Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe
Resource
win10v2004-20220812-en
General
-
Target
a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe
-
Size
445KB
-
MD5
632493be46dd6cae98709880d4e9ba20
-
SHA1
77bea82f89a8068dcbf4ecb99f500475f2608042
-
SHA256
a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0
-
SHA512
8bbb66236ade3f2e42f54bae88b03ff524fdca5440844a14b409ace3a0239c95192dd86ec8abac58fe86e25417604a4fef345164bddfa6e48239a8de58b631ca
-
SSDEEP
6144:EAXSSifvn4Ed7PLAMunCf5G4cEUCdEFxZi8wRwY5xU3fhtKscnSkyL1yY+:ENSQ7On+5G4c/vi8wR15xYKscnSRLJ+
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 64 mkgIIoEY.exe 3024 wScoIAQY.exe 3664 ROwsYYMA.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mkgIIoEY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wScoIAQY.exe = "C:\\ProgramData\\LYEksIos\\wScoIAQY.exe" wScoIAQY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wScoIAQY.exe = "C:\\ProgramData\\LYEksIos\\wScoIAQY.exe" ROwsYYMA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ngEAAIsY.exe = "C:\\Users\\Admin\\JuYQoEYo\\ngEAAIsY.exe" a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YMYgUsAE.exe = "C:\\ProgramData\\umIkgMkk\\YMYgUsAE.exe" a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkgIIoEY.exe = "C:\\Users\\Admin\\vsoUgQkQ\\mkgIIoEY.exe" a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wScoIAQY.exe = "C:\\ProgramData\\LYEksIos\\wScoIAQY.exe" a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkgIIoEY.exe = "C:\\Users\\Admin\\vsoUgQkQ\\mkgIIoEY.exe" mkgIIoEY.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sheUseDismount.mp3 mkgIIoEY.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\vsoUgQkQ ROwsYYMA.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\vsoUgQkQ\mkgIIoEY ROwsYYMA.exe File created C:\Windows\SysWOW64\shell32.dll.exe mkgIIoEY.exe File opened for modification C:\Windows\SysWOW64\sheInstallResolve.rar mkgIIoEY.exe File opened for modification C:\Windows\SysWOW64\sheSendClose.mp3 mkgIIoEY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 5028 5048 WerFault.exe 614 3676 32 WerFault.exe 603 5044 1692 WerFault.exe 608 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 5060 reg.exe 2004 reg.exe 1760 reg.exe 5060 reg.exe 2308 reg.exe 1284 reg.exe 4504 reg.exe 1704 reg.exe 3028 reg.exe 5096 reg.exe 4072 reg.exe 540 reg.exe 3504 reg.exe 4848 reg.exe 3616 reg.exe 1528 reg.exe 1084 reg.exe 4292 reg.exe 2088 reg.exe 1184 reg.exe 4240 reg.exe 4724 reg.exe 1936 reg.exe 5088 reg.exe 5072 reg.exe 1100 reg.exe 3968 reg.exe 4156 reg.exe 700 reg.exe 4672 reg.exe 3828 reg.exe 2092 reg.exe 2936 reg.exe 1268 reg.exe 3572 reg.exe 2656 reg.exe 748 reg.exe 3808 reg.exe 3836 reg.exe 3544 reg.exe 2636 reg.exe 2892 reg.exe 2192 reg.exe 4348 reg.exe 712 reg.exe 4772 reg.exe 1104 reg.exe 4176 reg.exe 4984 reg.exe 4252 reg.exe 1132 reg.exe 4240 reg.exe 2704 reg.exe 3732 reg.exe 776 reg.exe 4844 reg.exe 1276 reg.exe 4436 reg.exe 2940 reg.exe 3180 reg.exe 5116 reg.exe 552 reg.exe 3272 reg.exe 1960 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2520 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2520 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2520 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2520 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 1612 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 1612 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 1612 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 1612 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2848 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2848 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2848 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2848 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4444 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4444 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4444 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4444 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 960 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 960 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 960 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 960 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4324 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4324 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4324 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 4324 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 460 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 460 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 460 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 460 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3504 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3504 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3504 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3504 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2140 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2140 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2140 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 2140 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3640 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3640 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3640 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 3640 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 64 mkgIIoEY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe 64 mkgIIoEY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 64 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 82 PID 5084 wrote to memory of 64 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 82 PID 5084 wrote to memory of 64 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 82 PID 5084 wrote to memory of 3024 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 83 PID 5084 wrote to memory of 3024 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 83 PID 5084 wrote to memory of 3024 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 83 PID 5084 wrote to memory of 5064 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 85 PID 5084 wrote to memory of 5064 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 85 PID 5084 wrote to memory of 5064 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 85 PID 5084 wrote to memory of 5104 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 86 PID 5084 wrote to memory of 5104 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 86 PID 5084 wrote to memory of 5104 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 86 PID 5084 wrote to memory of 5048 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 87 PID 5084 wrote to memory of 5048 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 87 PID 5084 wrote to memory of 5048 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 87 PID 5084 wrote to memory of 5096 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 88 PID 5084 wrote to memory of 5096 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 88 PID 5084 wrote to memory of 5096 5084 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 88 PID 5064 wrote to memory of 1252 5064 cmd.exe 93 PID 5064 wrote to memory of 1252 5064 cmd.exe 93 PID 5064 wrote to memory of 1252 5064 cmd.exe 93 PID 1252 wrote to memory of 3244 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 94 PID 1252 wrote to memory of 3244 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 94 PID 1252 wrote to memory of 3244 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 94 PID 3244 wrote to memory of 2004 3244 cmd.exe 96 PID 3244 wrote to memory of 2004 3244 cmd.exe 96 PID 3244 wrote to memory of 2004 3244 cmd.exe 96 PID 1252 wrote to memory of 4864 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 97 PID 1252 wrote to memory of 4864 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 97 PID 1252 wrote to memory of 4864 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 97 PID 1252 wrote to memory of 2844 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 102 PID 1252 wrote to memory of 2844 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 102 PID 1252 wrote to memory of 2844 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 102 PID 1252 wrote to memory of 5028 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 98 PID 1252 wrote to memory of 5028 