Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 21:49
Static task
static1
Behavioral task
behavioral1
Sample
10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe
Resource
win10v2004-20221111-en
General
-
Target
10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe
-
Size
213KB
-
MD5
9246f749d1f6df1856a5f70f1a20fd30
-
SHA1
adf16a1cc1ff97c5e7418d9fae22bdf8aad20bf2
-
SHA256
10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0
-
SHA512
f1fc3e8aa77a7d1ce078a69290714a6eef06e4fa8907313041475d151f35423b2a547593e77a0a97246e8bcc1d587b3a38e18c5f7df125a7e092e4408d1e876f
-
SSDEEP
6144:R88HEHyWldQMPnaewqzqIJkUjAEyFo16IEXnvlzjdWJnFZ:R88HEt+FeRMvl8FZ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 6 IoCs
Processes:
xsMYUowA.exeEAwYIQgk.exexsMYUowA.exeEAwYIQgk.exexsMYUowA.exeEAwYIQgk.exepid process 4680 xsMYUowA.exe 2648 EAwYIQgk.exe 4260 xsMYUowA.exe 5000 EAwYIQgk.exe 3132 xsMYUowA.exe 4884 EAwYIQgk.exe -
Adds Run key to start application 2 TTPs 12 IoCs
Processes:
10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exexsMYUowA.exeEAwYIQgk.exexsMYUowA.exeEAwYIQgk.exexsMYUowA.exeEAwYIQgk.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EAwYIQgk.exe = "C:\\ProgramData\\saEgQgMs\\EAwYIQgk.exe" 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EAwYIQgk.exe = "C:\\ProgramData\\saEgQgMs\\EAwYIQgk.exe" 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsMYUowA.exe = "C:\\Users\\Admin\\umcwocEU\\xsMYUowA.exe" 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EAwYIQgk.exe = "C:\\ProgramData\\saEgQgMs\\EAwYIQgk.exe" 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsMYUowA.exe = "C:\\Users\\Admin\\umcwocEU\\xsMYUowA.exe" xsMYUowA.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsMYUowA.exe = "C:\\Users\\Admin\\umcwocEU\\xsMYUowA.exe" 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EAwYIQgk.exe = "C:\\ProgramData\\saEgQgMs\\EAwYIQgk.exe" EAwYIQgk.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsMYUowA.exe = "C:\\Users\\Admin\\umcwocEU\\xsMYUowA.exe" xsMYUowA.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsMYUowA.exe = "C:\\Users\\Admin\\umcwocEU\\xsMYUowA.exe" 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EAwYIQgk.exe = "C:\\ProgramData\\saEgQgMs\\EAwYIQgk.exe" EAwYIQgk.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsMYUowA.exe = "C:\\Users\\Admin\\umcwocEU\\xsMYUowA.exe" xsMYUowA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EAwYIQgk.exe = "C:\\ProgramData\\saEgQgMs\\EAwYIQgk.exe" EAwYIQgk.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4152 taskkill.exe 4364 taskkill.exe 624 taskkill.exe 4480 taskkill.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1160 reg.exe 2692 reg.exe 3972 reg.exe 4828 reg.exe 4380 reg.exe 4760 reg.exe 2384 reg.exe 1788 reg.exe 4284 reg.exe 4640 reg.exe 1372 reg.exe 1308 reg.exe 3876 reg.exe 3936 reg.exe 3212 reg.exe 400 reg.exe 1492 reg.exe 3212 reg.exe 3904 reg.exe 2108 reg.exe 5100 reg.exe 4368 reg.exe 592 reg.exe 1500 reg.exe 2756 reg.exe 3212 reg.exe 1492 reg.exe 3100 reg.exe 2568 reg.exe 2656 reg.exe 896 reg.exe 3792 reg.exe 3728 reg.exe 3644 reg.exe 4692 reg.exe 2168 reg.exe 3704 reg.exe 3416 reg.exe 4268 reg.exe 4284 reg.exe 2084 reg.exe 2744 reg.exe 748 reg.exe 4660 reg.exe 668 reg.exe 440 reg.exe 1388 reg.exe 4008 reg.exe 992 reg.exe 2352 reg.exe 1880 reg.exe 2068 reg.exe 3040 reg.exe 2240 reg.exe 4360 reg.exe 2704 reg.exe 4964 reg.exe 2004 reg.exe 3640 reg.exe 1560 reg.exe 4236 reg.exe 3624 reg.exe 3328 reg.exe 4148 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exetaskkill.exetaskkill.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exepid process 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4172 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4172 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4172 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4172 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3972 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3972 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3972 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3972 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3236 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3236 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3236 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3236 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4152 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4152 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4152 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4152 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 748 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 748 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 748 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 748 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4676 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4676 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4676 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4676 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4256 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4256 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4256 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4256 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 1100 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 1100 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 1100 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 1100 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3796 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3796 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3796 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 3796 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 4364 taskkill.exe 4364 taskkill.exe 4152 taskkill.exe 4152 taskkill.exe 832 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 832 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 832 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 832 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 1664 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 1664 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 1664 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 1664 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 336 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 336 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 336 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe 336 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4152 taskkill.exe Token: SeDebugPrivilege 4364 taskkill.exe Token: SeDebugPrivilege 624 taskkill.exe Token: SeDebugPrivilege 4480 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.execmd.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.execmd.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.execmd.exe10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.execmd.exedescription pid process target process PID 4376 wrote to memory of 4680 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe xsMYUowA.exe PID 4376 wrote to memory of 4680 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe xsMYUowA.exe PID 4376 wrote to memory of 4680 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe xsMYUowA.exe PID 4376 wrote to memory of 2648 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe EAwYIQgk.exe PID 4376 wrote to memory of 2648 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe EAwYIQgk.exe PID 4376 wrote to memory of 2648 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe EAwYIQgk.exe PID 4376 wrote to memory of 336 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4376 wrote to memory of 336 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4376 wrote to memory of 336 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4376 wrote to memory of 4852 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4376 wrote to memory of 4852 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4376 wrote to memory of 4852 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4376 wrote to memory of 1672 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4376 wrote to memory of 1672 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4376 wrote to memory of 1672 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4376 wrote to memory of 4276 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4376 wrote to memory of 4276 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4376 wrote to memory of 4276 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4376 wrote to memory of 4256 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4376 wrote to memory of 4256 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4376 wrote to memory of 4256 4376 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 336 wrote to memory of 4644 336 cmd.exe 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe PID 336 wrote to memory of 4644 336 cmd.exe 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe PID 336 wrote to memory of 4644 336 cmd.exe 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe PID 4644 wrote to memory of 3656 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4644 wrote to memory of 3656 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4644 wrote to memory of 3656 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 3656 wrote to memory of 2532 3656 cmd.exe 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe PID 3656 wrote to memory of 2532 3656 cmd.exe 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe PID 3656 wrote to memory of 2532 3656 cmd.exe 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe PID 4644 wrote to memory of 2148 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4644 wrote to memory of 2148 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4644 wrote to memory of 2148 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4644 wrote to memory of 4664 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4644 wrote to memory of 4664 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4644 wrote to memory of 4664 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4644 wrote to memory of 4648 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4644 wrote to memory of 4648 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4644 wrote to memory of 4648 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 4644 wrote to memory of 1192 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4644 wrote to memory of 1192 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4644 wrote to memory of 1192 4644 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 2532 wrote to memory of 2240 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 2532 wrote to memory of 2240 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 2532 wrote to memory of 2240 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 2532 wrote to memory of 4964 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 2532 wrote to memory of 4964 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 2532 wrote to memory of 4964 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 2532 wrote to memory of 2224 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 2532 wrote to memory of 2224 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 2532 wrote to memory of 2224 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 2532 wrote to memory of 3952 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 2532 wrote to memory of 3952 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 2532 wrote to memory of 3952 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe reg.exe PID 2532 wrote to memory of 1312 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 2532 wrote to memory of 1312 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 2532 wrote to memory of 1312 2532 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 2240 wrote to memory of 4172 2240 cmd.exe 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe PID 2240 wrote to memory of 4172 2240 cmd.exe 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe PID 2240 wrote to memory of 4172 2240 cmd.exe 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe PID 4172 wrote to memory of 3528 4172 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4172 wrote to memory of 3528 4172 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 4172 wrote to memory of 3528 4172 10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe cmd.exe PID 1312 wrote to memory of 5000 1312 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe"C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\umcwocEU\xsMYUowA.exe"C:\Users\Admin\umcwocEU\xsMYUowA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4680 -
