04b5f3b64016f9f11e17d39407646d60db40def49c7eda95e744de95d38848f7

Analysis

max time kernel
128s
max time network
107s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.Blocker.exe
Size

232KB
MD5

d12d3d23fb8c8a1d313b2590e15a6757
SHA1

f09e87cb760bc9932b02233fd764ccc103b972fa
SHA256

04b5f3b64016f9f11e17d39407646d60db40def49c7eda95e744de95d38848f7
SHA512

7116055b5fbb568fcddcff19914773ce6f5b8deccaffb001cbbbedd593add48691150224132711c4a2fcbbee313c76dfd8dcbb736cb4bf95d91e462a5595e9ae
SSDEEP

6144:B2AFYd5nT3UN1cJaj7NJobtvomq64xT7fu6jINl2wkHFeu09eNaX4IWb65:B2MYdpINCajv6eNxlfu6UN0wwp09eNwT

Score

10^/10

evasion spyware stealer trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 49 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1652-54-0x0000000000400000-0x00000000004AC000-memory.dmp	upx
behavioral1/memory/1652-56-0x0000000000400000-0x00000000004AC000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Trojan-Ransom.Win32.Blocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
3244	Process not Found
3708	Process not Found
3196	PING.EXE
3692	PING.EXE
3284	PING.EXE
4092	PING.EXE
3660	Process not Found
1332	Process not Found
2680	Process not Found
4092	Process not Found
3568	PING.EXE
3320	PING.EXE
3704	Process not Found
4028	Process not Found
2804	Process not Found
3592	Process not Found
2816	Process not Found
2688	PING.EXE
3792	PING.EXE
2692	Process not Found
3312	Process not Found
3836	Process not Found
1104	PING.EXE
3632	PING.EXE
3832	PING.EXE
3656	PING.EXE
3052	PING.EXE
3000	Process not Found
3564	Process not Found
4056	Process not Found
3340	Process not Found
3228	PING.EXE
3396	PING.EXE
3476	Process not Found
3264	PING.EXE
3228	Process not Found
3828	Process not Found
3748	Process not Found
624	Process not Found
520	Process not Found
4088	PING.EXE
2160	Process not Found
3508	PING.EXE
3024	PING.EXE
3840	PING.EXE
2776	PING.EXE
2676	PING.EXE
3664	PING.EXE
3608	Process not Found
3512	Process not Found
3236	Process not Found
4004	Process not Found
3604	PING.EXE
3980	PING.EXE
3264	Process not Found
3344	Process not Found
3592	Process not Found
3728	Process not Found
3756	Process not Found
4092	PING.EXE
3552	PING.EXE
3292	Process not Found
3832	Process not Found
2796	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2000	1652	Trojan-Ransom.Win32.Blocker.exe	26
PID 1652 wrote to memory of 2000	1652	Trojan-Ransom.Win32.Blocker.exe	26
PID 1652 wrote to memory of 2000	1652	Trojan-Ransom.Win32.Blocker.exe	26
PID 1652 wrote to memory of 2000	1652	Trojan-Ransom.Win32.Blocker.exe	26
PID 1652 wrote to memory of 1168	1652	Trojan-Ransom.Win32.Blocker.exe	29
PID 1652 wrote to memory of 1168	1652	Trojan-Ransom.Win32.Blocker.exe	29
PID 1652 wrote to memory of 1168	1652	Trojan-Ransom.Win32.Blocker.exe	29
PID 1652 wrote to memory of 1168	1652	Trojan-Ransom.Win32.Blocker.exe	29
PID 1652 wrote to memory of 1444	1652	Trojan-Ransom.Win32.Blocker.exe	28
PID 1652 wrote to memory of 1444	1652	Trojan-Ransom.Win32.Blocker.exe	28
PID 1652 wrote to memory of 1444	1652	Trojan-Ransom.Win32.Blocker.exe	28
PID 1652 wrote to memory of 1444	1652	Trojan-Ransom.Win32.Blocker.exe	28
PID 1652 wrote to memory of 1516	1652	Trojan-Ransom.Win32.Blocker.exe	30
PID 1652 wrote to memory of 1516	1652	Trojan-Ransom.Win32.Blocker.exe	30
PID 1652 wrote to memory of 1516	1652	Trojan-Ransom.Win32.Blocker.exe	30
PID 1652 wrote to memory of 1516	1652	Trojan-Ransom.Win32.Blocker.exe	30
PID 1652 wrote to memory of 1528	1652	Trojan-Ransom.Win32.Blocker.exe	31
