770621652159680-1339056963844432999"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-495979388-1211332231-16320542081040897244190944755121146375891092733440-1572442782"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "551873731770985388790092135-1866087187-2073488161-4408438420206558201577333403"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1775672912-772479382545307071-1805312916-930417224147173185666757881-1400090532"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "18999112719155723910803905861101083692-121787359620475524371432747878-657954507"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "11772645231205335764203166603418800217151697130529-267446830-11563832451172827980"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2153929741600553974620816448-788679427-824349325108338382216330818491697052830"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1729421542267241001-612624147-1614305561-1898757895-309836369-663764506-1667652678"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "338604046-10977501073477229-439629270466394499335403624-2021385025-2050138028"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "669759794167412287018206392191877117090-698130496-1259334118-1132266831804660018"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1797106689-20678273311402396605810077985-1557759134672000600-414841751708157076"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-11955443120245091671402576560-209213128510123359251453247775-1394645210-234454384"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-107959160617430245221324729071879538968500097371-72807585977975722016990969"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-19355240071156258818-85688326514459635911053482327-12430092481535103783-1202791642"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-966516309-678426811-136750058-17695709171028872064-1067080086-3273411261121545119"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1861518001489070478-908877437739370632-978710820-10394090891785140423-1038952021"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-939936322-1552824817-1659144436-1304858324317233466297727049-2108147478513763343"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-179027022012473655105880894011315283930224357296-1903660322-7395119051237830292"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "269207376-940348266-2008808594524864275693488811-143142396455541929-1432665050"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1666350188-1403175884987952248-9601293736594016-264660915-6473466101831303046"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-17695483-100111348-1899020062-10920030516574603817933189251476515845926628736"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1286516082-1844522933-21144693391375164641-1161554138-18274527751069735727-807671107"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "203672993-1294085258-2095813702-1431859071141329937810792905821449235352-547608529"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2005197660297826505-414873242-1340341942-242332826-992484308659968718-715248411"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "201638734649215097798128848295899164938178981-16971534541621097996-213874680"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1376510595-2697357511978211272-282006607-735743594183678517798430074262368840"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-270670892173795657211049011231613548205-584704749-41196358484591640-1345695032"