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 98 PID 1252 wrote to memory of 5028 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 98 PID 1252 wrote to memory of 5056 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 99 PID 1252 wrote to memory of 5056 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 99 PID 1252 wrote to memory of 5056 1252 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 99 PID 2004 wrote to memory of 1528 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 105 PID 2004 wrote to memory of 1528 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 105 PID 2004 wrote to memory of 1528 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 105 PID 2004 wrote to memory of 4176 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 107 PID 2004 wrote to memory of 4176 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 107 PID 2004 wrote to memory of 4176 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 107 PID 2004 wrote to memory of 4564 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 109 PID 2004 wrote to memory of 4564 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 109 PID 2004 wrote to memory of 4564 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 109 PID 2004 wrote to memory of 3448 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 111 PID 2004 wrote to memory of 3448 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 111 PID 2004 wrote to memory of 3448 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 111 PID 2004 wrote to memory of 3968 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 113 PID 2004 wrote to memory of 3968 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 113 PID 2004 wrote to memory of 3968 2004 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 113 PID 1528 wrote to memory of 2148 1528 cmd.exe 115 PID 1528 wrote to memory of 2148 1528 cmd.exe 115 PID 1528 wrote to memory of 2148 1528 cmd.exe 115 PID 2148 wrote to memory of 3408 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 116 PID 2148 wrote to memory of 3408 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 116 PID 2148 wrote to memory of 3408 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 116 PID 2148 wrote to memory of 4984 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 118 PID 2148 wrote to memory of 4984 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 118 PID 2148 wrote to memory of 4984 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 118 PID 2148 wrote to memory of 4884 2148 a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe 120 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe"C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\vsoUgQkQ\mkgIIoEY.exe"C:\Users\Admin\vsoUgQkQ\mkgIIoEY.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:64
-
-
C:\ProgramData\LYEksIos\wScoIAQY.exe"C:\ProgramData\LYEksIos\wScoIAQY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"2⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea03⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"4⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea05⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"6⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea07⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"8⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea09⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"10⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea011⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"12⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea013⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"14⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea015⤵
- Suspicious behavior: EnumeratesProcesses
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"16⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea017⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"18⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea019⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"20⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea021⤵
- Suspicious behavior: EnumeratesProcesses
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"22⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea023⤵
- Suspicious behavior: EnumeratesProcesses
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"24⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea025⤵
- Suspicious behavior: EnumeratesProcesses
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"26⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea027⤵
- Suspicious behavior: EnumeratesProcesses
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"28⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea029⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"30⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea031⤵
- Suspicious behavior: EnumeratesProcesses
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"32⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea033⤵PID:3348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"34⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea035⤵PID:4236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"36⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea037⤵PID:3752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"38⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea039⤵PID:2636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"40⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea041⤵PID:32
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"42⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea043⤵PID:1256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"44⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea045⤵PID:460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"46⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea047⤵PID:3220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"48⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea049⤵PID:3556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"50⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea051⤵PID:404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"52⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea053⤵PID:4264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"54⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea055⤵PID:4892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"56⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea057⤵PID:4152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"58⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea059⤵PID:1516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"60⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea061⤵PID:4280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"62⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea063⤵PID:4168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"64⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea065⤵PID:2164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"66⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea067⤵PID:640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"68⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea069⤵PID:4744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"70⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea071⤵PID:3084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"72⤵PID:1132
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qQEQIMUw.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""72⤵PID:4476
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵PID:1900
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- Modifies registry key
PID:3968
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵PID:2020
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
PID:4984
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RWgcksYU.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""70⤵PID:2696
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵PID:2656
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
- Modifies visibility of file extensions in Explorer
PID:3924
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵PID:2372
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵PID:2500
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
PID:2364
