16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
Size

449KB
MD5

09b477552c14bd308566c973313c25a0
SHA1

eb417d24393a8a150be23d0fdb70698afdead026
SHA256

16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
SHA512

5b7f715b5bbfd79b49f48e2473a6c166ca912fc6b97b638450a6741cb0c7af2d74f16eff4dea97335247b284364e265aee084778a29851a688899b137ff21cfb
SSDEEP

6144:Ufapylgf1mq29CwaWGpAsedfdz53zRBk2kU+DO3gHq1R9Fxjp/c/c:Uw1mq2ci95tBEU+DSy4Hb/Oc

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 22 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 22 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
360	zmoQAcIQ.exe
2720	nCsUoMIk.exe
3660	PiswAIIs.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	nCsUoMIk.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmoQAcIQ.exe = "C:\\Users\\Admin\\YqcQsQMk\\zmoQAcIQ.exe"	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nCsUoMIk.exe = "C:\\ProgramData\\QyMgwYEI\\nCsUoMIk.exe"	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmoQAcIQ.exe = "C:\\Users\\Admin\\YqcQsQMk\\zmoQAcIQ.exe"	zmoQAcIQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nCsUoMIk.exe = "C:\\ProgramData\\QyMgwYEI\\nCsUoMIk.exe"	nCsUoMIk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nCsUoMIk.exe = "C:\\ProgramData\\QyMgwYEI\\nCsUoMIk.exe"	PiswAIIs.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\YqcQsQMk	PiswAIIs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\YqcQsQMk\zmoQAcIQ	PiswAIIs.exe
File created	C:\Windows\SysWOW64\shell32.dll.exe	nCsUoMIk.exe
File opened for modification	C:\Windows\SysWOW64\sheOpenDeny.png	nCsUoMIk.exe
File opened for modification	C:\Windows\SysWOW64\sheRevokeConvertTo.wma	nCsUoMIk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
3624	reg.exe
3940	reg.exe
1144	reg.exe
3712	reg.exe
4296	reg.exe
3712	reg.exe
2568	reg.exe
3428	reg.exe
4252	reg.exe
4308	reg.exe
4204	reg.exe
1100	reg.exe
1436	reg.exe
4712	reg.exe
1468	reg.exe
3180	reg.exe
3992	reg.exe
4520	reg.exe
4120	reg.exe
4956	reg.exe
2508	reg.exe
3424	reg.exe
4564	reg.exe
5052	reg.exe
4356	reg.exe
4500	reg.exe
4812	reg.exe
1120	reg.exe
3196	reg.exe
4400	reg.exe
4416	reg.exe
4812	reg.exe
1192	reg.exe
836	reg.exe
3604	reg.exe
736	reg.exe
3532	reg.exe
2068	reg.exe
5068	reg.exe
3948	reg.exe
2032	reg.exe
4612	reg.exe
3124	reg.exe
3432	reg.exe
4260	reg.exe
3760	reg.exe
1600	reg.exe
4240	reg.exe
5032	reg.exe
1992	reg.exe
2508	reg.exe
3388	reg.exe
3460	reg.exe
3868	reg.exe
3504	reg.exe
4268	reg.exe
4668	reg.exe
3620	reg.exe
3020	reg.exe
4092	reg.exe
2736	reg.exe
1088	reg.exe
1436	reg.exe
832	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
8	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
8	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
8	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
8	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3052	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3052	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3052	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3052	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3188	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3188	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3188	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3188	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4704	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4704	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4704	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4704	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3912	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3912	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3912	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3912	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4976	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4976	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4976	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4976	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4388	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4388	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4388	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4388	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4436	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4436	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4436	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
4436	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3760	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3760	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3760	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3760	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3500	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3500	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3500	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
3500	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
832	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
832	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
832	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
832	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
1568	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
1568	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
1568	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
1568	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
5008	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
5008	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
5008	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
5008	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	nCsUoMIk.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe
2720	nCsUoMIk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 360	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	83
PID 4884 wrote to memory of 360	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	83
PID 4884 wrote to memory of 360	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	83
PID 4884 wrote to memory of 2720	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	84
PID 4884 wrote to memory of 2720	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	84
PID 4884 wrote to memory of 2720	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	84
PID 4884 wrote to memory of 4480	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	86
PID 4884 wrote to memory of 4480	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	86
PID 4884 wrote to memory of 4480	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	86
PID 4884 wrote to memory of 3196	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	89
PID 4884 wrote to memory of 3196	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	89
PID 4884 wrote to memory of 3196	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	89
PID 4480 wrote to memory of 4288	4480	cmd.exe	88