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-912380943653073571-1093690768-947018174-8418700351841651239-1643647566869629462"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1899450486-1322299611-815004352616262536-205031918643994817-504503050-1963615273"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "746569973-12394450373290921231722136407-12202389203067825-82999321-1973067640"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1017253795126661807314954402711807073843-21169632051314363510-2037719185-774320425"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "79937489021408558211505504473-1460684613-1665994812-118579534418232519081134395058"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\CCYEIUwI\XqUAEYYE.exeMD5
e538b90c250efcf49dec719a2066acf7
SHA1a651db7f7991cbbcfff5147531a8a30ad1060489
SHA2562d59c9737cce6557c77c791edea17312cdc7672ef45658fe31eb67c899bef5b7
SHA512cae6322cdf433b03ba1d0ad6672c1192c56a1ea159562847972d101b6df33f96871f753f3340285b906bdde200b0b587aaf00866f98b97f18e5c88074bef23e5
-
C:\ProgramData\JAQgEgYI\tsMgcIoM.exeMD5
6b6bf05848fc10af8e84e05161214b46
SHA1d0b12084e900be94ae2fa4d9a0c13cebd4ac743b
SHA2569ddd7fb20724922a24595275b79118b67c7ad072e29987195373c15bd3525f53
SHA512aca81f415f60e57093228dd06325d2535f3e78fa2f27d9737e035ab5e1d0be3e5509a7ff1eee36895764cea1d88e9d05837dbe3951b245df3698b780f69e0d80
-
C:\Users\Admin\AppData\Local\Temp\CAUwUUUU.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\EegIwUMk.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\FGIsQkME.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\GqYQsQgQ.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\OUwUwUsY.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\XqkMEkQg.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\askYsIoI.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\dMMYAcgg.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\dYgYkYgk.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\dqscAcwE.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\gaIcEEkU.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\hsUIowss.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\pmUAUocI.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\rsMYcYsI.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\AppData\Local\Temp\sample31MD5
477256402c581beed8f9aef56cebfb0a
SHA1af541187d2a0baaeb1329c6234c6007c5ef322f4
SHA256fec9aafbd19c3dacbec0b2b1168d0720bdbc510b53919b628de736d15971139b
SHA512c2d14818d3a7fe9e15627baf34527fe76213e5d515e6995a81349dfae262ee57af96850eb6c61f486870474b853237a35d85cb295b84eb9b62ba80595cbe5a85
-
C:\Users\Admin\fqMgUMkA\YUYEwcAM.exeMD5
c0c8ccabb62d689e8986dd09463b8736
SHA1e641a2321a485ea5c5a4f559634886c1dcccd147
SHA256d30c4152035bf7221fb59bb42033ffbc231d95acb70eaf96f19880b6e8c241ba
SHA5122dd4bb2f8a7e5520c294cf0f5e1c55527a7df42a921eff4144e31a5a4c05688d6e85452824d29bdf5ac8658dd06dfb00e3ac878ecfa9fb7aaacbaf7abe7dc6f0
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exeMD5
9d10f99a6712e28f8acd5641e3a7ea6b
SHA1835e982347db919a681ba12f3891f62152e50f0d
SHA25670964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc
SHA5122141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5
-
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exeMD5
4d92f518527353c0db88a70fddcfd390
SHA1c4baffc19e7d1f0e0ebf73bab86a491c1d152f98
SHA25697e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c
SHA51205a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452
-
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exeMD5