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
PID:5060
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵PID:3152
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
PID:1552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dosQgAUI.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""68⤵PID:1436
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵PID:4672
-
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea069⤵PID:2092
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RIgIQYcw.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""66⤵PID:2036
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵PID:4856
-
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea067⤵PID:4176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NwQYgMQI.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""68⤵PID:1300
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
PID:3092
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
- Modifies registry key
PID:3180
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies registry key
PID:552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"68⤵PID:4580
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
PID:1460
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵PID:1660
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1704
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
PID:3548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fYcAIYMM.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""64⤵PID:4140
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵PID:740
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV166⤵PID:2940
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
PID:1528
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵PID:1640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"63⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea064⤵PID:4008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"65⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea066⤵PID:5028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"67⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea068⤵PID:1008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ueEsUEsY.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""69⤵PID:1044
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs70⤵PID:4608
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f69⤵
- UAC bypass
- Modifies registry key
PID:3808
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 269⤵PID:2520
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 169⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4292
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"69⤵PID:4152
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 269⤵PID:4324
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 169⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2004
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV168⤵
- UAC bypass
PID:4848
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs68⤵PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pOkMYwQE.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""67⤵PID:3552
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f67⤵
- UAC bypass
PID:700
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 267⤵
- Modifies visibility of file extensions in Explorer
PID:2192
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 167⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3272
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AWMsUYok.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""65⤵PID:4052
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f65⤵
- UAC bypass
- Modifies registry key
PID:2088
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 265⤵PID:1456
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 165⤵PID:3540
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UaUQAokI.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""62⤵PID:632
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵PID:1084
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- Modifies registry key
PID:4436
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵PID:3420
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵PID:1104
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FEowUcIw.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""60⤵PID:1232
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵PID:2296
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
PID:3572
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵PID:4984
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵PID:3924
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵PID:3972
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵PID:4856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cQMEoYcM.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""58⤵PID:5012
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵PID:1724
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵PID:3964
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea058⤵PID:3332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"59⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea060⤵PID:4128
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cKkcIAUc.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""59⤵PID:2504
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs60⤵PID:4496
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f59⤵
- UAC bypass
PID:740
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 259⤵
- Modifies registry key
PID:5072
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 159⤵
- Modifies visibility of file extensions in Explorer
PID:2712
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
PID:4860
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵PID:2704
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
PID:1252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZKAQcYYg.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""56⤵PID:964
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵PID:4488
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- Modifies registry key
PID:712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DCAEgswE.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""54⤵PID:772
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵PID:5112
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
- Modifies registry key
PID:4772
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
PID:4572 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵PID:4128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QoogYkEo.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""56⤵PID:3988
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵PID:3496
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵PID:2352
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵PID:1936
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
PID:4348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"56⤵PID:1436
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PYkQcIgY.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""52⤵PID:208
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵PID:3408
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
- Modifies registry key
PID:2892
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵PID:2164
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1268
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\seAYwkAM.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""50⤵PID:1460
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵PID:1984
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
PID:1684
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵PID:4688
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
PID:4168
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
PID:5076
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵PID:4416
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
PID:2660 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵PID:2296
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ekckMMkY.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""48⤵PID:3536
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵PID:4988
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
PID:1732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wOAYYMII.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""46⤵PID:4384