PID 1652 wrote to memory of 1528	1652	Trojan-Ransom.Win32.Blocker.exe	31
PID 1652 wrote to memory of 1528	1652	Trojan-Ransom.Win32.Blocker.exe	31
PID 1652 wrote to memory of 1528	1652	Trojan-Ransom.Win32.Blocker.exe	31
PID 1652 wrote to memory of 1460	1652	Trojan-Ransom.Win32.Blocker.exe	27
PID 1652 wrote to memory of 1460	1652	Trojan-Ransom.Win32.Blocker.exe	27
PID 1652 wrote to memory of 1460	1652	Trojan-Ransom.Win32.Blocker.exe	27
PID 1652 wrote to memory of 1460	1652	Trojan-Ransom.Win32.Blocker.exe	27
PID 1652 wrote to memory of 1468	1652	Trojan-Ransom.Win32.Blocker.exe	33
PID 1652 wrote to memory of 1468	1652	Trojan-Ransom.Win32.Blocker.exe	33
PID 1652 wrote to memory of 1468	1652	Trojan-Ransom.Win32.Blocker.exe	33
PID 1652 wrote to memory of 1468	1652	Trojan-Ransom.Win32.Blocker.exe	33
PID 1652 wrote to memory of 828	1652	Trojan-Ransom.Win32.Blocker.exe	34
PID 1652 wrote to memory of 828	1652	Trojan-Ransom.Win32.Blocker.exe	34
PID 1652 wrote to memory of 828	1652	Trojan-Ransom.Win32.Blocker.exe	34
PID 1652 wrote to memory of 828	1652	Trojan-Ransom.Win32.Blocker.exe	34
PID 1652 wrote to memory of 1116	1652	Trojan-Ransom.Win32.Blocker.exe	32
PID 1652 wrote to memory of 1116	1652	Trojan-Ransom.Win32.Blocker.exe	32
PID 1652 wrote to memory of 1116	1652	Trojan-Ransom.Win32.Blocker.exe	32
PID 1652 wrote to memory of 1116	1652	Trojan-Ransom.Win32.Blocker.exe	32
PID 1652 wrote to memory of 816	1652	Trojan-Ransom.Win32.Blocker.exe	35
PID 1652 wrote to memory of 816	1652	Trojan-Ransom.Win32.Blocker.exe	35
PID 1652 wrote to memory of 816	1652	Trojan-Ransom.Win32.Blocker.exe	35
PID 1652 wrote to memory of 816	1652	Trojan-Ransom.Win32.Blocker.exe	35
PID 1652 wrote to memory of 888	1652	Trojan-Ransom.Win32.Blocker.exe	36
PID 1652 wrote to memory of 888	1652	Trojan-Ransom.Win32.Blocker.exe	36
PID 1652 wrote to memory of 888	1652	Trojan-Ransom.Win32.Blocker.exe	36
PID 1652 wrote to memory of 888	1652	Trojan-Ransom.Win32.Blocker.exe	36
PID 1652 wrote to memory of 340	1652	Trojan-Ransom.Win32.Blocker.exe	37
PID 1652 wrote to memory of 340	1652	Trojan-Ransom.Win32.Blocker.exe	37
PID 1652 wrote to memory of 340	1652	Trojan-Ransom.Win32.Blocker.exe	37
PID 1652 wrote to memory of 340	1652	Trojan-Ransom.Win32.Blocker.exe	37
PID 1652 wrote to memory of 108	1652	Trojan-Ransom.Win32.Blocker.exe	38
PID 1652 wrote to memory of 108	1652	Trojan-Ransom.Win32.Blocker.exe	38
PID 1652 wrote to memory of 108	1652	Trojan-Ransom.Win32.Blocker.exe	38
PID 1652 wrote to memory of 108	1652	Trojan-Ransom.Win32.Blocker.exe	38
PID 1652 wrote to memory of 1196	1652	Trojan-Ransom.Win32.Blocker.exe	39
PID 1652 wrote to memory of 1196	1652	Trojan-Ransom.Win32.Blocker.exe	39
PID 1652 wrote to memory of 1196	1652	Trojan-Ransom.Win32.Blocker.exe	39
PID 1652 wrote to memory of 1196	1652	Trojan-Ransom.Win32.Blocker.exe	39
PID 1652 wrote to memory of 1428	1652	Trojan-Ransom.Win32.Blocker.exe	40
PID 1652 wrote to memory of 1428	1652	Trojan-Ransom.Win32.Blocker.exe	40
PID 1652 wrote to memory of 1428	1652	Trojan-Ransom.Win32.Blocker.exe	40
PID 1652 wrote to memory of 1428	1652	Trojan-Ransom.Win32.Blocker.exe	40
PID 1652 wrote to memory of 1736	1652	Trojan-Ransom.Win32.Blocker.exe	41
PID 1652 wrote to memory of 1736	1652	Trojan-Ransom.Win32.Blocker.exe	41
PID 1652 wrote to memory of 1736	1652	Trojan-Ransom.Win32.Blocker.exe	41
PID 1652 wrote to memory of 1736	1652	Trojan-Ransom.Win32.Blocker.exe	41