4d92f518527353c0db88a70fddcfd390
SHA1c4baffc19e7d1f0e0ebf73bab86a491c1d152f98
SHA25697e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c
SHA51205a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452
-
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXEMD5
a41e524f8d45f0074fd07805ff0c9b12
SHA1948deacf95a60c3fdf17e0e4db1931a6f3fc5d38
SHA256082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7
SHA51291bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f
-
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXEMD5
a41e524f8d45f0074fd07805ff0c9b12
SHA1948deacf95a60c3fdf17e0e4db1931a6f3fc5d38
SHA256082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7
SHA51291bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f
-
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exeMD5
c87e561258f2f8650cef999bf643a731
SHA12c64b901284908e8ed59cf9c912f17d45b05e0af
SHA256a1dfa6639bef3cb4e41175c43730d46a51393942ead826337ca9541ac210c67b
SHA512dea4833aa712c5823f800f5f5a2adcf241c1b2b6747872f540f5ff9da6795c4ddb73db0912593337083c7c67b91e9eaf1b3d39a34b99980fd5904ba3d7d62f6c
-
\ProgramData\JAQgEgYI\tsMgcIoM.exeMD5
6b6bf05848fc10af8e84e05161214b46
SHA1d0b12084e900be94ae2fa4d9a0c13cebd4ac743b
SHA2569ddd7fb20724922a24595275b79118b67c7ad072e29987195373c15bd3525f53
SHA512aca81f415f60e57093228dd06325d2535f3e78fa2f27d9737e035ab5e1d0be3e5509a7ff1eee36895764cea1d88e9d05837dbe3951b245df3698b780f69e0d80
-
\ProgramData\JAQgEgYI\tsMgcIoM.exeMD5
6b6bf05848fc10af8e84e05161214b46
SHA1d0b12084e900be94ae2fa4d9a0c13cebd4ac743b
SHA2569ddd7fb20724922a24595275b79118b67c7ad072e29987195373c15bd3525f53
SHA512aca81f415f60e57093228dd06325d2535f3e78fa2f27d9737e035ab5e1d0be3e5509a7ff1eee36895764cea1d88e9d05837dbe3951b245df3698b780f69e0d80
-
\Users\Admin\fqMgUMkA\YUYEwcAM.exeMD5
c0c8ccabb62d689e8986dd09463b8736
SHA1e641a2321a485ea5c5a4f559634886c1dcccd147
SHA256d30c4152035bf7221fb59bb42033ffbc231d95acb70eaf96f19880b6e8c241ba
SHA5122dd4bb2f8a7e5520c294cf0f5e1c55527a7df42a921eff4144e31a5a4c05688d6e85452824d29bdf5ac8658dd06dfb00e3ac878ecfa9fb7aaacbaf7abe7dc6f0
-
\Users\Admin\fqMgUMkA\YUYEwcAM.exeMD5
c0c8ccabb62d689e8986dd09463b8736
SHA1e641a2321a485ea5c5a4f559634886c1dcccd147
SHA256d30c4152035bf7221fb59bb42033ffbc231d95acb70eaf96f19880b6e8c241ba
SHA5122dd4bb2f8a7e5520c294cf0f5e1c55527a7df42a921eff4144e31a5a4c05688d6e85452824d29bdf5ac8658dd06dfb00e3ac878ecfa9fb7aaacbaf7abe7dc6f0
-
memory/268-65-0x0000000000000000-mapping.dmp
-
memory/268-18-0x0000000000000000-mapping.dmp
-
memory/288-36-0x0000000000000000-mapping.dmp
-
memory/288-123-0x0000000000000000-mapping.dmp
-
memory/288-182-0x0000000002650000-0x0000000002654000-memory.dmpFilesize
16KB
-
memory/288-129-0x0000000002690000-0x0000000002694000-memory.dmpFilesize
16KB
-
memory/288-90-0x0000000000000000-mapping.dmp
-
memory/300-115-0x0000000000000000-mapping.dmp
-
memory/316-280-0x0000000002810000-0x0000000002814000-memory.dmpFilesize
16KB
-
memory/316-202-0x00000000027C0000-0x00000000027C4000-memory.dmpFilesize
16KB
-
memory/400-75-0x0000000000000000-mapping.dmp
-
memory/436-287-0x0000000002880000-0x0000000002884000-memory.dmpFilesize
16KB
-
memory/440-277-0x0000000002820000-0x0000000002824000-memory.dmpFilesize
16KB
-
memory/440-22-0x0000000000000000-mapping.dmp
-
memory/460-193-0x0000000002770000-0x0000000002774000-memory.dmpFilesize
16KB
-
memory/524-154-0x00000000027E0000-0x00000000027E4000-memory.dmpFilesize
16KB
-
memory/524-112-0x0000000000000000-mapping.dmp
-
memory/564-19-0x0000000000000000-mapping.dmp
-
memory/564-178-0x0000000002720000-0x0000000002724000-memory.dmpFilesize
