e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Analysis

max time kernel
151s
max time network
162s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
Size

500KB
MD5

741881a4decc4960fe7dcebac35e5050
SHA1

b8fe46ea965c3e653611933f85db0c5a8e1f4e24
SHA256

e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
SHA512

8c4d53e61d3622eb3c6ad252ca02b9ec9808f39e973746f771e096ac980050aee265e68645e3717d7075e8fd36d6c265f9d5156ae00bd9cefd736f7b57e236fe
SSDEEP

12288:ZlWtZnNlB2e7EQXokRUCLxSftAd7U44Vn:Xq11hRokRwui1

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 32 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 32 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
1608	FccoooQw.exe
520	KAgUMQsw.exe
340	rikMowMs.exe

Loads dropped DLL 22 IoCs

pid	Process
1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe
1608	FccoooQw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\FccoooQw.exe = "C:\\Users\\Admin\\AsQcgMEQ\\FccoooQw.exe"	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KAgUMQsw.exe = "C:\\ProgramData\\mkMIoMEQ\\KAgUMQsw.exe"	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\FccoooQw.exe = "C:\\Users\\Admin\\AsQcgMEQ\\FccoooQw.exe"	FccoooQw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KAgUMQsw.exe = "C:\\ProgramData\\mkMIoMEQ\\KAgUMQsw.exe"	KAgUMQsw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KAgUMQsw.exe = "C:\\ProgramData\\mkMIoMEQ\\KAgUMQsw.exe"	rikMowMs.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AsQcgMEQ	rikMowMs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AsQcgMEQ\FccoooQw	rikMowMs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
1712	reg.exe
1176	reg.exe
2036	reg.exe
1808	reg.exe
1468	reg.exe
1688	reg.exe
1728	reg.exe
1616	reg.exe
1732	reg.exe
2036	reg.exe
1792	reg.exe
808	reg.exe
1584	reg.exe
1288	reg.exe
1416	reg.exe
2012	reg.exe
1416	reg.exe
1744	reg.exe
1644	reg.exe
1760	reg.exe
1556	reg.exe
624	reg.exe
1624	reg.exe
2012	reg.exe
540	reg.exe
1312	reg.exe
1988	reg.exe
1672	reg.exe
1828	reg.exe
664	reg.exe
1960	reg.exe
1648	reg.exe
1988	reg.exe
1736	reg.exe
624	reg.exe
1324	reg.exe
1644	reg.exe
1428	reg.exe
1640	reg.exe
804	reg.exe
1640	reg.exe
760	reg.exe
1788	reg.exe
836	reg.exe
1648	reg.exe
1312	reg.exe
1760	reg.exe
268	reg.exe
1624	reg.exe
1884	reg.exe
680	reg.exe
1860	reg.exe
1600	reg.exe
1712	reg.exe
748	reg.exe
988	reg.exe
932	reg.exe
760	reg.exe
1408	reg.exe
1164	reg.exe
1876	reg.exe
1384	reg.exe
1344	reg.exe
1976	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1740	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1740	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
328	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
328	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1176	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1176	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1536	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1536	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1724	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1724	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1732	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1732	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1660	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1660	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
940	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
940	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1052	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1052	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1288	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1288	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
836	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
836	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1260	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1260	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
912	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
912	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1672	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1672	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1280	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1280	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
808	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
808	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1732	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1732	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
796	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
796	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
280	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
280	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
756	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
756	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1528	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1528	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1788	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1788	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1896	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1896	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
556	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
556	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
564	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
564	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1532	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1532	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
2012	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