C:\Windows\SysWOW64\taskkill.exetaskkill /FI "USERNAME eq Admin" /F /IM EAwYIQgk.exe3⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152 -
C:\ProgramData\saEgQgMs\EAwYIQgk.exe"C:\ProgramData\saEgQgMs\EAwYIQgk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2648 -
C:\Windows\SysWOW64\taskkill.exetaskkill /FI "USERNAME eq Admin" /F /IM xsMYUowA.exe3⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"2⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e03⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"4⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e05⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"6⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e07⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"8⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e09⤵
- Suspicious behavior: EnumeratesProcesses
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"10⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e011⤵
- Suspicious behavior: EnumeratesProcesses
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"12⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e013⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"14⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e015⤵
- Suspicious behavior: EnumeratesProcesses
PID:748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"16⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e017⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"18⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e019⤵
- Suspicious behavior: EnumeratesProcesses
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"20⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e021⤵
- Suspicious behavior: EnumeratesProcesses
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"22⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e023⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"24⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e025⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:832 -
C:\Users\Admin\umcwocEU\xsMYUowA.exe"C:\Users\Admin\umcwocEU\xsMYUowA.exe"26⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4260 -
C:\Windows\SysWOW64\taskkill.exetaskkill /FI "USERNAME eq Admin" /F /IM EAwYIQgk.exe27⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"26⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e027⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"28⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e029⤵
- Suspicious behavior: EnumeratesProcesses
PID:336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"30⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e031⤵PID:3384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"32⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e033⤵PID:1408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"34⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e035⤵PID:1472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"36⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e037⤵
- Modifies visibility of file extensions in Explorer
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"38⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e039⤵PID:3852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"40⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e041⤵PID:3868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"42⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e043⤵PID:992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"44⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e045⤵PID:4612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"46⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e047⤵PID:4828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"48⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e049⤵PID:3692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"50⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e051⤵PID:1108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"52⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e053⤵PID:4520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"54⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e055⤵PID:3624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"56⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e057⤵PID:4216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"58⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e059⤵PID:4644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"60⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e061⤵PID:4048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"62⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e063⤵PID:3904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"64⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e065⤵PID:4032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"66⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e067⤵PID:3180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"68⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e069⤵PID:60
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"70⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e071⤵PID:1312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"72⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e073⤵PID:2604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"74⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e075⤵PID:4188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"76⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e077⤵PID:4596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"78⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e079⤵PID:772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"80⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e081⤵PID:4648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"82⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e083⤵PID:2224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"84⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e085⤵PID:2408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"86⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e087⤵PID:5080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"88⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e089⤵PID:4860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"90⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e091⤵PID:1944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"92⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e093⤵PID:3488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"94⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e095⤵PID:636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"96⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e097⤵PID:1408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"98⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e099⤵PID:4776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"100⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0101⤵PID:4936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"102⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0103⤵PID:4768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"104⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0105⤵PID:2992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"106⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0107⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"108⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0109⤵PID:4336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"110⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0111⤵PID:3868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"112⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0113⤵PID:772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"114⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0115⤵PID:1312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"116⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0117⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"118⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0119⤵PID:3104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"120⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0121⤵PID:4708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"122⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0123⤵PID:1472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"124⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0125⤵PID:1160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"126⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0127⤵PID:3972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"128⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0129⤵PID:3852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"130⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0131⤵PID:2376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"132⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0133⤵PID:4460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"134⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0135⤵PID:4160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"136⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0137⤵PID:4400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"138⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0139⤵PID:2128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"140⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0141⤵PID