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1652
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:2000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3300
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3864
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3600
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3828
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3672
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3832
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3852
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3364
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3924
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3832
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2756
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4016
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3552
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3300
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3892
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3212
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1444
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3980
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3980
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3812
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3712
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3628
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1168
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3212
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4004
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3436
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3852
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:1104
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1200
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1516
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3872
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3872
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3952
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3588
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2972
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1528
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3776
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3364
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3224
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:520
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:520
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3424
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3624
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3700
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3552
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3352
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3728
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:828
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3428
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3872
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3352
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4092
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:816
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3544
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3924
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3864
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3428
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:520
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3396
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:888
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3740
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3472
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:340
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3224
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4028
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3604
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3224
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3828
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3464
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:108
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3188
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3816
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3264
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3672
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3552
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3840
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3692
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2684
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3628
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4088
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3872
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3832
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3980
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3284
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3544
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1428
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3584
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2688
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:520
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3352
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3404
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3252
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3364
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3372
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3928
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3352
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3024
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3228
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:968
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3884
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2776
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3188
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3528
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:612
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3508
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3568
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3188
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3664
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3224
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3624
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2988
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:1968
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2756
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3372
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3552
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3656
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3520
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3264
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3940
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3268
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:2256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3212
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3832
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3188
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3372
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3700
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3628
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3512
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3788
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:2308
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3884
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3724
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4044
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3700
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3540
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:2372
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3252
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3924
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3952
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3672
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3828
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3300
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3848
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - System policy modification
  PID:2544
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3264
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3588
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3436
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3724

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "89970644-348234596-75797710-571900421-194466509419272225401746998027-1477377276"
1⤵
PID:3908

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1222605679-1045026014-132198809619964753-1326621487-12908586881555535125-278134189"
1⤵
PID:3856

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-632941098-322340920-2102029045-13471468441155288009-875965512-903235384-987762418"
1⤵
PID:2988

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16306831633218976181578226652073456870-11645958191291710828-1716197739-604439483"
1⤵
PID:3872

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1289138992-9860016596314907751690908219682984321-1620512145-98436337-1198123729"
1⤵
PID:3232

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1893881662-242737890-887087509-1721147078-5759834-1947141642055355263692640401"
1⤵
PID:2992

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "380117133-1125607627-82791961416803336532029917611214727715-406372669506675263"
1⤵
PID:3616

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1392218573-1246634980-408799805336474088150725390111604479301903450178-923051229"
1⤵
PID:3428

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1263915266-124958914520530173572075846017142117132319492101905512344-1761318283"
1⤵
PID:3880

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-198208283410413575531418733714-1383757124-19926086951657760095-2138813672-1376427395"
1⤵
PID:3048