PID 4480 wrote to memory of 4288	4480	cmd.exe	88
PID 4480 wrote to memory of 4288	4480	cmd.exe	88
PID 4884 wrote to memory of 4260	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	90
PID 4884 wrote to memory of 4260	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	90
PID 4884 wrote to memory of 4260	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	90
PID 4884 wrote to memory of 4356	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	91
PID 4884 wrote to memory of 4356	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	91
PID 4884 wrote to memory of 4356	4884	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	91
PID 4288 wrote to memory of 4192	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	95
PID 4288 wrote to memory of 4192	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	95
PID 4288 wrote to memory of 4192	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	95
PID 4192 wrote to memory of 392	4192	cmd.exe	97
PID 4192 wrote to memory of 392	4192	cmd.exe	97
PID 4192 wrote to memory of 392	4192	cmd.exe	97
PID 4288 wrote to memory of 2736	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	98
PID 4288 wrote to memory of 2736	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	98
PID 4288 wrote to memory of 2736	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	98
PID 4288 wrote to memory of 3460	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	105
PID 4288 wrote to memory of 3460	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	105
PID 4288 wrote to memory of 3460	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	105
PID 4288 wrote to memory of 1144	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	104
PID 4288 wrote to memory of 1144	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	104
PID 4288 wrote to memory of 1144	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	104
PID 4288 wrote to memory of 5056	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	101
PID 4288 wrote to memory of 5056	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	101
PID 4288 wrote to memory of 5056	4288	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	101
PID 5056 wrote to memory of 3032	5056	cmd.exe	106
PID 5056 wrote to memory of 3032	5056	cmd.exe	106
PID 5056 wrote to memory of 3032	5056	cmd.exe	106
PID 392 wrote to memory of 740	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	107
PID 392 wrote to memory of 740	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	107
PID 392 wrote to memory of 740	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	107
PID 740 wrote to memory of 8	740	cmd.exe	109
PID 740 wrote to memory of 8	740	cmd.exe	109
PID 740 wrote to memory of 8	740	cmd.exe	109
PID 392 wrote to memory of 1192	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	110
PID 392 wrote to memory of 1192	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	110
PID 392 wrote to memory of 1192	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	110
PID 392 wrote to memory of 3712	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	111
PID 392 wrote to memory of 3712	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	111
PID 392 wrote to memory of 3712	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	111
PID 392 wrote to memory of 836	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	113
PID 392 wrote to memory of 836	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	113
PID 392 wrote to memory of 836	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	113
PID 392 wrote to memory of 1472	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	115
PID 392 wrote to memory of 1472	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	115
PID 392 wrote to memory of 1472	392	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	115
PID 8 wrote to memory of 4548	8	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	118
PID 8 wrote to memory of 4548	8	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	118
PID 8 wrote to memory of 4548	8	16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe	118
PID 1472 wrote to memory of 4580	1472	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
"C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\YqcQsQMk\zmoQAcIQ.exe
  "C:\Users\Admin\YqcQsQMk\zmoQAcIQ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:360
- C:\ProgramData\QyMgwYEI\nCsUoMIk.exe
  "C:\ProgramData\QyMgwYEI\nCsUoMIk.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
    C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:392
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        10⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        12⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        13⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        14⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        15⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        16⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        17⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        18⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        19⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        20⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        22⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        23⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        24⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        25⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        26⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        27⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        28⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        30⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        31⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        32⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        33⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        34⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        35⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        36⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        37⤵
        
        PID:400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        38⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        39⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        40⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        41⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        42⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe
        
        C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116
        43⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116"
        44⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        44⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4520
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        44⤵
        Modifies registry key
        