:5060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"142⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0143⤵PID:1664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"144⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0145⤵PID:1372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"146⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0147⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"148⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0149⤵PID:4628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"150⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0151⤵PID:1312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"152⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0153⤵PID:4440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"154⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0155⤵PID:4696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"156⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0157⤵PID:4596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"158⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0159⤵PID:3328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"160⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0161⤵PID:1564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"162⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0163⤵PID:4488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"164⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0165⤵PID:680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"166⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0167⤵PID:4296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"168⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0169⤵PID:4380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"170⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0171⤵PID:2552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"172⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0173⤵PID:2364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"174⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0175⤵PID:4160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"176⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0177⤵PID:4676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"178⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0179⤵PID:4028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"180⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0181⤵PID:1000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"182⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0183⤵PID:4184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"184⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0185⤵PID:2828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"186⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0187⤵PID:4976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"188⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0189⤵PID:5100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"190⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0191⤵PID:3620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"192⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0193⤵PID:2836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"194⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0195⤵PID:3108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"196⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0197⤵PID:1692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"198⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0199⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"200⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0201⤵PID:2084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"202⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0203⤵PID:2088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"204⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0205⤵
- Adds Run key to start application
PID:4684 -
C:\Users\Admin\umcwocEU\xsMYUowA.exe"C:\Users\Admin\umcwocEU\xsMYUowA.exe"206⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"206⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0207⤵PID:4996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"208⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0209⤵PID:2692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"210⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0211⤵PID:3104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"212⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0213⤵PID:1472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"214⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0215⤵PID:1548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0"216⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exeC:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0217⤵PID:3484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cYYUUcgQ.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""216⤵PID:1908
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs217⤵PID:4832
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f216⤵
- UAC bypass
PID:4800 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2216⤵PID:4780
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1216⤵PID:1288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xqoMgUwk.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""214⤵PID:2784
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs215⤵PID:3052
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f214⤵
- UAC bypass
- Modifies registry key
PID:4236 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2214⤵PID:3656
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1214⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:440 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2212⤵PID:2356
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1212⤵
- Modifies registry key
PID:1880 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f212⤵
- UAC bypass
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hSQMkIUs.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""212⤵PID:1372
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs213⤵PID:4404
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1210⤵PID:1476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OwkogUAo.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""210⤵PID:2704
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs211⤵PID:5100
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f210⤵
- UAC bypass
- Modifies registry key
PID:2384 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2210⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Zusogksc.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""208⤵PID:4912
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs209⤵PID:3736
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f208⤵
- Modifies registry key
PID:4760 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2208⤵PID:3084
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1208⤵PID:2416
-
C:\ProgramData\saEgQgMs\EAwYIQgk.exe"C:\ProgramData\saEgQgMs\EAwYIQgk.exe"206⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UGwAQIYU.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""206⤵PID:5012
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs207⤵PID:3444
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f206⤵
- UAC bypass
- Modifies registry key
PID:668 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2206⤵PID:4800
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1206⤵
- Modifies visibility of file extensions in Explorer
PID:536 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1204⤵
- Modifies visibility of file extensions in Explorer
PID:4776 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2204⤵PID:2856
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f204⤵PID:1664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HmgEYgAs.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""204⤵PID:2172
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs205⤵PID:4404
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1202⤵
- Modifies visibility of file extensions in Explorer
PID:4100 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2202⤵PID:2316
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f202⤵
- UAC bypass
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DsMggcgg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""202⤵PID:1992
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs203⤵PID:60
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1200⤵PID:2704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GQcQccUM.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""200⤵PID:1364
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs201⤵PID:3660
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f200⤵
- UAC bypass
PID:3692 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2200⤵PID:1060
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1198⤵
- Modifies visibility of file extensions in Explorer
PID:2312 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2198⤵PID:4976
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f198⤵
- UAC bypass
- Modifies registry key
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ngQgEcsc.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""198⤵PID:4668
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs199⤵PID:2148
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1196⤵PID:1100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aMQgEcUY.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""196⤵PID:5044
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs197⤵PID:4192
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f196⤵PID:1500
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2196⤵PID:3132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\caQAcMwg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""194⤵PID:3316
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs195⤵PID:116
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f194⤵
- UAC bypass
PID:3896 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2194⤵PID:3140
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1194⤵
- Modifies visibility of file extensions in Explorer
PID:1192 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2192⤵PID:1000
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1192⤵
- Modifies visibility of file extensions in Explorer
PID:1108 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f192⤵PID:1324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CkQsMIUc.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""192⤵PID:1644
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs193⤵PID:5032
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1190⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uAAIEcIo.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""190⤵PID:4588
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs191⤵PID:3424
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f190⤵PID:4436
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2190⤵PID:1848