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "9195380403238784818365420796214535432029313900-932382268-1767903117-1991906129"
1⤵
PID:3312

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "18332900941657703648432445202294499066-1812568143627036755-1928169398-1850378520"
1⤵
PID:4008

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-18494577651010022542-2093407994-1623962201416222602-17142615796551976391862366374"
1⤵
PID:2764

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1773138016-1111738455-2387950331296238550-329349411870686219-1907465732137786173"
1⤵
PID:3272

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1148280962-1159439887-89537514817910747441562261760810298429225624714-74828547"
1⤵
PID:3920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "162839848420820188401055995246-1231328471-16747665455136304189250292371877209239"
1⤵
PID:3196

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1316924406648161196925139720-144677314719304128501279853487-7785811141697740052"
1⤵
PID:3888

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1798418814-127790428918331407781769079513984653488127451436745362113665458495"
1⤵
PID:3340

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12544413131631498007178673618-1348216574815062783-350939009-1918557567-1638554058"
1⤵
PID:3480

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-315824615-1770216174-1721704711-1380098691-940242707-18582879931269087719-1705262332"
1⤵
PID:3200

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "658987908-130390415569992817120584877101148595745-498412385628594436-386016"
1⤵
PID:3736

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1276226682-1896155666-1507122365209362347415134628512275150891127588101319365168"
1⤵
PID:2784

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1880914116914353923-603518868-975770948-771163081-897612887-1667841049-255722901"
1⤵
PID:3640

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-522404762154074003-613453096-1637062010-11989606516950160926949169191801414680"
1⤵
PID:1484

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "695187411-308742508133694584398643751-743495175245597960-606948052-532521808"
1⤵
PID:3360

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12431975514301874972034287959-1395415456-1361455469-1932595005-182466998932536305"
1⤵
PID:3440

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "340620345-3836803491858901407-129181334311787308111543849482881608488-1372168427"
1⤵
PID:3244

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1883489655-4855911111456079219-1393516375600941718-828016086488387865660142203"
1⤵
PID:3956

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1641278060-1008005188562940796705716892-646176420-1691759007863632549859097378"
1⤵
PID:3432

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "131374020518404313771822351450-10212304871195850240-5687994912069923040-1588781809"
1⤵
PID:3032

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-63153897814380565051357926188-1658169324-5234277891567660451523588843-441357733"
1⤵
PID:3760

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1115030213-92906129-1904989504-1296846508-912484184107032666-644932177222931357"
1⤵
PID:3744

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "8535896572660200131267512936-58278232-1910297340-383785486-1603755337345752334"
1⤵
PID:3684

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1678462243-1933758504-1533456919-135061152817573898991814361883543457689802380530"
1⤵
PID:3320

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1971723678-857273895-942198409-4118706822100810699220780491-2961490801866075969"
1⤵
PID:3708

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2137254110-1982756726-527224881-1007563288-376350992137922208655824641765331632"
1⤵
PID:3724

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2460373661155146527-616866736-15885330891419694475-1254587403-1328368479-1196052667"
1⤵
PID:3332

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "6838827491218777468-8853815033966749123165216011772619311-2055587973-1204590962"
1⤵
PID:2628

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2152011081944880129-145488571422135410-1119033048-70746468680987372-1012209733"
1⤵
PID:2740

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "615086621-687427423-1951972596-1698357431119059171589935249921105112791303125841"
1⤵
PID:3728

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-555088581-299108446-19987698321857487470-497654923-1358475115-234326719-1264817359"
1⤵
PID:3416

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-761776881594114556115439453-231028562-829415419-1941815200-674853443306584283"
1⤵
PID:3476

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1050511061721288087666993109396223606-1412893331-1338854911846714344232355405"
1⤵
PID:2816

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-14703573182084928464-382901839-11320056576583846061428012579-13437968061977714076"
1⤵
PID:3600

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1701197481736069623-1689603813-772796052134326720-1925374589-169371592965082530"
1⤵
PID:4072

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1031743601836266893-1268691576-14915396461018471775-1476971591-997778962-29122571"
1⤵
PID:4044

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "547635418-1394392088-16723707516592269314690539872137892205-3495944711223150664"
1⤵
PID:3052

