Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 02:08

General

  • Target

    d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe

  • Size

    437KB

  • MD5

    a269c24d11b1fd737217af0ea28aeff0

  • SHA1

    d09cbac123cffd29a08ff5bccd0cf44d3a66f07d

  • SHA256

    d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

  • SHA512

    f1673d9a6239c82a962af87d66f614a151449ea0695fce3b418be4f4c4c2cc1d000262865eab5680d1d72dc1b9198fea5e8f3eef3e24f956988b277cba081b56

  • SSDEEP

    6144:zRy8sqRW/HtLSeuKDgGeMeFLbJukfa3WFH9wLiUEsRWjOhXET3R/xiMBOSeGUw60:5sq4/HheigxMeF3UWp9wJEB3HcSeo

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 35 IoCs
  • UAC bypass 3 TTPs 35 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
    "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\ekEQYUUw\eqEkQUAo.exe
      "C:\Users\Admin\ekEQYUUw\eqEkQUAo.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:2664
    • C:\ProgramData\oSMcMoso\ngUoUQws.exe
      "C:\ProgramData\oSMcMoso\ngUoUQws.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3744
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
        C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2316
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
            C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3132
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4808
              • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1508
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                  8⤵
                    PID:4556
                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                      9⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4288
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                        10⤵
                          PID:1376
                          • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                            C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                            11⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3836
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                              12⤵
                                PID:2848
                                • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                  C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                  13⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1756
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                    14⤵
                                      PID:440
                                      • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                        C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                        15⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3164
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                          16⤵
                                            PID:3056
                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                              17⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2312
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                18⤵
                                                  PID:5116
                                                  • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                    C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                    19⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4156
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                      20⤵
                                                        PID:1892
                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                          C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                          21⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1360
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                            22⤵
                                                              PID:3388
                                                              • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                23⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4884
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                  24⤵
                                                                    PID:1272
                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                      25⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1316
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                        26⤵
                                                                          PID:2036
                                                                          • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                            27⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:3128
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                              28⤵
                                                                                PID:2576
                                                                                • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                  29⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:1664
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                    30⤵
                                                                                      PID:3684
                                                                                      • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                        31⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:3668
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                          32⤵
                                                                                            PID:2528
                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                              33⤵
                                                                                                PID:4904
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                  34⤵
                                                                                                    PID:5060
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                      35⤵
                                                                                                        PID:4444
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                          36⤵
                                                                                                            PID:4032
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                              37⤵
                                                                                                                PID:4756
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                  38⤵
                                                                                                                    PID:5016
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                      39⤵
                                                                                                                        PID:4948
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                          40⤵
                                                                                                                            PID:2312
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                              41⤵
                                                                                                                                PID:544
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                  42⤵
                                                                                                                                    PID:2752
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                      43⤵
                                                                                                                                        PID:4736
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                          44⤵
                                                                                                                                            PID:2244
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                              45⤵
                                                                                                                                                PID:3816
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                  46⤵
                                                                                                                                                    PID:2992
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                      47⤵
                                                                                                                                                        PID:1752
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                          48⤵
                                                                                                                                                            PID:3020
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                              49⤵
                                                                                                                                                                PID:1564
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                  50⤵
                                                                                                                                                                    PID:1556
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                      51⤵
                                                                                                                                                                        PID:1208
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                          52⤵
                                                                                                                                                                            PID:3164
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                              53⤵
                                                                                                                                                                                PID:1732
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                                  54⤵
                                                                                                                                                                                    PID:384
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                                      55⤵
                                                                                                                                                                                        PID:4912
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                                          56⤵
                                                                                                                                                                                            PID:2148
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                                              57⤵
                                                                                                                                                                                                PID:3340
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                    PID:1524
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                            PID:2088
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                PID:4584
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                    PID:2756
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                            PID:4644
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                PID:2480
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                    PID:428
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                            PID:4988
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab
                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                PID:1836
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab"
                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                    PID:3628
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YIUosIAc.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                      PID:2260
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                          PID:5116
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:2056
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:4036
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:4272
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QegoAkcg.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                      PID:4824
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                                                                          PID:4116
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:1180
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:384
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZEkgUwYg.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                      PID:4820
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                          PID:4904
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        PID:2252