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1188⤵
- Modifies visibility of file extensions in Explorer
PID:4728 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2188⤵PID:3476
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f188⤵PID:3280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FYkAQosA.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""188⤵PID:4164
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs189⤵PID:2656
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1186⤵
- Modifies visibility of file extensions in Explorer
PID:4964 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2186⤵PID:2780
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f186⤵PID:4828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pgYYIQMs.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""186⤵PID:2180
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs187⤵PID:4188
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1184⤵
- Modifies visibility of file extensions in Explorer
PID:3836 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2184⤵PID:3216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\osswgMsg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""184⤵PID:4276
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs185⤵PID:4580
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f184⤵
- UAC bypass
PID:948 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1182⤵
- Modifies visibility of file extensions in Explorer
PID:2956 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2182⤵PID:3236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fAsAYUcA.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""182⤵PID:60
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs183⤵PID:2172
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f182⤵
- UAC bypass
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PkEAEIUw.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""180⤵PID:4480
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs181⤵PID:2244
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f180⤵PID:2084
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2180⤵PID:4944
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1180⤵PID:3816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QIgYEUkw.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""178⤵PID:1848
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs179⤵PID:1992
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f178⤵
- UAC bypass
PID:1020 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2178⤵PID:2160
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1178⤵PID:4356
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1176⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3212 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2176⤵
- Modifies registry key
PID:2756 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f176⤵PID:1616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dIMYsosY.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""176⤵PID:4164
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs177⤵PID:4032
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1174⤵
- Modifies visibility of file extensions in Explorer
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\niQogUoM.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""174⤵PID:1332
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs175⤵PID:2280
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f174⤵
- UAC bypass
- Modifies registry key
PID:4692 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2174⤵PID:2780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dQcoEsEI.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""172⤵PID:1500
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs173⤵PID:208
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f172⤵
- UAC bypass
PID:4656 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2172⤵PID:4508
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1172⤵
- Modifies visibility of file extensions in Explorer
PID:4360 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1170⤵
- Modifies visibility of file extensions in Explorer
PID:4228 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2170⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OyEMEgsY.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""170⤵PID:2828
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs171⤵PID:636
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f170⤵PID:3892
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1168⤵
- Modifies visibility of file extensions in Explorer
PID:1164 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2168⤵PID:2744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AgQcsosY.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""168⤵PID:2712
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs169⤵PID:3704
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f168⤵
- Modifies registry key
PID:4284 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1166⤵
- Modifies visibility of file extensions in Explorer
PID:2108 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2166⤵PID:3416
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f166⤵PID:2064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wsUgMEEI.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""166⤵PID:4480
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs167⤵PID:5100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uIAAkYIg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""164⤵PID:1848
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs165⤵PID:4440
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f164⤵PID:3588
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2164⤵PID:440
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1164⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3100 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2162⤵PID:4628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GeksogYA.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""162⤵PID:4200
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs163⤵PID:1424
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f162⤵
- UAC bypass
- Modifies registry key
PID:4660 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1162⤵
- Modifies visibility of file extensions in Explorer
PID:4340 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1160⤵PID:528
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f160⤵
- UAC bypass
- Modifies registry key
PID:1500 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2160⤵PID:4100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HEkgoUMM.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""160⤵PID:3940
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs161⤵PID:3736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dEMcAoQU.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""158⤵PID:992
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs159⤵PID:116
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f158⤵
- Modifies registry key
PID:3644 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2158⤵PID:1472
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1158⤵
- Modifies visibility of file extensions in Explorer
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\myYkssMs.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""156⤵PID:2704
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs157⤵PID:4308
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f156⤵
- Modifies registry key
PID:1560 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2156⤵
- Modifies registry key
PID:4380 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1156⤵PID:3660
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1154⤵
- Modifies visibility of file extensions in Explorer
PID:2108 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f154⤵
- UAC bypass
PID:3432 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2154⤵PID:4852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Xewswosk.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""154⤵PID:4900
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs155⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JYUAckcY.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""152⤵PID:4988
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs153⤵PID:2520
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f152⤵
- Modifies registry key
PID:2352 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2152⤵PID:1476
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1152⤵
- Modifies visibility of file extensions in Explorer
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sCYwAQkY.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""150⤵PID:3880
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs151⤵PID:2224
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f150⤵PID:4120
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2150⤵PID:3976
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1150⤵
- Modifies registry key
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vKkYUsYI.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""148⤵PID:1308
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs149⤵PID:2356
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f148⤵
- UAC bypass
- Modifies registry key
PID:592 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2148⤵PID:1388
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1148⤵PID:740
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:992 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2146⤵PID:1600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MMsIwgsM.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""146⤵PID:3204
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs147⤵PID:2328
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f146⤵PID:3316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ayUQUIoQ.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""144⤵PID:3236
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs145⤵PID:3688
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f144⤵
- UAC bypass
PID:4728 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2144⤵PID:3460
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qmwcwgoM.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""142⤵PID:3468
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs143⤵PID:3620
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f142⤵PID:1536
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2142⤵
- Modifies registry key
PID:3876 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1142⤵PID:3432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MOEwoEIE.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""140⤵PID:2756
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs141⤵PID:2016
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f140⤵
- UAC bypass
PID:4992 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2140⤵PID:3896
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1140⤵
- Modifies visibility of file extensions in Explorer