2012	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1176	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1176	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1644	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
1644	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1608	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	28
PID 1208 wrote to memory of 1608	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	28
PID 1208 wrote to memory of 1608	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	28
PID 1208 wrote to memory of 1608	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	28
PID 1208 wrote to memory of 520	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	29
PID 1208 wrote to memory of 520	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	29
PID 1208 wrote to memory of 520	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	29
PID 1208 wrote to memory of 520	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	29
PID 1208 wrote to memory of 1772	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	31
PID 1208 wrote to memory of 1772	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	31
PID 1208 wrote to memory of 1772	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	31
PID 1208 wrote to memory of 1772	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	31
PID 1772 wrote to memory of 1416	1772	cmd.exe	33
PID 1772 wrote to memory of 1416	1772	cmd.exe	33
PID 1772 wrote to memory of 1416	1772	cmd.exe	33
PID 1772 wrote to memory of 1416	1772	cmd.exe	33
PID 1416 wrote to memory of 1000	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	34
PID 1416 wrote to memory of 1000	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	34
PID 1416 wrote to memory of 1000	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	34
PID 1416 wrote to memory of 1000	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	34
PID 1000 wrote to memory of 1164	1000	cmd.exe	36
PID 1000 wrote to memory of 1164	1000	cmd.exe	36
PID 1000 wrote to memory of 1164	1000	cmd.exe	36
PID 1000 wrote to memory of 1164	1000	cmd.exe	36
PID 1208 wrote to memory of 664	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	37
PID 1208 wrote to memory of 664	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	37
PID 1208 wrote to memory of 664	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	37
PID 1208 wrote to memory of 664	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	37
PID 1208 wrote to memory of 988	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	38
PID 1208 wrote to memory of 988	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	38
PID 1208 wrote to memory of 988	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	38
PID 1208 wrote to memory of 988	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	38
PID 1208 wrote to memory of 1724	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	40
PID 1208 wrote to memory of 1724	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	40
PID 1208 wrote to memory of 1724	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	40
PID 1208 wrote to memory of 1724	1208	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	40
PID 1416 wrote to memory of 1672	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	43
PID 1416 wrote to memory of 1672	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	43
PID 1416 wrote to memory of 1672	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	43
PID 1416 wrote to memory of 1672	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	43
PID 1416 wrote to memory of 1468	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	44
PID 1416 wrote to memory of 1468	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	44
PID 1416 wrote to memory of 1468	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	44
PID 1416 wrote to memory of 1468	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	44
PID 1416 wrote to memory of 1324	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	46
PID 1416 wrote to memory of 1324	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	46
PID 1416 wrote to memory of 1324	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	46
PID 1416 wrote to memory of 1324	1416	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	46
PID 1164 wrote to memory of 1876	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	49
PID 1164 wrote to memory of 1876	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	49
PID 1164 wrote to memory of 1876	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	49
PID 1164 wrote to memory of 1876	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	49
PID 1164 wrote to memory of 1300	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	52
PID 1164 wrote to memory of 1300	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	52
PID 1164 wrote to memory of 1300	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	52
PID 1164 wrote to memory of 1300	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	52
PID 1164 wrote to memory of 1616	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	53
PID 1164 wrote to memory of 1616	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	53
PID 1164 wrote to memory of 1616	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	53
PID 1164 wrote to memory of 1616	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	53
PID 1164 wrote to memory of 1688	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	57
PID 1164 wrote to memory of 1688	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	57
PID 1164 wrote to memory of 1688	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	57
PID 1164 wrote to memory of 1688	1164	e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe	57