16KB
-
memory/564-292-0x0000000002810000-0x0000000002814000-memory.dmpFilesize
16KB
-
memory/572-200-0x0000000002500000-0x0000000002504000-memory.dmpFilesize
16KB
-
memory/572-165-0x00000000027B0000-0x00000000027B4000-memory.dmpFilesize
16KB
-
memory/572-26-0x0000000000000000-mapping.dmp
-
memory/636-20-0x0000000000000000-mapping.dmp
-
memory/636-111-0x0000000000000000-mapping.dmp
-
memory/660-23-0x0000000000000000-mapping.dmp
-
memory/660-54-0x0000000000000000-mapping.dmp
-
memory/688-191-0x0000000002680000-0x0000000002684000-memory.dmpFilesize
16KB
-
memory/748-102-0x0000000002640000-0x0000000002644000-memory.dmpFilesize
16KB
-
memory/748-88-0x0000000000000000-mapping.dmp
-
memory/748-164-0x0000000002630000-0x0000000002634000-memory.dmpFilesize
16KB
-
memory/748-38-0x0000000000000000-mapping.dmp
-
memory/748-316-0x00000000029A0000-0x00000000029A4000-memory.dmpFilesize
16KB
-
memory/752-85-0x0000000000000000-mapping.dmp
-
memory/752-290-0x0000000002660000-0x0000000002664000-memory.dmpFilesize
16KB
-
memory/752-239-0x0000000002750000-0x0000000002754000-memory.dmpFilesize
16KB
-
memory/808-107-0x0000000000000000-mapping.dmp
-
memory/808-72-0x0000000000000000-mapping.dmp
-
memory/836-52-0x0000000000000000-mapping.dmp
-
memory/836-308-0x0000000002810000-0x0000000002814000-memory.dmpFilesize
16KB
-
memory/872-269-0x0000000002850000-0x0000000002854000-memory.dmpFilesize
16KB
-
memory/872-305-0x0000000002620000-0x0000000002624000-memory.dmpFilesize
16KB
-
memory/872-295-0x0000000002800000-0x0000000002804000-memory.dmpFilesize
16KB
-
memory/880-91-0x0000000000000000-mapping.dmp
-
memory/880-176-0x00000000027C0000-0x00000000027C4000-memory.dmpFilesize
16KB
-
memory/904-10-0x0000000000000000-mapping.dmp
-
memory/912-257-0x0000000002680000-0x0000000002684000-memory.dmpFilesize
16KB
-
memory/912-302-0x00000000025C0000-0x00000000025C4000-memory.dmpFilesize
16KB
-
memory/912-236-0x0000000002730000-0x0000000002734000-memory.dmpFilesize
16KB
-
memory/924-272-0x0000000002650000-0x0000000002654000-memory.dmpFilesize
16KB
-
memory/924-242-0x00000000028C0000-0x00000000028C4000-memory.dmpFilesize
16KB
-
memory/924-250-0x00000000027F0000-0x00000000027F4000-memory.dmpFilesize
16KB
-
memory/924-92-0x0000000000000000-mapping.dmp
-
memory/976-25-0x0000000000000000-mapping.dmp
-
memory/976-55-0x0000000000000000-mapping.dmp
-
memory/984-27-0x0000000000000000-mapping.dmp
-
memory/984-79-0x0000000000000000-mapping.dmp
-
memory/1012-215-0x0000000002740000-0x0000000002744000-memory.dmpFilesize
16KB
-
memory/1036-120-0x0000000000000000-mapping.dmp
-
memory/1036-73-0x0000000000000000-mapping.dmp
-
memory/1056-223-0x0000000002840000-0x0000000002844000-memory.dmpFilesize
16KB
-
memory/1056-15-0x0000000000000000-mapping.dmp
-
memory/1080-81-0x0000000000000000-mapping.dmp
-
memory/1080-63-0x0000000000000000-mapping.dmp
-
memory/1084-274-0x0000000002600000-0x0000000002604000-memory.dmpFilesize
16KB
-
memory/1108-310-0x0000000002570000-0x0000000002574000-memory.dmpFilesize
16KB
-
memory/1108-172-0x0000000002830000-0x0000000002834000-memory.dmpFilesize
16KB
-
memory/1108-83-0x0000000000000000-mapping.dmp
-
memory/1136-205-0x0000000002700000-0x0000000002704000-memory.dmpFilesize
16KB
-
memory/1184-299-0x0000000002810000-0x0000000002814000-memory.dmpFilesize
16KB
-
memory/1184-221-0x0000000002640000-0x0000000002644000-memory.dmpFilesize
16KB
-
memory/1212-41-0x0000000000000000-mapping.dmp
-
memory/1280-28-0x0000000000000000-mapping.dmp
-
memory/1280-89-0x0000000000000000-mapping.dmp