PID:1692 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2138⤵PID:3132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uussUgQw.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""138⤵PID:4328
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs139⤵PID:1976
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f138⤵
- UAC bypass
PID:3728 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1138⤵
- Modifies visibility of file extensions in Explorer
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\koYIIEgQ.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""136⤵PID:1156
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs137⤵PID:1716
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f136⤵
- UAC bypass
- Modifies registry key
PID:4360 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2136⤵PID:3940
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1308 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1134⤵
- Modifies visibility of file extensions in Explorer
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DQMUsksA.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""134⤵PID:624
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs135⤵PID:3644
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f134⤵
- UAC bypass
- Modifies registry key
PID:4368 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2134⤵
- Modifies registry key
PID:1492 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f132⤵
- UAC bypass
- Modifies registry key
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGAkMMUI.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""132⤵PID:2316
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs133⤵PID:4512
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2132⤵PID:4492
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1132⤵PID:752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MQscQggs.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""130⤵PID:1888
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs131⤵PID:724
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f130⤵PID:3956
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2130⤵PID:3008
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1130⤵PID:2188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DEEAYYMk.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""128⤵PID:3100
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs129⤵PID:3164
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f128⤵
- UAC bypass
PID:696 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2128⤵PID:856
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\riAIMEQg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""126⤵PID:2992
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs127⤵PID:3992
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f126⤵
- Modifies registry key
PID:4828 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2126⤵PID:2968
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1126⤵
- Modifies visibility of file extensions in Explorer
PID:4252 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1124⤵PID:1336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zGIIQUAU.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""124⤵PID:3216
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs125⤵PID:1892
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f124⤵PID:4820
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2124⤵PID:772
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1122⤵
- Modifies visibility of file extensions in Explorer
PID:3812 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f122⤵
- UAC bypass
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vkMwYQsA.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""122⤵PID:1324
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs123⤵PID:3140
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2122⤵PID:992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yMcwwMQY.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""120⤵PID:4944
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs121⤵PID:4412
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f120⤵
- UAC bypass
- Modifies registry key
PID:4268 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2120⤵PID:1164
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1120⤵PID:752
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1118⤵PID:4028
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f118⤵
- UAC bypass
- Modifies registry key
PID:3640 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2118⤵
- Modifies registry key
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xMoAMwcw.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""118⤵PID:3236
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs119⤵PID:3624
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1116⤵PID:3588
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f116⤵
- UAC bypass
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PasMYAAI.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""116⤵PID:4692
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs117⤵PID:3632
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2116⤵PID:4644
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f114⤵
- UAC bypass
- Modifies registry key
PID:896 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2114⤵PID:3656
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lsYIwwcw.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""114⤵PID:1716
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs115⤵PID:2604
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1112⤵
- Modifies visibility of file extensions in Explorer
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rkEoQMws.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""112⤵PID:4648
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs113⤵PID:3128
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f112⤵
- UAC bypass
- Modifies registry key
PID:748 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2112⤵PID:4816
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1110⤵PID:4152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OuYQYAMg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""110⤵PID:3688
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs111⤵PID:4412
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f110⤵
- UAC bypass
PID:4232 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2110⤵PID:2188
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵PID:1476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lmkkMgAg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""108⤵PID:4900
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs109⤵PID:2656
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
- UAC bypass
PID:1560 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵PID:4680
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵PID:4376
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
- Modifies registry key
PID:3972 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵PID:4032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uogMwwsI.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""106⤵PID:680
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵PID:2356
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵PID:1100
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵PID:2856
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵PID:2276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zaAUYwQw.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""104⤵PID:3488
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵PID:2108
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵PID:4308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NsYIAMsU.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""102⤵PID:4660
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵PID:1312
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- UAC bypass
- Modifies registry key
PID:2004 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
- Modifies registry key
PID:3328 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵PID:4412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AOowogAU.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""100⤵PID:2196
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵PID:3472
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵PID:532
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵PID:4612
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dqIYwoIE.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""98⤵PID:2712
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵PID:1364
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
- Modifies registry key
PID:2656 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵PID:1664
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hgskAogw.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""96⤵PID:4276
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵PID:3136
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵PID:1424
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵PID:2380
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵PID:3008
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵PID:2624
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵PID:1388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VuQAUUgo.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""94⤵PID:5048
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵PID:1208
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jUokooIs.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""92⤵PID:4360
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵PID:3424
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
PID:4672 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵PID:1644
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OGUsUsEQ.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""90⤵PID:60
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵PID:3644
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
PID:4144 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵PID:3180
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies registry key
PID:1372 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵PID:4708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xEoUYwsM.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""88⤵PID:2196
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵PID:992
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
PID:2188 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵PID:4188
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵PID:4636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uwkMMMwA.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""86⤵PID:4728
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵PID:2656
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵PID:1672
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
PID:3468 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
- Modifies registry key
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eUwMogQY.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""84⤵PID:1424