C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
"C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AsQcgMEQ\FccoooQw.exe
  "C:\Users\Admin\AsQcgMEQ\FccoooQw.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:1608
- C:\ProgramData\mkMIoMEQ\KAgUMQsw.exe
  "C:\ProgramData\mkMIoMEQ\KAgUMQsw.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
    C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1164
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        6⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        8⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        10⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        12⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        13⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        14⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        15⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        16⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        17⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        18⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        19⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        20⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        22⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        23⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        24⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        25⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        26⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        27⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        28⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        30⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        31⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:912
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        32⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        33⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        34⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        35⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        36⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        37⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:808
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        38⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        39⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        40⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        41⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        42⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        43⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:280
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        44⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        45⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        46⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        47⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        48⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        49⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        50⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        51⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        52⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        53⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        54⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        55⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:564
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        56⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        57⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        58⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        59⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        60⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        61⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        62⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        63⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663"
        64⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe
        
        C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663
        65⤵
        
        PID:748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        64⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        64⤵
        
        PID:468
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        64⤵
        UAC bypass
        Modifies registry key
        
        PID:760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        62⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        62⤵
        UAC bypass
        Modifies registry key
        
        PID:1760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        62⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        60⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        60⤵
        Modifies registry key
        
        PID:1744
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        60⤵
        UAC bypass
        Modifies registry key
        
        PID:748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        58⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        58⤵
        Modifies registry key
        
        PID:624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        58⤵
        UAC bypass
        Modifies registry key
        
        PID:804
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        56⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1712
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        56⤵
        Modifies registry key
        
        PID:1416
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        56⤵
        UAC bypass
        Modifies registry key
        
        PID:1644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        54⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1288
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        54⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        54⤵
        UAC bypass
        
        PID:748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        52⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        52⤵
        Modifies registry key
        
        PID:1312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        52⤵
        UAC bypass
        
        PID:1076
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        50⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:808
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        50⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        50⤵
        UAC bypass
        Modifies registry key
        
        PID:540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        48⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1736
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        48⤵
        
        PID:992
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        48⤵
        UAC bypass
        
        PID:1744
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        46⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2012
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        46⤵
        Modifies registry key
        
        PID:1960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        46⤵
        UAC bypass
        Modifies registry key
        
        PID:1312
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\dgAokQEY.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        46⤵
        
        PID:468
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        47⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        44⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        44⤵
        Modifies registry key
        
        PID:1648
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        44⤵
        UAC bypass
        Modifies registry key
        
        PID:1644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NKkooksA.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        44⤵
        
        PID:604
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        45⤵
        
        PID:276
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        42⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1808
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        42⤵
        Modifies registry key
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QCsssEwI.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        42⤵
        
        PID:688
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        43⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        42⤵
        UAC bypass
        
        PID:680
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1792
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        Modifies registry key
        
        PID:2036
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        UAC bypass
        
        PID:1428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ZccoAEsU.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        40⤵
        
        PID:556
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        UAC bypass
        
        PID:684
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        Modifies registry key
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\oUQkAAMY.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        38⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NGkYEUwA.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        36⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        UAC bypass
        Modifies registry key
        
        PID:1640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1076
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        UAC bypass
        
        PID:1384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        Modifies registry key
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\xaoYUEYk.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        34⤵
        
        PID:556
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        
        PID:432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\fwEwoAkA.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        32⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        
        PID:624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        UAC bypass
        
        PID:992
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        
        PID:564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1164
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:680
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        Modifies registry key
        
        PID:1408
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        UAC bypass
        Modifies registry key
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NkkUMYko.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        30⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        
        PID:392
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        Modifies registry key
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\usIkQMUw.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        28⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        UAC bypass
        Modifies registry key
        
        PID:1428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        Modifies registry key
        
        PID:268
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        UAC bypass
        Modifies registry key
        
        PID:1884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\JkIcYgss.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        26⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1176
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        UAC bypass
        
        PID:1384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\JyAgQUgU.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        24⤵
        
        PID:988
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1888
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        UAC bypass
        Modifies registry key
        
        PID:1976
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        Modifies registry key
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\OecEEEIw.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        22⤵
        
        PID:932
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1344
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        UAC bypass
        
        PID:916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\nMwYAoAI.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        20⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies visibility of file extensions in Explorer
        
        PID:612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        UAC bypass
        
        PID:1648
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\miQYgkMI.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        18⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1600
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        
        PID:280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        Modifies registry key
        
        PID:1416
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        UAC bypass
        Modifies registry key
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YKswYQEU.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        16⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        
        PID:932
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        18⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:1640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        UAC bypass
        Modifies registry key
        
        PID:932
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\nOMsEUoo.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        14⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        
        PID:432
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1828
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        Modifies registry key
        
        PID:1728
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        UAC bypass
        
        PID:992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MUIgccEU.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        12⤵
        
        PID:688
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        
        PID:1620
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        Modifies registry key
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PasYEAsE.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        10⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        
        PID:836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        
        PID:992
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\nCQgEAsE.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        8⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        
        PID:756
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1300
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:1616
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:1688
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\TwsYMMgA.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
        6⤵
        
        PID:988
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        
        PID:1936
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies registry key
      PID:1672
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:1468
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:1324
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\BSkUUckk.bat" "C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663.exe""
      4⤵
      PID:1344
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:1964
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  PID:664
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:988
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  PID:1724