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:3412
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:3028
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\twgUwcsg.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                      PID:440
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                                                          PID:3056
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:4084
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        PID:1228
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:1080
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FEYMYAUM.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                      PID:2948
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        PID:1060
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:4276
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    PID:1120
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JcEMYUsM.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                      PID:2100
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                          PID:764
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:4856
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:4656
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JYEosIEs.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                      PID:1300
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                          PID:4828
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        PID:3656
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:2576
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WUAYEMEk.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                        PID:628
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                            PID:3732
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EiIwkEAk.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                        PID:4440
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                            PID:4204
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                          PID:3508
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:2028
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YYQQoMIM.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                        PID:4288
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                                            PID:2232
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:1092
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3032
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:4136
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aEUwkgEI.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                        PID:1632
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                            PID:3640
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:2416
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:2940
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      PID:4572
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bkwwMMEI.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                        PID:1592
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                            PID:1308
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3156
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3616
                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        PID:2228
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      PID:3648
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SoEMIQAA.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      PID:3784
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                          PID:4060
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:812
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:1836
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:3684
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wQEIsYAY.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                      PID:4392
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        45⤵
                                                                                                                                                                                                                                                          PID:1512
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:3624
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:2104
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SwsIswIw.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                      PID:4472
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                                                                          PID:4272
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:2768
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\beoQIckk.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        PID:2036
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                          PID:3640
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                          PID:1080
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\facgkEos.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                        PID:1940
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                                                                            PID:4428
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                          38⤵
                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                          PID:4124
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                          38⤵
                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                          PID:3948
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                          38⤵
                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                          PID:1604
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3376
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                        PID:452
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WoowQAoA.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                                                          PID:3180
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                                                                              PID:2760
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                            PID:2180
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                          PID:3784
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WuIcwoAI.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                              PID:3568
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                PID:3616
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tocIAMkQ.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                                                                              PID:3012
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                  PID:1176
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                PID:3732
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                  PID:4272
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                              PID:4708
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FQogoIcI.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                    PID:1360
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                    PID:3060
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKkgMcEA.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                  PID:2148
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                    29⤵
                                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                    PID:1092
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                      PID:4428
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                      PID:764
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                  PID:1604
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                  PID:3164
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cksEYQwY.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                    PID:4236
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                      PID:1508
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lWgoIwss.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                    PID:1628
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                      25⤵
                                                                                                                                                                                                                                                                        PID:2088
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                    PID:2768
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                                      PID:4344
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                      PID:4028
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SEwIIgYw.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                        PID:3436
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                                                            PID:808
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                      PID:312
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SQscAMcc.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                        PID:4100
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                      PID:3032
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                      PID:2820
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zuYkEogI.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                        PID:1880
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                            PID:1228
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                        PID:2100
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jAoooIIg.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                          PID:2916
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                              PID:1180
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                        PID:628
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\miscwggY.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                          PID:2252
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\imkwQMAw.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                            PID:4052
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                PID:1492
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                              PID:3712
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                          PID:1568
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                          PID:768
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\omAEgsoA.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                            PID:2520
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                PID:4068
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                          PID:4560
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                            PID:3700
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                            PID:4584
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vkMAcEwM.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                              PID:4472
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                  PID:5108
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                            PID:2584
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                            PID:2564
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DiYUwwYg.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                            PID:1592
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:656
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                          PID:556
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                          PID:2412
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                          PID:2924
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vyMcAgkE.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:4084
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                        PID:4060
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hmEgMsYo.bat" "C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab.exe""
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:3672
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:4092
                                                                                                                                                                                                                                                                        • C:\ProgramData\gOkIIIgU\OUoAcQkA.exe
                                                                                                                                                                                                                                                                          C:\ProgramData\gOkIIIgU\OUoAcQkA.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          PID:4872