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "456565254-968904251640797295-7836939391199303182-2083628819-1461855692-1492469859"
1⤵
PID:3780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-126666748-1488756649-26022798306918851944161463-1288124390-894156817-2126526568"
1⤵
PID:3472

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "10215421991881982553396060984-1458636545715594392-1927494730626018548-573301961"
1⤵
PID:2992

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9685965671272603623-28043517-1994528346-143375800919276758021238162756-1014215850"
1⤵
PID:3932

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2074356851-1754878304766959041224868737-615292958-1673327135-1644925725-2010464289"
1⤵
PID:2712

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "17307484571361254504-199553322656593154-5557711621850168807-18464712831433250170"
1⤵
PID:3884

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-27127138618156563392114171662-944475619-495053188150454876718997511481499789449"
1⤵
PID:3488

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1710869802545437615566941868857060293-1425896688-1714204383664506731-597609126"
1⤵
PID:3008

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1854682615-1448870200-986664557287702018-1604093336-1861022354-1070320368-1704767597"
1⤵
PID:3064

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "211788630920982201851485546070-17503613131888539896-5482557241635057383-1795024899"
1⤵
PID:3428

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "141278456-1567178166-39294120826184433074637513417973290901918872364-1130604356"
1⤵
PID:4000

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "378335656-1880522521975864301-1272278523-1665918139-255816044422572143197948341"
1⤵
PID:4028

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "90868845-10472172078986606971584376894-1863776115-10151703081590157955-40143100"
1⤵
PID:2980

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "6519398475390963301894372763-24794011917491579651578276223-1092003831038110017"
1⤵
PID:3924

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13247365762116405742846402732009787673-1804272208547522908-4227851281139926833"
1⤵
PID:4020

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "157221762295141490211451498971760521170-212466084-74726832772404288-1404027997"
1⤵
PID:3016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19328629932037297431-157601269819744670036829807594455660621868224525-1226145802"
1⤵
PID:1988

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "961097686127921109-15343674494809993412110306944-1357168794-824631366-1034703130"
1⤵
PID:3672

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1948952141-1441452258-1610217441-1726158179171037808-5724014361563115349-270966598"
1⤵
PID:3308

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "19000117831329148212-1105490762-1475292091-590761805955283579-10693717021673508561"
1⤵
PID:3012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-29674836014093636191469842416-100232020-1975553189132600391372233451449802807"
1⤵
PID:2608

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "16309953141739779373-158558759813983859631642821582-1761642334-390260369794331744"
1⤵
PID:3280

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-8262413181530361676232274488442326384-18534552242466235275557362362114259520"
1⤵
PID:3808

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-180390288455557671283958348-1248117481134216393-11916432694072858591759846811"
1⤵
PID:3668

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1185547244-1130998476-1403539762-572261224-1063214979-1667235879-1942825138-1700358610"
1⤵
PID:3640

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1902596167654044205-6515458351898745340-95946433714634999551011253841769736152"
1⤵
PID:3204

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "244956514-21465256151944476791656818240-1215873494-2119885360-1713039052-865984627"
1⤵
PID:3656

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-178470313783495812-1384889683632610321-295225993-310438595-2128921350-1323333493"
1⤵
PID:4084

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1478403775-324300594-20197602051316418623-2078299418-1860250821860624030-2000411286"
1⤵
PID:3864

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-214142641-22480313-1772902442-642120510-1801308292086628691-2108997402-1957277308"
1⤵
PID:3520

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2144814386-189379394410532320921506807910591610841-11548267961683128356-262516783"
1⤵
PID:3716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "226577616-117560240819700557941136849426-2112611993-1336508623167751933-175952117"
1⤵
PID:3736

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "90464607-1748606482664737730-79117350721437102021636754516-183212414459852638"
1⤵
PID:3440

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1715976442883366434-276209211-2197264191807862568171042600416805663031255659230"
1⤵
PID:4016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-14802008461254478232-187387094515085305326212641010308663148472407912098707568"
1⤵
PID:3856

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "723018118-257392162339148249-568889028-15427549237440889921942428497-2042221469"
1⤵
PID:3500