C:\ProgramData\dkQggEsM\rikMowMs.exe
C:\ProgramData\dkQggEsM\rikMowMs.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\dkQggEsM\rikMowMs.exe

Filesize
468KB

MD5
46881ec6df30dbf9d355da771410292d

SHA1
1269120af3ba93b045a15c179d14a37f1f143b59

SHA256
76284b661ec8aa896c5c4b9b4ef6047cac8ef453646cf6ac312a08e2e9f8fe0b

SHA512
bdb825ee200f8d2a515a401bd50fe96a14dc1afb86294c2804ad883b1274bec711cac99064449bd7bd4f0042c048157e605c66713466d7ae3ccea8a2c9dd9f1f

Download Submit
C:\ProgramData\dkQggEsM\rikMowMs.exe

Filesize
468KB

MD5
46881ec6df30dbf9d355da771410292d

SHA1
1269120af3ba93b045a15c179d14a37f1f143b59

SHA256
76284b661ec8aa896c5c4b9b4ef6047cac8ef453646cf6ac312a08e2e9f8fe0b

SHA512
bdb825ee200f8d2a515a401bd50fe96a14dc1afb86294c2804ad883b1274bec711cac99064449bd7bd4f0042c048157e605c66713466d7ae3ccea8a2c9dd9f1f

Download Submit
C:\ProgramData\mkMIoMEQ\KAgUMQsw.exe

Filesize
472KB

MD5
cd00b0460f24bc85a171361af5e563be

SHA1
9eb14816cfeaeb931a72def14c38dc64bae95db1

SHA256
18beb9357173c957c31a1019ed7b8af315bdd17ae73f557a3ae38ae684223377

SHA512
b7581b0c44b84682e61c7c24779080d9bf5b5cb6203c3fe52bba46feb7d70591b5e76e7baa21f0afbc2ea7bc80ec8aecad25b50aacb01a1cfb25df027c19597b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BSkUUckk.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\JkIcYgss.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\JyAgQUgU.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\MUIgccEU.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\NkkUMYko.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\OecEEEIw.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\PasYEAsE.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\TwsYMMgA.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\YKswYQEU.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e33fdd9e482472df3ab545ea9cc3e2cdbd8dfec5b12c7435651c41334f260663

Filesize
27KB

MD5
6fb2a38dc107eacb41cf1656e899cf70

SHA1
4eee44b18576e84de7b163142b537d2fe6231845

SHA256
62e85a0f3a4cbc01b6d3390d63de0f7d051e1e723aeb071416a38799c50738ea

SHA512
939f4a7f03996833d54a36f608949a579a7e6c37f5a477694287158fae1403bce8b5b57603ac45f8caf683129f918093e5663703c05d44e78e9e3606a0d683fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\miQYgkMI.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\nCQgEAsE.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\nMwYAoAI.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\nOMsEUoo.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\usIkQMUw.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AsQcgMEQ\FccoooQw.exe

Filesize
468KB

MD5
93141e6c34c55de1151ce361b893bc90

SHA1
00975a6e1563951b295529b4d1dd3af49d9e3fe6

SHA256
143404d7f2423d2efefb14421d3a852ac909fd471367d8a24489c499274e4532

SHA512
d0b3c210a7d2be1a0aef79a5d298665630461c921048b90f4fb4014044a604fc8726771d3dde592b077af98124e49696a5c3f08c39ced3cf3ca187e72ef06291