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵PID:3432
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
- Modifies registry key
PID:3212 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
- Modifies registry key
PID:2108 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵PID:3804
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
PID:336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HiUsEgAk.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""82⤵PID:680
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵PID:4644
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EyMkYMQI.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""80⤵PID:3948
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵PID:3388
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
PID:4340 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵PID:1436
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵PID:4936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hAoIsUIQ.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""78⤵PID:3180
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵PID:4980
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
PID:4776 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵PID:520
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵PID:4032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WCEgcIUI.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""76⤵PID:4232
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵PID:2704
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵PID:3992
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵PID:8
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies registry key
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IuwskEEo.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""74⤵PID:1848
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵PID:3892
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
PID:4276 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵PID:3904
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FUokMIMc.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""72⤵PID:2408
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵PID:4908
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
PID:5016 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵PID:4984
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
PID:4688 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵PID:2068
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ACQogEkM.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""70⤵PID:4644
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵PID:4480
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵PID:4652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KOcYUQog.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""68⤵PID:3220
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵PID:4884
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
PID:3040 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵PID:3972
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies registry key
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\quIYkoMo.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""66⤵PID:2780
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵PID:3472
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵PID:4728
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵PID:3876
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
PID:2828 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵PID:496
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nuwUAkws.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""64⤵PID:3824
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵PID:3936
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
PID:4640 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tWcsQQIo.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""62⤵PID:3200
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵PID:3496
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
PID:3984 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XKAYMEYo.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""60⤵PID:3852
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵PID:4496
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵PID:1308
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
- Modifies registry key
PID:4284 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵PID:4144
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dQQksgks.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""58⤵PID:1312
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵PID:868
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
PID:2736 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵PID:328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bigwsIcg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""56⤵PID:3588
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵PID:3388
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
PID:748 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵PID:4764
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CCUQAUwU.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""54⤵PID:1500
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵PID:1560
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
- Modifies registry key
PID:2568 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵PID:3432
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies registry key
PID:1160 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵PID:2772
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵PID:2108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RggAYcIk.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""52⤵PID:3868
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵PID:4240
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
PID:3476 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- Modifies registry key
PID:4008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fykEMgcU.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""50⤵PID:2224
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵PID:3652
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
PID:3428 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
PID:4656 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵PID:3040
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HosIwEcs.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""48⤵PID:3704
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵PID:948
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵PID:5060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zwYYIcgE.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""46⤵PID:3732
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵PID:4900
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
PID:2036 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵PID:4548
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yQUwIkMc.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""44⤵PID:4508
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵PID:4620
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵PID:4164
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵PID:3136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xaAssMEc.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""42⤵PID:4860
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵PID:3432
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
PID:1388 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵PID:2496
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
PID:3416 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵PID:1564
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uSEoscow.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""40⤵PID:2352
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵PID:3760
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵PID:4568
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bYQkkwEE.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""38⤵PID:4376
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵PID:5032
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵PID:592
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵PID:2728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vAQUokIE.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""36⤵PID:4316
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵PID:3808
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
PID:3300 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵PID:4536
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
PID:208 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵PID:3124
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
PID:520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kuQgMwkg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""34⤵PID:5004
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵PID:2736
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵PID:3840
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
PID:1560 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵PID:4100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GAgAgwMM.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""32⤵PID:3004
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵PID:2656
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
PID:5016 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵PID:4488
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵PID:3812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WogQswss.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""30⤵PID:4560
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵PID:2712
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\USUkIosQ.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""28⤵PID:3572
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵PID:3804
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵PID:1308
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵PID:2084
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵PID:2744
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵PID:4916
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VgMMsMMQ.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""26⤵PID:3644
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵PID:3748
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵PID:4844
-
C:\ProgramData\saEgQgMs\EAwYIQgk.exe"C:\ProgramData\saEgQgMs\EAwYIQgk.exe"26⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5000 -
C:\Windows\SysWOW64\taskkill.exetaskkill /FI "USERNAME eq Admin" /F /IM xsMYUowA.exe27⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wUkcgYAQ.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""24⤵PID:4824
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵PID:1492
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵PID:948
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵PID:1944