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea048⤵
- Adds Run key to start application
PID:3792 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f49⤵
- Modifies registry key
PID:4348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LSQoMEMw.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""49⤵PID:4152
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs50⤵PID:2464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LQsEMAcY.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""51⤵PID:1612
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f51⤵
- UAC bypass
- Modifies registry key
PID:3836
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 251⤵PID:4600
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 151⤵
- Modifies visibility of file extensions in Explorer
PID:404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"51⤵PID:4072
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 249⤵
- Modifies registry key
PID:2704
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 149⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"49⤵PID:240
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
PID:1044
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵PID:1248
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
PID:540
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵PID:5028
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cKIcUgcM.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""44⤵PID:3632
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵PID:1456
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"43⤵PID:816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SAAsUwkY.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""43⤵PID:2036
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs44⤵PID:1188
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f43⤵
- UAC bypass
PID:5076
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵PID:5040
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
PID:1860
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CCUwMEko.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""42⤵PID:920
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵PID:4860
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵PID:5044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XAQoQUAQ.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""40⤵PID:3968
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵PID:424
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
PID:4900
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4504
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
PID:4032 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵PID:5096
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵PID:3376
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
PID:4632
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dAMcEkwA.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""38⤵PID:4488
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵PID:3404
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
PID:700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AEsAkwso.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""36⤵PID:1084
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵PID:1660
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵PID:2508
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1284
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CeAkQkUs.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""34⤵PID:4444
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵PID:2912
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
PID:2248
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵PID:2640
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2308
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hQMYwsYE.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""32⤵PID:1416
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵PID:2224
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
PID:4684
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
PID:2936
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4240
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
PID:4080
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
PID:4724
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"31⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea032⤵PID:3676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AEwoYAsg.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""31⤵PID:2196
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs32⤵PID:3556
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f31⤵
- Modifies registry key
PID:4848
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 231⤵PID:2848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 32 -ip 3232⤵PID:1776
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 133⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:748
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wCcAogAY.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""33⤵PID:4836
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f33⤵
- UAC bypass
PID:3880
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 233⤵
- Modifies registry key
PID:1184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"33⤵PID:1124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1692 -ip 169232⤵PID:1528
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 131⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:5088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\moUAsYMM.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""30⤵PID:1128
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵PID:1236
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lOUMIEMQ.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""28⤵PID:4784
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵PID:2196
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
PID:3820
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea029⤵PID:4592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"30⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea031⤵PID:816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xqEUIAMI.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""32⤵PID:1528
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵PID:4120
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
PID:1480
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
PID:5116
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
PID:1268
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
- Modifies visibility of file extensions in Explorer
PID:3260
-
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea032⤵PID:2464
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BKocsAUQ.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""30⤵PID:4076
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵PID:116
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- Modifies registry key
PID:3504
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
PID:1104
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵PID:3260
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
PID:1460
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MgcQIIAQ.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""26⤵PID:3740
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵PID:3448
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
PID:1184 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵PID:1936
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵PID:2904
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
PID:4464
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XoUAgcww.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""24⤵PID:1552
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵PID:2276
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
PID:1276
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵PID:964
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
PID:1444
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nUoAwosQ.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""22⤵PID:4412
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵PID:4852
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
PID:5060
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵PID:1480