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-68184937117501215621194013450-613272558-1711910997-2080108486-16293940301156974805"
1⤵
PID:3008

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1597900378906127671219012244-6674627081836478145178128625616663950341943599973"
1⤵
PID:3476

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-396545803-323053727-933544565473924244-745175093-4109635502025069598-957764403"
1⤵
PID:4040

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-685010754-861565117-18708589807371777272021120033227804891-1874041707507860839"
1⤵
PID:3988

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-6296079318555916811345560450161772288-905500627-1871713137-130111541-2038123629"
1⤵
PID:4048

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2127293028-31585115917328781572003773613593817924-1530901588-1184262589-314963130"
1⤵
PID:2796

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13921584271941926951603850369-9774989311533284686-14193811011432366910-1871345689"
1⤵
PID:3676

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "19008482337944002-451047665678091436-1615777613780104510-13823236301442038563"
1⤵
PID:2996

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-3199348371443012395-707100417-552520256-11918937741186867087188109253-75233237"
1⤵
PID:2804

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "8637458411766148541854786180-625756860-171530688612342689441241632656-2027356036"
1⤵
PID:520

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12610689141766270258-1727506517191743523-1201323391-1125955108-187016001519985223"
1⤵
PID:2672

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1899166635-151823275862018467-109288109869928209-93672601878719244-624297269"
1⤵
PID:4012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-53734659212940645111476647208892937419111754484365441894618708033061964717509"
1⤵
PID:3704

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1158194103-180807169120011857671735396092-29626386717855769611173518017-1213409667"
1⤵
PID:2660

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1920144328879099572-946950778-11305285421453335000-373251369-907904431-1976764778"
1⤵
PID:3860

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1287106503318823044322819936802667581904781787103803063319745324111032339376"
1⤵
PID:3904

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "649972029-1743198645996674981-330527814-49848750713004177241195535727-1581156288"
1⤵
PID:3176

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-62174875-1041261030473618027-1603209910-1620816476320317297-1208988773-1744673960"
1⤵
PID:4080

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12729821641875116831-598355716-219192868305383595-664454349-404888867818612466"
1⤵
PID:3508

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1189260093530558492-394102301-8770056721188201220-1627292352-26036541526364417"
1⤵
PID:3596

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "204097022374406067-1329098202-3978605735658405181721109345-2957794712022009296"
1⤵
PID:2976

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-137310422157700911576463529712208390-1303607273-821073118678509649-2098528036"
1⤵
PID:2644

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1360228064-34924422198588331416986966641740919941-4183534791839579585945336215"
1⤵
PID:3200

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-695941068401396543-11207038571343640629-20933220981087586983-1668093328-1031044317"
1⤵
PID:2756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-619650942-253100282-17811416471849045229165741507-454172621225955845-1023515455"
1⤵
PID:3920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "962453480-1116437937600267455-1441147862-10992570661464907563283196927-1301793028"
1⤵
PID:3468

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-289883972-1334505877-516555260-1004097527492880807909697041-448399861218743672"
1⤵
PID:3204

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1749177878-676358011-1688680644-540246690-93286304-725558985-3961399821860219413"
1⤵
PID:2612

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1077708042-443044635721915623-835067222820129722511592391-20306620191816511718"
1⤵
PID:3480

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1174566806-20839267101154095490-6172478671675279120-589203753481737343-639518128"
1⤵
PID:3948

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2133910898740753930-903360526462962110-733271306-516226142-8830020732107220251"
1⤵
PID:3240

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1252507866530748784808030159382946718-240705489-2037484404-660154805-2095642679"
1⤵
PID:4040

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-3835512010002282007749581332113751297-114568866776273244622023736-1301204173"
1⤵
PID:3036

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-626065797-13120838241715828021235543514-2105938446-1163004621157430148-1632447676"
1⤵
PID:3968

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-6918238861255865346-1493321726423103269-239966004-268330271-2054057923112509183"
1⤵
PID:1200

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-117106721010123693471255788900526723303752616230-66143387-594374079-757469796"
1⤵
PID:3652

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1948642268-127520582216518637579297433-1102151011-11792213601435163256836729648"
1⤵
PID:3436