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵PID:2856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uOEkscsg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""22⤵PID:3892
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵PID:2356
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵PID:3484
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵PID:4008
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
PID:3652 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵PID:2188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eQAAcQsg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""20⤵PID:2608
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵PID:4400
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
PID:3316 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
PID:2084 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
PID:4308 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵PID:4288
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GOwoYwUg.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""18⤵PID:3140
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵PID:3528
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
PID:520 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵PID:1928
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵PID:4928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UOEgMIMw.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""16⤵PID:4916
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵PID:4820
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
PID:4232 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵PID:3588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sEkEMIgk.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""14⤵PID:4164
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵PID:2856
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵PID:3816
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵PID:1000
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵PID:3904
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xascwUoU.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""12⤵PID:4480
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵PID:3432
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:1788 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵PID:2756
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵PID:3672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zCcIYYsA.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""10⤵PID:3420
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵PID:1564
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
PID:752 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
PID:1388 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\esssUMss.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""8⤵PID:2516
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵PID:5064
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies registry key
PID:4964 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵PID:2224
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NWYwgogA.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""6⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵PID:5000
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵PID:2148
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵PID:4664
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵PID:4648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SIMkAkYw.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""4⤵PID:1192
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵PID:5020
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
PID:4852 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵PID:4276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dycQAgQc.bat" "C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0.exe""2⤵PID:4256
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵PID:1880
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵PID:1672
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4400
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:948
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\saEgQgMs\EAwYIQgk.exeFilesize
187KB
MD576e18bdcf42af8cfd6f3297b7df7bb37
SHA1070d85a71c76d76f5d0f880dacb004412202e811
SHA256a607c00b57d74063db972048faafb285f917b4e16e62e48d785ea138acc4ed5e
SHA5122cd051b5e4baa0b7a37ebe1c3eee219c2767ec86a07184228fb0c96052d224ca3a78bec5a77fbfb5a5f74ee35130434e835b77da0ec865dbc04aa1e36c88ed9f
-
C:\ProgramData\saEgQgMs\EAwYIQgk.exeFilesize
187KB
MD576e18bdcf42af8cfd6f3297b7df7bb37
SHA1070d85a71c76d76f5d0f880dacb004412202e811
SHA256a607c00b57d74063db972048faafb285f917b4e16e62e48d785ea138acc4ed5e
SHA5122cd051b5e4baa0b7a37ebe1c3eee219c2767ec86a07184228fb0c96052d224ca3a78bec5a77fbfb5a5f74ee35130434e835b77da0ec865dbc04aa1e36c88ed9f
-
C:\ProgramData\saEgQgMs\EAwYIQgk.exeFilesize
193KB
MD5f313cc69a27143dc8ae37e0e604f924e
SHA1c9017922810aa1e711e0145851d9591d553f067f
SHA25654aca1ed3b5ac4549a992f1738e6c73480d9f2615d2e00af815762f422cbd695
SHA512779fed3a8f1c3d2f72300b71e365a6b54001bfa23012fed4875e039203963c5b1f5366bf8db0f6eb5724aecd27f9defc5889bbf858bf5fdff101aa3578d0d666
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD57d0d88213fd2b86e3d923354278154b5
SHA12d3fa47e32397044a0ae9493c747d6791f240874
SHA2560e07d133c529a5a4f8d5e126c6d98d10ba570d9bccefbff3847bd994dcd29e99
SHA5125f02e364b67364fe52f6a324d304ba678a25d152776c8499fdfb2a8e737d885e3c76b5620810e16749dc48d1786d54b1df3005ff6a9680e0e6f8b632398ebc12
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD5c152360a9ebd4b87179f7da72f8dfd87
SHA19fe061ee9fe30e7d00a902904257d86ab815f8a9
SHA256409a3274c8631937587423ea5428829beb4d3d76dd98fd5d2275e656a69e8891
SHA512ccf71ecb7d9cd1b43e5df491af80ca5a692873d0acc39111c5219a2afb64c0b62bf54e27b492021fafc4af5eb3570a43c375302a2b4dc56448b4cced7074a776
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD5c306570ceea9016f0803867c98770661
SHA1d33cadaaaaa98a273cd1d5a80f2c7af8e0007c23
SHA2564679b695793422671dcc100f9788c39ad433bbdd1da7e61e428ab7929e053ac6
SHA51216aa7e72d3a5178e52612e2fda31824bd3df215d7bc14dcbe6aa715f7273023cbd37e230ec6d86b9efcb398d05dd2343d3a063eeeed9cba703118d27ff0d306a
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD553dae63d9031380dd9d0be54ba59b6d5
SHA1c80d35d5fab6cd5775ee3366203fa81bd72dbe8f
SHA256c63887013161eca850a681d27aa1f764002d3b0d1ed69c096e289a9649ee930c
SHA5126a49a8d5b7e8abd1bc5850682cb8d4f85a26fb0d710f3f12b2758c502eeb1df43afb824e5666fc3b2cabbcc2525c62e9869c0b50ba92937141d7817dce85a159
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD553dae63d9031380dd9d0be54ba59b6d5
SHA1c80d35d5fab6cd5775ee3366203fa81bd72dbe8f
SHA256c63887013161eca850a681d27aa1f764002d3b0d1ed69c096e289a9649ee930c
SHA5126a49a8d5b7e8abd1bc5850682cb8d4f85a26fb0d710f3f12b2758c502eeb1df43afb824e5666fc3b2cabbcc2525c62e9869c0b50ba92937141d7817dce85a159
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD502fbaa1ad2c1b2c1c49f3c736cb75c1c
SHA12d05de26954ed61df369cdaf80af2219671243cf
SHA2569627b6b0d16363674c53092fbaef4fc75aaa0b1dde539dd61840fe4e80cef699
SHA5120d5de562a7f83c15adb11c35df366de356ab942d474a80f9daba3fc12ab3038a66c13e62720156e454483ec432626496bc503fcac189b8ea710c3120153c6b7f
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD5e97288f8bad629740259b6e94cce99bb
SHA1361385335ba235134cdad7f7a84781f815119bad
SHA256e6fe59a6f875fba0323486bba5f85907a308d6ffc6b02139bfa6fe0222a95b4f
SHA51264c137ec492d49d164d4fa63bd1f2b782c05c00ef3b441b4ea2e214a00b050ce8d695f785d205dc7a4d5f59be400daf96360c27ebeab530d6172a4df05a7278f
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD5999163a05f4a71194c008ee663427dfa
SHA1627c986fa094fd9870c3760dcf9ef38ba81e5c32
SHA25636f343bdb1ed6d1282afc4626be6b26f1b3090c48ef05cd9102ac2fbc8abd3de
SHA512060c30526fef4a2d3feb04cf3c557a1da238cba32e9cf4b6013f5e0a386fe3aabc0f48ef7578073960615830a656266ae144da026d2fe12f972e2f802a3fcb3b
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD51c08114a688656fce19da0106d87228b
SHA193f35213591520d6f0d4881751d74ddeee902a63
SHA2561690de1df7d2bfae4833c29dd0656c287d3a34bb368be8f36df59f9183fc207c
SHA5120b455e6676fc0bfcda801ff42542f80c1e0f30dd5d7acea470a21038b9dd570333d0959f2a92375199b8f4981d605d9c53345186751fe69692ca23f3283fb2fc
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD592db689a2c0c3b09f88f6d3b1e5afe8f
SHA141b530fe17d6b3bb5442f32e0b25d1d4728be74d
SHA256d8fa096a0514d0564df67da6c8368cfeec5cb0d3738d6539925079fd033e2910
SHA512b3a2046f041d5971540ea7d160c4a026e3eb10f0e9bb3d36ed82a811c099bb685a2c9d7d7992f99df0c93c0eae0731f3ca9424e678eb6e10f802716bc2653cef
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD59b82be0b7425a0d7e87ddd6bb607e4aa
SHA1a7b06bd61229d5a704e10b81e24a95d8d6d2b9ff
SHA256599335a088ae78aac5e47770733b298e680efd9b4d469c7c649dd0dad93619e2
SHA512e1291a6030395bb4491c74e2ff33ec7e494e79141bad7e050aa6be7350f6adeb1c5a64c99b6da6122c9c291d0571f8e52569bf1dacb10293ed7639373a6ba529
-
C:\ProgramData\saEgQgMs\EAwYIQgk.infFilesize
4B
MD5578319de047170d823e305201817e327
SHA1d8af8f88225680afe11aee07e9a9faa44e7a97dd
SHA256344e16ba559f93c072bcbd94e9638480e96d0bbd5b2280745e21eee0b74461bd
SHA512ba8163e335b4808d94422bcbe022ade20fb5a14c9002929092504077e763842a79c3f904973b92fc63f4393677d1199090950b12222d15678c70b95ae0cf7375
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\10761618fcb66dbe87890e55b0ec0ebf578d062c78a1287985b3b96e49e2a3e0Filesize
6KB
MD5d3ab425b258de25415358116b5a507d8
SHA15f1cd2914105fcc99d08d0dfd07ab52cc8be2095
SHA2565d6f342681f420179a8832d6cfb0a1081a8a7ce1268736ef95a63896137694d5
SHA51214561e1660ccdc68f1a51785b2617676842562942336921c2e2adc2860190796f9cebf7087fd0c1be745cc22cf52831eaa2d1f9e45c9049af6ad4b8dbcc4ec06
-
C:\Users\Admin\AppData\Local\Temp\GOwoYwUg.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\NWYwgogA.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\SIMkAkYw.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\UOEgMIMw.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\dycQAgQc.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\eQAAcQsg.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\esssUMss.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\sEkEMIgk.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\uOEkscsg.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\wUkcgYAQ.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\xascwUoU.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\zCcIYYsA.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\umcwocEU\xsMYUowA.exeFilesize
199KB
MD5627a4ca986597c7250479f3346e678e2
SHA166755c754741402c55c3dc63685638e10dca8611
SHA25633ccaf5be9881632cd18541673edef63b4e22d0894519566ea6a8043749c79d0
SHA51295c7a4e30fdd5cb3bdcaf2ef99c4a9d63d6a2c46bf2d7761fbf1750cbca4c71643108dc9a0cf95328c25a31079ae5f6ad8517a80becd37ee85fe3d103c60a5bb
-
C:\Users\Admin\umcwocEU\xsMYUowA.exeFilesize
199KB
MD5627a4ca986597c7250479f3346e678e2
SHA166755c754741402c55c3dc63685638e10dca8611
SHA25633ccaf5be9881632cd18541673edef63b4e22d0894519566ea6a8043749c79d0
SHA51295c7a4e30fdd5cb3bdcaf2ef99c4a9d63d6a2c46bf2d7761fbf1750cbca4c71643108dc9a0cf95328c25a31079ae5f6ad8517a80becd37ee85fe3d103c60a5bb
-
C:\Users\Admin\umcwocEU\xsMYUowA.exeFilesize
193KB