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2636
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\omMkwEQA.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""20⤵PID:2040
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵PID:1620
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
PID:1100
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
PID:3616
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
PID:1872
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵PID:4380
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵PID:2300
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
PID:4404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GwYwEEcw.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""18⤵PID:2672
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵PID:3208
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
PID:3204
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
PID:4252
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
PID:1960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uAwoUgkk.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""16⤵PID:3444
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵PID:3440
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4844
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
PID:3544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OAAQMcEQ.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""14⤵PID:5088
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵PID:3152
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵PID:4888
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵PID:3792
-
C:\Users\Admin\JuYQoEYo\ngEAAIsY.exe"C:\Users\Admin\JuYQoEYo\ngEAAIsY.exe"13⤵PID:32
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 28414⤵
- Program crash
PID:3676
-
-
-
C:\ProgramData\umIkgMkk\YMYgUsAE.exe"C:\ProgramData\umIkgMkk\YMYgUsAE.exe"13⤵PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 38014⤵
- Program crash
PID:5044
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
PID:880
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
PID:4076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RIsAsgMM.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""12⤵PID:4084
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵PID:1704
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs12⤵PID:2276
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
PID:2284
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵PID:5076
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
PID:4240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uokYIwQk.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""10⤵PID:1920
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵PID:2656
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4984
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵PID:4884
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
PID:1368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PCEcoggA.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""8⤵PID:3676
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵PID:2508
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"9⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea010⤵PID:1864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"11⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea012⤵PID:1176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mIQcccYw.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""13⤵PID:700
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs14⤵PID:2932
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f13⤵
- UAC bypass
PID:4372
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 213⤵PID:5052
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 113⤵
- Modifies visibility of file extensions in Explorer
PID:2696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"13⤵PID:2036
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
- Modifies visibility of file extensions in Explorer
PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZycwQAEk.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""11⤵PID:5096
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs12⤵PID:3408
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f11⤵PID:4388
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵PID:3084
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 211⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea012⤵PID:1592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"13⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea014⤵PID:1872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bGUMMgYs.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""15⤵PID:1100
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs16⤵PID:4036
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f15⤵
- UAC bypass
PID:3404
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 215⤵PID:3692
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 115⤵
- Modifies visibility of file extensions in Explorer
PID:2036
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"15⤵PID:2904
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DOosIQgY.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""13⤵PID:1872
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f13⤵
- UAC bypass
PID:3680
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 213⤵PID:4240
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 113⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1760
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 111⤵
- Modifies registry key
PID:2192
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵PID:3496
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\giksEwsQ.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""9⤵PID:3872
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs10⤵PID:4972
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f9⤵
- UAC bypass
PID:2016
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 29⤵
- Modifies registry key
PID:2940
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 19⤵
- Modifies visibility of file extensions in Explorer
PID:3860
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4176
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵PID:4564
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
PID:3448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jaMkMIMo.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""6⤵PID:3968
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵PID:4800
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
PID:4864
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
PID:5028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YOUoAksc.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""4⤵PID:5056
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵PID:1804
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵PID:2844
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
PID:5104
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵PID:5048
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
PID:5096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uccwAMEg.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""2⤵PID:868
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵PID:1524
-
-
-
C:\ProgramData\OmcsQAgQ\ROwsYYMA.exeC:\ProgramData\OmcsQAgQ\ROwsYYMA.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"1⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea02⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea03⤵PID:3444
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
PID:1640
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea01⤵PID:3204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FwYEEYQE.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""2⤵PID:2712
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
PID:2948
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵PID:2352
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
PID:2660
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"2⤵PID:2308
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
PID:1104
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵PID:380
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵PID:4128
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:2848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5048 -ip 50482⤵PID:4784