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "345880588-10575422791837701867-51448814-38721057686344563410244121361917851450"
1⤵
PID:3828

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-98566035612421808271270404403-997782001571277597-771446567-2503864981245251803"
1⤵
PID:3752

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1113383473-105414201574801923619385691941554690182-10263507091475931444369917326"
1⤵
PID:3264

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1541149814-254825782-1761916758-259337690-842004169-1458275992-1599203988-535291028"
1⤵
PID:3700

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1557327488-15985952471734080128964446376-42233202299979224317185627531098935686"
1⤵
PID:3564

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1926410536-787345236-247431820-1611682348-39375920710454519561240406778-1663049821"
1⤵
PID:1664

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1851824136-1362908559-2129072023-1127131354634604676344085480114753980-1617047667"
1⤵
PID:2784

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-490785854-270413963-1464361687373906132-1739221977-1628374101-692262277673182633"
1⤵
PID:3872

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-459915424-20326225101149407626-884296658856770399-715552270770986753-1173946393"
1⤵
PID:4064

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1486945246-8085206791560698155-1641192993314901212-660742055-21052366452065169303"
1⤵
PID:1956

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "10777839559317739411956867554505307761746713830100428124112990547551201743707"
1⤵
PID:3208

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12036052841448148786-1355485716-1417311132-1259832706-458650482-1695053325-1558285584"
1⤵
PID:3256

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-718098842-1003537184-20977163019867655342073976275177393519615697046032131725369"
1⤵
PID:1200

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16789116489682680101509539209-663389563-498712688-1511182267-12940123811989315718"
1⤵
PID:3876

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2144852966-1984642724-485513611-589043124-15058875021723671858199753318191884195"
1⤵
PID:3880

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2596123881910606104-16962511051292592768-350238016-344178460604662664-1527447470"
1⤵
PID:3376

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "11084160671765711758-590137098154145758221358603591142542226-2022858232-466729977"
1⤵
PID:3340

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3103540861128266543-8729760391121769949530160231-1526336395707934996-1905495812"
1⤵
PID:2628

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-429820415-3661664241795402803-820455176903689317-11393375301470581084-884960226"
1⤵
PID:3260

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1272854102-13930124872014397821734691774799227184-5051413981805049714-1750746158"
1⤵
PID:2668

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "370432859406040471-4189726641215062961-1378030261-743314951-1736348615-806255784"
1⤵
PID:3504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-7428674397160742911212558899-1056215821-425709859-99836295648687108021115200"
1⤵
PID:2788

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1446621141434491173-7609009401453642685162299064-1003970032-1347450096-1860546986"
1⤵
PID:4088

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19165878281927888751468980754-59212907-13905267731696053498-160165724374490634"
1⤵
PID:2800

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1560892286552149558-1854619888-1290592196-1862859780449826059784806883-1314391569"
1⤵
PID:3956

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1446302131532734115-1157114729-984092010-1808366370-1094039730180584468685940771"
1⤵
PID:3840

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2014843259-3887169921485244055-618021773-110117935-750361765-1260863562-925497066"
1⤵
PID:3820

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "4178090741153993625983950578-15925810132140065356-1977852039-17815564201165847202"
1⤵
PID:3060

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1167783108-1103746651556727969-1684217297-11315015661852792969472812239-1416494954"
1⤵
PID:3732

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1263952406-1118252251-1276313652-5617486601186370636-2093589125-1834229419-830746074"
1⤵
PID:3172

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-289650373-1939275183-11071033891156545954699628058-106194651-423859109-132737143"
1⤵
PID:1104

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "782854727-113869014-726815269-1322423372-1971539125197137620117587484651482560153"
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
memory/108-85-0x0000000000000000-mapping.dmp