        PID:1468
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        44⤵
        UAC bypass
        Modifies registry key
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zyUYoogw.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        44⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        45⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        42⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IcMYoQIE.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        42⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        43⤵
        
        PID:452
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        42⤵
        UAC bypass
        Modifies registry key
        
        PID:5068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        42⤵
        
        PID:856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RqoscoUI.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        40⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        UAC bypass
        Modifies registry key
        
        PID:3620
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        Modifies registry key
        
        PID:4308
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        Modifies registry key
        
        PID:4252
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        UAC bypass
        Modifies registry key
        
        PID:4712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mOYMUocM.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        38⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FuAAcEMQ.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        36⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        UAC bypass
        Modifies registry key
        
        PID:2068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        Modifies registry key
        
        PID:1120
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3940
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qasYsEEw.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        34⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        UAC bypass
        Modifies registry key
        
        PID:4668
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        Modifies registry key
        
        PID:3432
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        Modifies registry key
        
        PID:3428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        UAC bypass
        Modifies registry key
        
        PID:3532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ruoMsgow.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        32⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MSUkEMEo.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        30⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        UAC bypass
        Modifies registry key
        
        PID:3124
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        Modifies registry key
        
        PID:736
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        UAC bypass
        Modifies registry key
        
        PID:4120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CqcEwEEM.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        28⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        Modifies registry key
        
        PID:4416
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GoQQYQsQ.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        26⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        UAC bypass
        Modifies registry key
        
        PID:3712
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        Modifies registry key
        
        PID:4400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UKMsYkkE.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        24⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        UAC bypass
        Modifies registry key
        
        PID:4612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        Modifies registry key
        
        PID:4564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FuEsAwQo.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        22⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        UAC bypass
        Modifies registry key
        
        PID:3020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        Modifies registry key
        
        PID:3424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4268
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        UAC bypass
        Modifies registry key
        
        PID:2032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aAUIQIEE.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        20⤵
        
        PID:536
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:1100
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies visibility of file extensions in Explorer
        
        PID:4500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:5052
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        UAC bypass
        Modifies registry key
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qwAQEQwY.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        18⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        
        PID:752
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        Modifies registry key
        
        PID:3868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        UAC bypass
        Modifies registry key
        
        PID:832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAIUosEQ.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        16⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3992
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygMMAUIY.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        14⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        UAC bypass
        Modifies registry key
        
        PID:4204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        Modifies registry key
        
        PID:3948
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        UAC bypass
        Modifies registry key
        
        PID:1436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msosEIsg.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        12⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1088
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        Modifies registry key
        
        PID:3180
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        Modifies registry key
        
        PID:4812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\faEMUkQo.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        10⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:4240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:5032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mwwMUgkM.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        8⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        
        PID:3468
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1192
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:3712
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:836
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\seYQUksk.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        
        PID:4580
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies registry key
      PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TQoQIYsA.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:3032
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:1144
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:3460
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies registry key
  PID:3196
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:4260
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RQokYQoQ.bat" "C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116.exe""
  2⤵
  PID:3728
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:4632

C:\ProgramData\KaYYUwos\PiswAIIs.exe
C:\ProgramData\KaYYUwos\PiswAIIs.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\KaYYUwos\PiswAIIs.exe

Filesize
433KB

MD5
2c171f019c9e9dc986fa72e66c7c076c

SHA1
4b8f43404ebb064d60735082f126ac400aa8a86f

SHA256
3e9819f4445c3cd37a22ab044c290a08bfaadd8b048f770070150932b35fff3a

SHA512
ea84c504e6719419f8b4cacd882b0814794a29aca06fa4ce2f306abaddca3f072ece8e02ca600f89fb47650531978015225294aadf22c368666d9a308fe53ae1

Download Submit
C:\ProgramData\KaYYUwos\PiswAIIs.exe

Filesize
433KB

MD5
2c171f019c9e9dc986fa72e66c7c076c

SHA1
4b8f43404ebb064d60735082f126ac400aa8a86f

SHA256
3e9819f4445c3cd37a22ab044c290a08bfaadd8b048f770070150932b35fff3a

SHA512
ea84c504e6719419f8b4cacd882b0814794a29aca06fa4ce2f306abaddca3f072ece8e02ca600f89fb47650531978015225294aadf22c368666d9a308fe53ae1