-
-
C:\ProgramData\tuswwUIQ\sioMoUEc.exeC:\ProgramData\tuswwUIQ\sioMoUEc.exe1⤵PID:5048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 2202⤵
- Program crash
PID:5028
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3500
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:2500
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵PID:2560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"1⤵PID:4696
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
PID:4140 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:3388
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵PID:2060
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵PID:3616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"1⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea02⤵PID:2020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MygwEAQI.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""3⤵PID:4032
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
- UAC bypass
PID:2064
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
- Modifies registry key
PID:776
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1084
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"3⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4608
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea01⤵PID:5080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eMUgAAgE.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""2⤵PID:4572
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Modifies registry key
PID:3732
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵PID:4900
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
PID:3564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"2⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea03⤵PID:1008
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:116
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:868
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
PID:552
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3616
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵PID:640
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4824
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵PID:1412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"1⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea02⤵PID:3740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kEgQQcMs.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""3⤵PID:2140
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3872
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs4⤵PID:1412
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
- UAC bypass
- Modifies registry key
PID:3828
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵PID:2580
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies visibility of file extensions in Explorer
PID:4804
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"3⤵PID:4164
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3472
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:3504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qscgocUQ.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""1⤵PID:1248
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
PID:4376
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies registry key
PID:4672
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
PID:1420
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea01⤵PID:5012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"2⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea03⤵PID:4408
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵PID:4608
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵PID:3692
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵PID:3732
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uIQkoEEg.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""2⤵PID:1860
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
PID:4436
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:2656
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
PID:4684
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea02⤵PID:1776
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FKgscIAI.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""1⤵PID:1864
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
PID:2372
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4744
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- UAC bypass
PID:2352
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
PID:1684
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea01⤵PID:5016
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:1188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iagggkoM.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""1⤵PID:1176
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
PID:456
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵PID:3008
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵PID:364
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3028
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea01⤵PID:312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MmAUIYMk.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""1⤵
- Modifies visibility of file extensions in Explorer
PID:3540
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
PID:4820
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- UAC bypass
PID:3972
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:1300
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
PID:3968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fCkMgAwc.bat" "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exe""1⤵PID:3008
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
- Modifies registry key
PID:2092
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵PID:3964
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
PID:4388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0"1⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea0.exeC:\Users\Admin\AppData\Local\Temp\a7bcab2b85668032e24be3ad15f4b1097538c4b78ab6f06ce6a29ac5d3d4aea01⤵PID:4964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434KB
MD57e68b46fbb6aa74f47a2ef75775a9860
SHA142d9d1e40e4d6e3a6fd52507cc37367e8d53d670
SHA25604c3601b45193c70533bd224df0c5989c1ce1d982952e46645a39f559d4bf953
SHA512b27dc3c0bb4297a28f08efc9a1d0c6e801e9e070c4ccf37fdde879f2165975734fa1d59f76ed9e34a94eb84bb1729090aab6e51097d979db33bfc39faac2f974
-
Filesize
434KB
MD57e68b46fbb6aa74f47a2ef75775a9860
SHA142d9d1e40e4d6e3a6fd52507cc37367e8d53d670
SHA25604c3601b45193c70533bd224df0c5989c1ce1d982952e46645a39f559d4bf953
SHA512b27dc3c0bb4297a28f08efc9a1d0c6e801e9e070c4ccf37fdde879f2165975734fa1d59f76ed9e34a94eb84bb1729090aab6e51097d979db33bfc39faac2f974
-
Filesize
433KB
MD52c560c14ebbf62210ceb86f1c4d268f4
SHA1d4393d17b9885283a0d844f73a9f4ef1f50883e6
SHA256e4750f55b009d7de1fa3ca0ed62cef1ce9c4734c825ab3f767267240b1b440e3
SHA512ac0d5afdbf55aa6d080ee79eedf8098e64cd85ee50f4fc2ff4335f4e0a8e1eaa3b807ba89cd95de59115c4fdb2b8f97a7363c90cbb915c5084602831968a843a
-
Filesize
433KB
MD52c560c14ebbf62210ceb86f1c4d268f4
SHA1d4393d17b9885283a0d844f73a9f4ef1f50883e6
SHA256e4750f55b009d7de1fa3ca0ed62cef1ce9c4734c825ab3f767267240b1b440e3
SHA512ac0d5afdbf55aa6d080ee79eedf8098e64cd85ee50f4fc2ff4335f4e0a8e1eaa3b807ba89cd95de59115c4fdb2b8f97a7363c90cbb915c5084602831968a843a
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
6KB
MD506db768a6aa1d62200826358b4099ffe
SHA11f59c300939cc7211327c6020a95b8083e1b617a
SHA25666e1cd26c61f27567c02fcce0e757acc75a0afac1bca6d646b7b5aad69a86517
SHA512c648209b7df60c557aac45346ea649efa77123c06d5e9b1285054b7bed0791450736803f3dd6487674a8f463ff72f7ebcbf1d56ff17403b4fe197371ae6bd8e6
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
435KB
MD5357584700aaf9da1c021323891c45b20
SHA177bbcc6df9a88bf410e65d1f430de5935f00a161
SHA256a83df4bec6c96a5c88884c6fc9c04ae890e2dafdb8141f019902c8b193000e73
SHA512a89612355800e1ae952d49efe117cae3d5f57909d7c635150b556d1cca318c6c55dc98b593db408d158c8c4f22e9610ba8cd5cda83518028414dd5c21c756d57
-
Filesize
435KB
MD5357584700aaf9da1c021323891c45b20
SHA177bbcc6df9a88bf410e65d1f430de5935f00a161
SHA256a83df4bec6c96a5c88884c6fc9c04ae890e2dafdb8141f019902c8b193000e73
SHA512a89612355800e1ae952d49efe117cae3d5f57909d7c635150b556d1cca318c6c55dc98b593db408d158c8c4f22e9610ba8cd5cda83518028414dd5c21c756d57