-
memory/1316-32-0x0000000000000000-mapping.dmp
-
memory/1380-49-0x0000000000000000-mapping.dmp
-
memory/1452-185-0x0000000002930000-0x0000000002934000-memory.dmpFilesize
16KB
-
memory/1452-230-0x00000000025E0000-0x00000000025E4000-memory.dmpFilesize
16KB
-
memory/1456-34-0x0000000000000000-mapping.dmp
-
memory/1476-101-0x0000000000000000-mapping.dmp
-
memory/1516-53-0x0000000000000000-mapping.dmp
-
memory/1528-39-0x0000000000000000-mapping.dmp
-
memory/1532-57-0x0000000000000000-mapping.dmp
-
memory/1556-319-0x0000000002710000-0x0000000002714000-memory.dmpFilesize
16KB
-
memory/1584-61-0x0000000000000000-mapping.dmp
-
memory/1620-116-0x0000000000000000-mapping.dmp
-
memory/1632-314-0x00000000025A0000-0x00000000025A4000-memory.dmpFilesize
16KB
-
memory/1632-109-0x0000000000000000-mapping.dmp
-
memory/1636-2-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/1640-245-0x0000000002530000-0x0000000002534000-memory.dmpFilesize
16KB
-
memory/1640-266-0x0000000002790000-0x0000000002794000-memory.dmpFilesize
16KB
-
memory/1688-60-0x0000000000000000-mapping.dmp
-
memory/1688-70-0x00000000026B0000-0x00000000026B4000-memory.dmpFilesize
16KB
-
memory/1732-59-0x0000000000000000-mapping.dmp
-
memory/1732-226-0x00000000026B0000-0x00000000026B4000-memory.dmpFilesize
16KB
-
memory/1732-196-0x00000000027D0000-0x00000000027D4000-memory.dmpFilesize
16KB
-
memory/1788-100-0x0000000000000000-mapping.dmp
-
memory/1788-64-0x0000000000000000-mapping.dmp
-
memory/1796-283-0x0000000002630000-0x0000000002634000-memory.dmpFilesize
16KB
-
memory/1796-105-0x0000000002790000-0x0000000002794000-memory.dmpFilesize
16KB
-
memory/1796-96-0x0000000000000000-mapping.dmp
-
memory/1796-84-0x00000000027D0000-0x00000000027D4000-memory.dmpFilesize
16KB
-
memory/1796-69-0x0000000000000000-mapping.dmp
-
memory/1804-114-0x0000000000000000-mapping.dmp
-
memory/1804-127-0x0000000002620000-0x0000000002624000-memory.dmpFilesize
16KB
-
memory/1804-212-0x00000000027E0000-0x00000000027E4000-memory.dmpFilesize
16KB
-
memory/1808-46-0x0000000000000000-mapping.dmp
-
memory/1828-106-0x0000000000000000-mapping.dmp
-
memory/1828-78-0x0000000000000000-mapping.dmp
-
memory/1828-16-0x0000000000000000-mapping.dmp
-
memory/1832-118-0x0000000000000000-mapping.dmp
-
memory/1832-218-0x0000000002850000-0x0000000002854000-memory.dmpFilesize
16KB
-
memory/1832-188-0x0000000002780000-0x0000000002784000-memory.dmpFilesize
16KB
-
memory/1832-209-0x0000000002560000-0x0000000002564000-memory.dmpFilesize
16KB
-
memory/1832-44-0x0000000000000000-mapping.dmp
-
memory/1832-51-0x0000000002750000-0x0000000002754000-memory.dmpFilesize
16KB
-
memory/1864-260-0x00000000027F0000-0x00000000027F4000-memory.dmpFilesize
16KB
-
memory/1864-233-0x0000000002660000-0x0000000002664000-memory.dmpFilesize
16KB
-
memory/1888-248-0x0000000002670000-0x0000000002674000-memory.dmpFilesize
16KB
-
memory/1920-254-0x00000000027E0000-0x00000000027E4000-memory.dmpFilesize
16KB
-
memory/1924-104-0x0000000000000000-mapping.dmp
-
memory/1924-42-0x0000000002770000-0x0000000002774000-memory.dmpFilesize
16KB
-
memory/1924-30-0x0000000000000000-mapping.dmp
-
memory/1924-149-0x00000000027B0000-0x00000000027B4000-memory.dmpFilesize
16KB
-
memory/1956-322-0x00000000025F0000-0x00000000025F4000-memory.dmpFilesize
16KB
-
memory/1972-5-0x0000000000000000-mapping.dmp
-
memory/1976-119-0x0000000000000000-mapping.dmp
-
memory/2020-262-0x00000000027F0000-0x00000000027F4000-memory.dmpFilesize
16KB
-
memory/2020-138-0x0000000002710000-0x0000000002714000-memory.dmpFilesize
16KB