                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                        • C:\ProgramData\gOkIIIgU\OUoAcQkA.exe

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          435KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          ca7aaaed04691d375d0bab34fea2f6e7

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          917ba989e9ee16c97c5a3a214bb98eebbc247121

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          61df38b1eac0b77f06eb44b1b13484ab6b6ed6ebe0041476b609e9946c6f184b

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          9945f3b45dac25c57febbb12065af64a3efb0128083a84673a02447126d1df72ee69b32fcd3ce556de1bd3b905fd794b29dc1477f183c10105a18f1172d3514f

                                                                                                                                                                                                                                                                        • C:\ProgramData\gOkIIIgU\OUoAcQkA.exe

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          435KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          ca7aaaed04691d375d0bab34fea2f6e7

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          917ba989e9ee16c97c5a3a214bb98eebbc247121

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          61df38b1eac0b77f06eb44b1b13484ab6b6ed6ebe0041476b609e9946c6f184b

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          9945f3b45dac25c57febbb12065af64a3efb0128083a84673a02447126d1df72ee69b32fcd3ce556de1bd3b905fd794b29dc1477f183c10105a18f1172d3514f

                                                                                                                                                                                                                                                                        • C:\ProgramData\oSMcMoso\ngUoUQws.exe

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          434KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          c8744eb6cc8936c1511cb2a17ee3b644

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          f3ad47fee703d48f06c4f50d3faeaffda13ecd6f

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e018aa2db481a1e1c440f959b9af5fbe670eaddb4093106a69fc06253146bb82

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          53bd877f23e90394de0e6cbf96fc011aee7ac3114c1cd86db8cf9744a125c2d981558ea401eddaf6c2bdb1c5731590aad6f57a598ea0294c8d71c049f1dcb39e

                                                                                                                                                                                                                                                                        • C:\ProgramData\oSMcMoso\ngUoUQws.exe

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          434KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          c8744eb6cc8936c1511cb2a17ee3b644

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          f3ad47fee703d48f06c4f50d3faeaffda13ecd6f

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e018aa2db481a1e1c440f959b9af5fbe670eaddb4093106a69fc06253146bb82

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          53bd877f23e90394de0e6cbf96fc011aee7ac3114c1cd86db8cf9744a125c2d981558ea401eddaf6c2bdb1c5731590aad6f57a598ea0294c8d71c049f1dcb39e

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DiYUwwYg.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FQogoIcI.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\LKkgMcEA.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\SEwIIgYw.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\SQscAMcc.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\SwsIswIw.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\WoowQAoA.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\WuIcwoAI.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\beoQIckk.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\cksEYQwY.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d15914551c41bad7877e2a023c925da0cedfcb6bce8dd05f494d923bd07087ab

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          f2139758e1ca788944e3d676ffdf569d

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          ac4ba97181837b96227c14b9b7dacee876688f14

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          e6886ff1f0d7ba5f6fafe66d8de31dcac805690e3a2c23aa22e4854db03be58d

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e43e97bd24a6f258872392685f0699faa8f6de78e9685b368f2b277794fb6866b4462eaf906b01bc11e4d1d4e8a064c6948b0aba2146b6800bd3957675bb3b1

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\facgkEos.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          19B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          4afb5c4527091738faf9cd4addf9d34e

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          170ba9d866894c1b109b62649b1893eb90350459

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\imkwQMAw.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jAoooIIg.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\lWgoIwss.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\miscwggY.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\omAEgsoA.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tocIAMkQ.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vkMAcEwM.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vyMcAgkE.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\zuYkEogI.bat

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          112B

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          bae1095f340720d965898063fede1273

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                                                                                                                                                                                                                        • C:\Users\Admin\ekEQYUUw\eqEkQUAo.exe

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          437KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          fcdd09b0f0c91a0b4be3271c53243e88

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          0e94ba2298c3a6750e691e02f86c2e149d1a6b1a

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ec131d8774b223f933d84648648a2163b3cbd5c69bf624a1e0088b147e0a7a52

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          00dddecffcbcfc354eb4022208eff9fb66645b8d754844ad6b9724dfb696e91d277221cbdfd6c29afe2b938bfd7d822d01ca50328589581b05cfbed95f4f396f

                                                                                                                                                                                                                                                                        • C:\Users\Admin\ekEQYUUw\eqEkQUAo.exe

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          437KB

                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                          fcdd09b0f0c91a0b4be3271c53243e88

                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                          0e94ba2298c3a6750e691e02f86c2e149d1a6b1a

                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                          ec131d8774b223f933d84648648a2163b3cbd5c69bf624a1e0088b147e0a7a52

                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                          00dddecffcbcfc354eb4022208eff9fb66645b8d754844ad6b9724dfb696e91d277221cbdfd6c29afe2b938bfd7d822d01ca50328589581b05cfbed95f4f396f

                                                                                                                                                                                                                                                                        • memory/544-293-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/544-290-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1208-300-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1316-258-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1360-246-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1508-177-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1564-299-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1664-266-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1684-309-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1732-302-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1732-301-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1752-298-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1752-297-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1756-211-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/1836-313-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2236-132-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2236-310-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2236-242-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2312-229-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2312-233-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2316-167-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2316-152-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2480-311-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2664-247-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/2664-139-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3128-262-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3132-163-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3164-213-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3164-223-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3340-304-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3340-305-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3668-271-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3668-268-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3744-253-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          444KB

                                                                                                                                                                                                                                                                        • memory/3744-150-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          444KB

                                                                                                                                                                                                                                                                        • memory/3816-296-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/3836-200-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4156-241-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4288-187-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4288-181-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4324-312-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4444-279-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4584-308-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4584-307-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4736-295-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4756-283-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4872-151-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4884-249-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4884-252-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4904-276-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4904-275-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4912-303-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/4948-288-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                        • memory/5116-306-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                          448KB