MD59dd999f83cb531fd49b3972cdfc3e52d
SHA1da84e89ea5fab663b85c6fbc4c724ec68e513895
SHA256267b12412bf334cb401f1388028b973de99bdf6b34c35a49248c91c185ce31e0
SHA5122e1479caf4c21bd38338407e7561adc3197924aa0c04396219daac5acb9c3b2d554020f2608715814f3a512f135337449586fa8eb9639ff49ec24679499ff15c
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD57d0d88213fd2b86e3d923354278154b5
SHA12d3fa47e32397044a0ae9493c747d6791f240874
SHA2560e07d133c529a5a4f8d5e126c6d98d10ba570d9bccefbff3847bd994dcd29e99
SHA5125f02e364b67364fe52f6a324d304ba678a25d152776c8499fdfb2a8e737d885e3c76b5620810e16749dc48d1786d54b1df3005ff6a9680e0e6f8b632398ebc12
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD5c306570ceea9016f0803867c98770661
SHA1d33cadaaaaa98a273cd1d5a80f2c7af8e0007c23
SHA2564679b695793422671dcc100f9788c39ad433bbdd1da7e61e428ab7929e053ac6
SHA51216aa7e72d3a5178e52612e2fda31824bd3df215d7bc14dcbe6aa715f7273023cbd37e230ec6d86b9efcb398d05dd2343d3a063eeeed9cba703118d27ff0d306a
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD553dae63d9031380dd9d0be54ba59b6d5
SHA1c80d35d5fab6cd5775ee3366203fa81bd72dbe8f
SHA256c63887013161eca850a681d27aa1f764002d3b0d1ed69c096e289a9649ee930c
SHA5126a49a8d5b7e8abd1bc5850682cb8d4f85a26fb0d710f3f12b2758c502eeb1df43afb824e5666fc3b2cabbcc2525c62e9869c0b50ba92937141d7817dce85a159
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD502fbaa1ad2c1b2c1c49f3c736cb75c1c
SHA12d05de26954ed61df369cdaf80af2219671243cf
SHA2569627b6b0d16363674c53092fbaef4fc75aaa0b1dde539dd61840fe4e80cef699
SHA5120d5de562a7f83c15adb11c35df366de356ab942d474a80f9daba3fc12ab3038a66c13e62720156e454483ec432626496bc503fcac189b8ea710c3120153c6b7f
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD5e97288f8bad629740259b6e94cce99bb
SHA1361385335ba235134cdad7f7a84781f815119bad
SHA256e6fe59a6f875fba0323486bba5f85907a308d6ffc6b02139bfa6fe0222a95b4f
SHA51264c137ec492d49d164d4fa63bd1f2b782c05c00ef3b441b4ea2e214a00b050ce8d695f785d205dc7a4d5f59be400daf96360c27ebeab530d6172a4df05a7278f
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD5d4c4bcc2e039de18c44ac5b1567aa10d
SHA11514b48b5a8ef30b1a2461dd5ba741d8d6b48ae5
SHA2566e7e5f322e9cd1735b42d6bafac42ef03fc3f49480c181b2a3808725b21fe1f1
SHA512d9d56c424226797c034128f35df4af6b20f8a1ff85e40ccb39789ca3d16d14721719fa61b13649d70b1cb79292ff6db70ac1c7b4cece2662df28982a012088e9
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD5999163a05f4a71194c008ee663427dfa
SHA1627c986fa094fd9870c3760dcf9ef38ba81e5c32
SHA25636f343bdb1ed6d1282afc4626be6b26f1b3090c48ef05cd9102ac2fbc8abd3de
SHA512060c30526fef4a2d3feb04cf3c557a1da238cba32e9cf4b6013f5e0a386fe3aabc0f48ef7578073960615830a656266ae144da026d2fe12f972e2f802a3fcb3b
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD51c08114a688656fce19da0106d87228b
SHA193f35213591520d6f0d4881751d74ddeee902a63
SHA2561690de1df7d2bfae4833c29dd0656c287d3a34bb368be8f36df59f9183fc207c
SHA5120b455e6676fc0bfcda801ff42542f80c1e0f30dd5d7acea470a21038b9dd570333d0959f2a92375199b8f4981d605d9c53345186751fe69692ca23f3283fb2fc
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD592db689a2c0c3b09f88f6d3b1e5afe8f
SHA141b530fe17d6b3bb5442f32e0b25d1d4728be74d
SHA256d8fa096a0514d0564df67da6c8368cfeec5cb0d3738d6539925079fd033e2910
SHA512b3a2046f041d5971540ea7d160c4a026e3eb10f0e9bb3d36ed82a811c099bb685a2c9d7d7992f99df0c93c0eae0731f3ca9424e678eb6e10f802716bc2653cef
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD59b82be0b7425a0d7e87ddd6bb607e4aa
SHA1a7b06bd61229d5a704e10b81e24a95d8d6d2b9ff
SHA256599335a088ae78aac5e47770733b298e680efd9b4d469c7c649dd0dad93619e2
SHA512e1291a6030395bb4491c74e2ff33ec7e494e79141bad7e050aa6be7350f6adeb1c5a64c99b6da6122c9c291d0571f8e52569bf1dacb10293ed7639373a6ba529
-
C:\Users\Admin\umcwocEU\xsMYUowA.infFilesize
4B
MD5403cca3ecf08f861b6d159562f2a7d4e
SHA18adbdb36aea2efc339405383cf0b1420f03c727c
SHA256f804fce3345a2bd758aacce28b168d980b2c7c3a10a95da291758a9ae599c03f
SHA512d3064129f22dc83d48978b28f2a15c3856f48ddfb70766acefc17f85b034e5cc2f00d9c83ee01d60cab594ab7fbeca601742420fac19fcad98242ea953cc56f8
-
memory/60-313-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/60-314-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/336-138-0x0000000000000000-mapping.dmp
-
memory/336-289-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/520-241-0x0000000000000000-mapping.dmp
-
memory/748-229-0x0000000000000000-mapping.dmp
-
memory/748-245-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/752-190-0x0000000000000000-mapping.dmp
-
memory/772-320-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/832-285-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/832-282-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/992-297-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1000-217-0x0000000000000000-mapping.dmp
-
memory/1100-267-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1108-302-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1192-156-0x0000000000000000-mapping.dmp
-
memory/1312-163-0x0000000000000000-mapping.dmp
-
memory/1312-315-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1388-192-0x0000000000000000-mapping.dmp
-
memory/1408-291-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1472-292-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1564-213-0x0000000000000000-mapping.dmp
-
memory/1664-287-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1672-140-0x0000000000000000-mapping.dmp
-
memory/1788-204-0x0000000000000000-mapping.dmp
-
memory/1880-191-0x0000000000000000-mapping.dmp
-
memory/1928-243-0x0000000000000000-mapping.dmp
-
memory/2068-193-0x0000000000000000-mapping.dmp
-
memory/2148-228-0x0000000000000000-mapping.dmp
-
memory/2148-153-0x0000000000000000-mapping.dmp
-
memory/2224-322-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2224-161-0x0000000000000000-mapping.dmp
-
memory/2240-159-0x0000000000000000-mapping.dmp
-
memory/2344-239-0x0000000000000000-mapping.dmp
-
memory/2408-323-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2496-216-0x0000000000000000-mapping.dmp
-
memory/2516-194-0x0000000000000000-mapping.dmp
-
memory/2532-164-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2532-152-0x0000000000000000-mapping.dmp
-
memory/2604-316-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2648-276-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2648-135-0x0000000000000000-mapping.dmp
-
memory/2648-145-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2756-205-0x0000000000000000-mapping.dmp
-
memory/2856-236-0x0000000000000000-mapping.dmp
-
memory/3140-259-0x0000000000000000-mapping.dmp
-
memory/3180-312-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3236-221-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3236-212-0x0000000000000000-mapping.dmp
-
memory/3384-288-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3384-290-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3420-207-0x0000000000000000-mapping.dmp
-
memory/3432-224-0x0000000000000000-mapping.dmp
-
memory/3528-187-0x0000000000000000-mapping.dmp
-
memory/3588-231-0x0000000000000000-mapping.dmp
-
memory/3624-304-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3624-305-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3656-151-0x0000000000000000-mapping.dmp
-
memory/3672-206-0x0000000000000000-mapping.dmp
-
memory/3692-301-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3796-274-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3796-271-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3816-232-0x0000000000000000-mapping.dmp
-
memory/3852-295-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3868-296-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3876-219-0x0000000000000000-mapping.dmp
-
memory/3904-218-0x0000000000000000-mapping.dmp
-
memory/3904-310-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3904-309-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3952-162-0x0000000000000000-mapping.dmp
-
memory/3960-257-0x0000000000000000-mapping.dmp
-
memory/3972-197-0x0000000000000000-mapping.dmp
-
memory/3972-208-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3972-203-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4032-311-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4048-253-0x0000000000000000-mapping.dmp
-
memory/4048-308-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4152-222-0x0000000000000000-mapping.dmp
-
memory/4152-225-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4152-234-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4164-233-0x0000000000000000-mapping.dmp
-
memory/4172-175-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4172-172-0x0000000000000000-mapping.dmp
-
memory/4172-195-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4188-317-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4216-306-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4232-230-0x0000000000000000-mapping.dmp
-
memory/4256-258-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4256-142-0x0000000000000000-mapping.dmp
-
memory/4256-254-0x0000000000000000-mapping.dmp
-
memory/4256-263-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4260-283-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4276-141-0x0000000000000000-mapping.dmp
-
memory/4288-256-0x0000000000000000-mapping.dmp
-
memory/4308-255-0x0000000000000000-mapping.dmp
-
memory/4376-143-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4376-202-0x0000000000000000-mapping.dmp
-
memory/4480-220-0x0000000000000000-mapping.dmp
-
memory/4520-303-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4596-318-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4596-319-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4612-299-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4612-298-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4644-307-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4644-148-0x0000000000000000-mapping.dmp
-
memory/4644-149-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4644-157-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4648-155-0x0000000000000000-mapping.dmp
-
memory/4648-321-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4664-154-0x0000000000000000-mapping.dmp
-
memory/4676-240-0x0000000000000000-mapping.dmp
-
memory/4676-249-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4676-260-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4680-275-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4680-132-0x0000000000000000-mapping.dmp
-
memory/4680-144-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4820-247-0x0000000000000000-mapping.dmp
-
memory/4828-300-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4852-139-0x0000000000000000-mapping.dmp
-
memory/4916-244-0x0000000000000000-mapping.dmp
-
memory/4916-293-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4916-294-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4928-242-0x0000000000000000-mapping.dmp
-
memory/4964-160-0x0000000000000000-mapping.dmp
-
memory/5000-188-0x0000000000000000-mapping.dmp
-
memory/5000-284-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5020-189-0x0000000000000000-mapping.dmp
-
memory/5064-199-0x0000000000000000-mapping.dmp