Download Submit
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
145KB

MD5
9d10f99a6712e28f8acd5641e3a7ea6b

SHA1
835e982347db919a681ba12f3891f62152e50f0d

SHA256
70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc

SHA512
2141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5

Download Submit
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.0MB

MD5
4d92f518527353c0db88a70fddcfd390

SHA1
c4baffc19e7d1f0e0ebf73bab86a491c1d152f98

SHA256
97e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c

SHA512
05a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452

Download Submit
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.0MB

MD5
4d92f518527353c0db88a70fddcfd390

SHA1
c4baffc19e7d1f0e0ebf73bab86a491c1d152f98

SHA256
97e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c

SHA512
05a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452

Download Submit
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
818KB

MD5
a41e524f8d45f0074fd07805ff0c9b12

SHA1
948deacf95a60c3fdf17e0e4db1931a6f3fc5d38

SHA256
082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7

SHA512
91bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f

Download Submit
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
818KB

MD5
a41e524f8d45f0074fd07805ff0c9b12

SHA1
948deacf95a60c3fdf17e0e4db1931a6f3fc5d38

SHA256
082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7

SHA512
91bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f

Download Submit
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
507KB

MD5
c87e561258f2f8650cef999bf643a731

SHA1
2c64b901284908e8ed59cf9c912f17d45b05e0af

SHA256
a1dfa6639bef3cb4e41175c43730d46a51393942ead826337ca9541ac210c67b

SHA512
dea4833aa712c5823f800f5f5a2adcf241c1b2b6747872f540f5ff9da6795c4ddb73db0912593337083c7c67b91e9eaf1b3d39a34b99980fd5904ba3d7d62f6c

Download Submit
\ProgramData\mkMIoMEQ\KAgUMQsw.exe

Filesize
472KB

MD5
cd00b0460f24bc85a171361af5e563be

SHA1
9eb14816cfeaeb931a72def14c38dc64bae95db1

SHA256
18beb9357173c957c31a1019ed7b8af315bdd17ae73f557a3ae38ae684223377

SHA512
b7581b0c44b84682e61c7c24779080d9bf5b5cb6203c3fe52bba46feb7d70591b5e76e7baa21f0afbc2ea7bc80ec8aecad25b50aacb01a1cfb25df027c19597b

Download Submit
\ProgramData\mkMIoMEQ\KAgUMQsw.exe

Filesize
472KB

MD5
cd00b0460f24bc85a171361af5e563be

SHA1
9eb14816cfeaeb931a72def14c38dc64bae95db1

SHA256
18beb9357173c957c31a1019ed7b8af315bdd17ae73f557a3ae38ae684223377

SHA512
b7581b0c44b84682e61c7c24779080d9bf5b5cb6203c3fe52bba46feb7d70591b5e76e7baa21f0afbc2ea7bc80ec8aecad25b50aacb01a1cfb25df027c19597b

Download Submit
\Users\Admin\AsQcgMEQ\FccoooQw.exe

Filesize
468KB

MD5
93141e6c34c55de1151ce361b893bc90

SHA1
00975a6e1563951b295529b4d1dd3af49d9e3fe6

SHA256
143404d7f2423d2efefb14421d3a852ac909fd471367d8a24489c499274e4532

SHA512
d0b3c210a7d2be1a0aef79a5d298665630461c921048b90f4fb4014044a604fc8726771d3dde592b077af98124e49696a5c3f08c39ced3cf3ca187e72ef06291

Download Submit
\Users\Admin\AsQcgMEQ\FccoooQw.exe

Filesize
468KB

MD5
93141e6c34c55de1151ce361b893bc90

SHA1
00975a6e1563951b295529b4d1dd3af49d9e3fe6

SHA256
143404d7f2423d2efefb14421d3a852ac909fd471367d8a24489c499274e4532

SHA512
d0b3c210a7d2be1a0aef79a5d298665630461c921048b90f4fb4014044a604fc8726771d3dde592b077af98124e49696a5c3f08c39ced3cf3ca187e72ef06291

Download Submit
memory/280-275-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/280-277-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/328-119-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/328-144-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/328-107-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/340-108-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/340-76-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/520-67-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/520-73-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/556-287-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/564-290-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/756-280-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/756-274-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/796-268-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/796-271-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/808-263-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/808-258-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/836-225-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/836-237-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/912-244-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/912-251-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/940-207-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/940-212-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1052-214-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1052-229-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1164-116-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1164-98-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1176-177-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1176-135-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1176-296-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1208-55-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1208-71-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1208-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1260-245-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1260-243-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1280-260-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1280-259-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1288-224-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1288-228-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1416-115-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1416-109-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1416-86-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1528-279-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1532-291-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1536-140-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1536-175-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1608-72-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1608-66-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1644-297-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1660-208-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1660-213-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1672-253-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1672-255-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1724-173-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1724-160-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1732-176-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1732-198-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1732-265-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1732-267-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1740-99-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1740-118-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1740-143-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1788-283-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1896-286-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2012-293-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download