Download Submit
C:\ProgramData\QyMgwYEI\nCsUoMIk.exe

Filesize
434KB

MD5
36f76c72ff11d32bc0a17abdc8be9aee

SHA1
462b7af1f32a831c411566565b0fa5c1f62dfc7b

SHA256
84f23d07733275b9bfc789297dfc69984e6a649760cb696f9d1b0c3dd1f02822

SHA512
025e7b0371a8b31237228f6ceb1343b8fe1e59cdf882586d02378bce04968c437145cec7bb26572b8eae1afc5656c31b8b7ac331ec0bb55310481383bcea334f

Download Submit
C:\ProgramData\QyMgwYEI\nCsUoMIk.exe

Filesize
434KB

MD5
36f76c72ff11d32bc0a17abdc8be9aee

SHA1
462b7af1f32a831c411566565b0fa5c1f62dfc7b

SHA256
84f23d07733275b9bfc789297dfc69984e6a649760cb696f9d1b0c3dd1f02822

SHA512
025e7b0371a8b31237228f6ceb1343b8fe1e59cdf882586d02378bce04968c437145cec7bb26572b8eae1afc5656c31b8b7ac331ec0bb55310481383bcea334f

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd81b8df740f868eb14f1a657e37c343554156f256a0c8bedb2027dea0d116

Filesize
6KB

MD5
1c17c162defdab9d945161e028a65b7b

SHA1
57b06993552a571eaacddb9836b72525120b04db

SHA256
ac791b7dd63587134076d1b62f91de3710266be921b04f89c0ac4840d6531ef4

SHA512
e1ac6cd5fc6970da778931f41aad2c980829a97af12eac6c1792539bc65146f680b17ec21bbec2a4ba34e8770d563e3467ac787dbb5a81dd9dc04b7bde9b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CAIUosEQ.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\CqcEwEEM.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\FuAAcEMQ.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\FuEsAwQo.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\GoQQYQsQ.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSUkEMEo.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\RQokYQoQ.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\RqoscoUI.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\TQoQIYsA.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\UKMsYkkE.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\aAUIQIEE.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\faEMUkQo.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\mOYMUocM.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\msosEIsg.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\mwwMUgkM.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\qasYsEEw.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwAQEQwY.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\ruoMsgow.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\seYQUksk.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\ygMMAUIY.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\YqcQsQMk\zmoQAcIQ.exe

Filesize
434KB

MD5
0ce8849ca40a4ce7374de881043aafa1

SHA1
6eb8255127e1cc2399a865c03ccc08058e497ae2

SHA256
a8b5b9fb3fd28952abb8e680d00d39a04fa22e94e8bc893667c554263ddfc822

SHA512
3908ebc0c51e634addf82fe85bf0b7968344c3cb531e182ce1ef43ed4a994e26f097dcff968ef78674892ed11842561fd1dcd6bb871c5ba4894a94a69d0f9cbb

Download Submit
C:\Users\Admin\YqcQsQMk\zmoQAcIQ.exe

Filesize
434KB

MD5
0ce8849ca40a4ce7374de881043aafa1

SHA1
6eb8255127e1cc2399a865c03ccc08058e497ae2

SHA256
a8b5b9fb3fd28952abb8e680d00d39a04fa22e94e8bc893667c554263ddfc822

SHA512
3908ebc0c51e634addf82fe85bf0b7968344c3cb531e182ce1ef43ed4a994e26f097dcff968ef78674892ed11842561fd1dcd6bb871c5ba4894a94a69d0f9cbb

Download Submit
memory/8-177-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/8-170-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/360-144-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/360-283-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/392-167-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/400-279-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-255-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-258-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1568-261-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2720-294-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2720-146-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2780-275-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3052-190-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3188-197-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3500-253-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3660-148-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3760-247-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3760-245-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3912-222-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4040-271-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4176-292-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4260-293-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4288-156-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4388-239-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4436-244-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4704-211-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4884-282-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4884-289-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4884-132-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4976-232-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4976-229-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/5008-265-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/5008-267-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/5056-286-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/5056-284-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download