Download
memory/340-82-0x0000000000000000-mapping.dmp

Download
memory/612-103-0x0000000000000000-mapping.dmp

Download
memory/660-97-0x0000000000000000-mapping.dmp

Download
memory/816-67-0x0000000000000000-mapping.dmp

Download
memory/828-64-0x0000000000000000-mapping.dmp

Download
memory/888-79-0x0000000000000000-mapping.dmp

Download
memory/968-100-0x0000000000000000-mapping.dmp

Download
memory/1116-65-0x0000000000000000-mapping.dmp

Download
memory/1168-58-0x0000000000000000-mapping.dmp

Download
memory/1196-88-0x0000000000000000-mapping.dmp

Download
memory/1428-91-0x0000000000000000-mapping.dmp

Download
memory/1444-59-0x0000000000000000-mapping.dmp

Download
memory/1460-62-0x0000000000000000-mapping.dmp

Download
memory/1468-63-0x0000000000000000-mapping.dmp

Download
memory/1516-60-0x0000000000000000-mapping.dmp

Download
memory/1528-61-0x0000000000000000-mapping.dmp

Download
memory/1652-66-0x0000000002130000-0x0000000002140000-memory.dmp

Filesize
64KB

Download
memory/1652-56-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/1652-54-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/1652-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1736-94-0x0000000000000000-mapping.dmp

Download
memory/1968-106-0x0000000000000000-mapping.dmp

Download
memory/2000-57-0x0000000000000000-mapping.dmp

Download
memory/2256-109-0x0000000000000000-mapping.dmp

Download
memory/2308-112-0x0000000000000000-mapping.dmp

Download
memory/2372-115-0x0000000000000000-mapping.dmp

Download
memory/2544-118-0x0000000000000000-mapping.dmp

Download
memory/2756-152-0x0000000000000000-mapping.dmp

Download
memory/2784-150-0x0000000000000000-mapping.dmp

Download
memory/2816-151-0x0000000000000000-mapping.dmp

Download
memory/3164-126-0x0000000000000000-mapping.dmp

Download
memory/3172-121-0x0000000000000000-mapping.dmp

Download
memory/3180-122-0x0000000000000000-mapping.dmp

Download
memory/3188-128-0x0000000000000000-mapping.dmp

Download
memory/3196-123-0x0000000000000000-mapping.dmp

Download
memory/3204-124-0x0000000000000000-mapping.dmp

Download
memory/3212-130-0x0000000000000000-mapping.dmp

Download
memory/3220-132-0x0000000000000000-mapping.dmp

Download
memory/3228-129-0x0000000000000000-mapping.dmp

Download
memory/3236-134-0x0000000000000000-mapping.dmp

Download
memory/3244-137-0x0000000000000000-mapping.dmp

Download
memory/3252-125-0x0000000000000000-mapping.dmp

Download
memory/3260-135-0x0000000000000000-mapping.dmp

Download
memory/3268-127-0x0000000000000000-mapping.dmp

Download
memory/3276-131-0x0000000000000000-mapping.dmp

Download
memory/3284-136-0x0000000000000000-mapping.dmp

Download
memory/3292-133-0x0000000000000000-mapping.dmp

Download
memory/3300-139-0x0000000000000000-mapping.dmp

Download
memory/3308-143-0x0000000000000000-mapping.dmp

Download
memory/3316-144-0x0000000000000000-mapping.dmp

Download
memory/3324-141-0x0000000000000000-mapping.dmp

Download
memory/3332-140-0x0000000000000000-mapping.dmp

Download
memory/3340-138-0x0000000000000000-mapping.dmp

Download
memory/3348-142-0x0000000000000000-mapping.dmp

Download
memory/3392-154-0x0000000000000000-mapping.dmp

Download
memory/3396-153-0x0000000000000000-mapping.dmp

Download
memory/3412-156-0x0000000000000000-mapping.dmp

Download
memory/3460-155-0x0000000000000000-mapping.dmp

Download
memory/3572-158-0x0000000000000000-mapping.dmp

Download
memory/3580-157-0x0000000000000000-mapping.dmp

Download
memory/3620-159-0x0000000000000000-mapping.dmp

Download
memory/3636-160-0x0000000000000000-mapping.dmp

Download
memory/3904-145-0x0000000000000000-mapping.dmp

Download
memory/3912-146-0x0000000000000000-mapping.dmp

Download
memory/3960-147-0x0000000000000000-mapping.dmp

Download
memory/3972-148-0x0000000000000000-mapping.dmp

Download
memory/4072-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads