Analysis
-
max time kernel
151s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 02:45
Static task
static1
Behavioral task
behavioral1
Sample
c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe
Resource
win10v2004-20220812-en
General
-
Target
c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe
-
Size
472KB
-
MD5
0b372c5f11c926717c614120d560bf80
-
SHA1
294f0120498fc4cc40a79c4f9197cff87abc83ad
-
SHA256
c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4
-
SHA512
29055671dc2c7d5bd00049fac08f25c76280780cc7c19fe671b596119d98659a1187b073ae8a3792a12d4d5d2f14c106751dfd7e719f7f89bb12e0d1e03e3cf0
-
SSDEEP
6144:gq6WAZ9v2mmKgziU3u8MPE8xv+f6O44L/HMD4CgnJpjPlflE5vTDjFUl:VtAfvBgeU3uFPZxmM4hMvvxUl
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 51 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
Processes:
vIYssokg.execWMcEUUQ.exemkEAQosg.exepid process 1472 vIYssokg.exe 764 cWMcEUUQ.exe 952 mkEAQosg.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
cWMcEUUQ.exedescription ioc process File created C:\Users\Admin\Pictures\ExportUnblock.png.exe cWMcEUUQ.exe File created C:\Users\Admin\Pictures\ProtectEnable.png.exe cWMcEUUQ.exe File created C:\Users\Admin\Pictures\SetMove.png.exe cWMcEUUQ.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cWMcEUUQ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation cWMcEUUQ.exe -
Loads dropped DLL 22 IoCs
Processes:
c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.execWMcEUUQ.exepid process 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
cWMcEUUQ.exemkEAQosg.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exevIYssokg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cWMcEUUQ.exe = "C:\\ProgramData\\TsMogogo\\cWMcEUUQ.exe" cWMcEUUQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cWMcEUUQ.exe = "C:\\ProgramData\\TsMogogo\\cWMcEUUQ.exe" mkEAQosg.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\vIYssokg.exe = "C:\\Users\\Admin\\logIEoQY\\vIYssokg.exe" c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cWMcEUUQ.exe = "C:\\ProgramData\\TsMogogo\\cWMcEUUQ.exe" c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\vIYssokg.exe = "C:\\Users\\Admin\\logIEoQY\\vIYssokg.exe" vIYssokg.exe -
Drops file in System32 directory 2 IoCs
Processes:
mkEAQosg.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\logIEoQY mkEAQosg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\logIEoQY\vIYssokg mkEAQosg.exe -
Drops file in Windows directory 1 IoCs
Processes:
cWMcEUUQ.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico cWMcEUUQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2748 reg.exe 2512 reg.exe 864 reg.exe 860 reg.exe 2344 reg.exe 740 reg.exe 2116 reg.exe 2804 reg.exe 924 reg.exe 3036 reg.exe 2356 reg.exe 2128 reg.exe 2268 reg.exe 2660 reg.exe 2560 reg.exe 2300 reg.exe 2600 reg.exe 1916 reg.exe 1916 reg.exe 2284 reg.exe 2428 reg.exe 2060 reg.exe 2188 reg.exe 2776 reg.exe 1512 reg.exe 1164 reg.exe 1996 reg.exe 2820 reg.exe 2996 reg.exe 2776 reg.exe 1100 reg.exe 360 reg.exe 1364 reg.exe 2756 reg.exe 1976 reg.exe 1924 reg.exe 1544 reg.exe 1860 reg.exe 2432 reg.exe 1460 reg.exe 2444 reg.exe 1248 reg.exe 1624 reg.exe 2148 reg.exe 2920 reg.exe 1728 reg.exe 1544 reg.exe 2312 reg.exe 2172 reg.exe 2616 reg.exe 2856 reg.exe 2628 reg.exe 1924 reg.exe 2572 reg.exe 2632 reg.exe 1688 reg.exe 2608 reg.exe 2392 reg.exe 2812 reg.exe 3004 reg.exe 3040 reg.exe 2156 reg.exe 2012 reg.exe 2376 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exepid process 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1008 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1008 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1320 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1320 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1484 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1484 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1004 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1004 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1972 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1972 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1512 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1512 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1592 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1592 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2256 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2256 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2504 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2504 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2748 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2748 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2972 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2972 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1704 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1704 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2272 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2272 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2512 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2512 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2780 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2780 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1860 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1860 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2464 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2464 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2056 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2056 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 3000 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 3000 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2100 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2100 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1692 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1692 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2424 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2424 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2252 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2252 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2868 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2868 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1004 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 1004 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2432 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 2432 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 908 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 908 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 3068 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe 3068 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
cWMcEUUQ.exepid process 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe 764 cWMcEUUQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.execmd.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.execmd.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.execmd.exec78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.execmd.exedescription pid process target process PID 1096 wrote to memory of 1472 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe vIYssokg.exe PID 1096 wrote to memory of 1472 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe vIYssokg.exe PID 1096 wrote to memory of 1472 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe vIYssokg.exe PID 1096 wrote to memory of 1472 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe vIYssokg.exe PID 1096 wrote to memory of 764 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cWMcEUUQ.exe PID 1096 wrote to memory of 764 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cWMcEUUQ.exe PID 1096 wrote to memory of 764 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cWMcEUUQ.exe PID 1096 wrote to memory of 764 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cWMcEUUQ.exe PID 1096 wrote to memory of 1772 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1096 wrote to memory of 1772 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1096 wrote to memory of 1772 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1096 wrote to memory of 1772 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1772 wrote to memory of 672 1772 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1772 wrote to memory of 672 1772 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1772 wrote to memory of 672 1772 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1772 wrote to memory of 672 1772 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 672 wrote to memory of 1184 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 672 wrote to memory of 1184 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 672 wrote to memory of 1184 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 672 wrote to memory of 1184 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1184 wrote to memory of 1916 1184 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1184 wrote to memory of 1916 1184 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1184 wrote to memory of 1916 1184 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1184 wrote to memory of 1916 1184 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1916 wrote to memory of 1800 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1916 wrote to memory of 1800 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1916 wrote to memory of 1800 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1916 wrote to memory of 1800 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1800 wrote to memory of 1008 1800 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1800 wrote to memory of 1008 1800 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1800 wrote to memory of 1008 1800 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1800 wrote to memory of 1008 1800 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1008 wrote to memory of 1972 1008 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1008 wrote to memory of 1972 1008 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1008 wrote to memory of 1972 1008 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1008 wrote to memory of 1972 1008 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe cmd.exe PID 1972 wrote to memory of 1320 1972 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1972 wrote to memory of 1320 1972 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1972 wrote to memory of 1320 1972 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 1972 wrote to memory of 1320 1972 cmd.exe c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe PID 672 wrote to memory of 1924 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 672 wrote to memory of 1924 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 672 wrote to memory of 1924 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 672 wrote to memory of 1924 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1096 wrote to memory of 1704 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1096 wrote to memory of 1704 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1096 wrote to memory of 1704 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1096 wrote to memory of 1704 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1916 wrote to memory of 1544 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1916 wrote to memory of 1544 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1916 wrote to memory of 1544 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1916 wrote to memory of 1544 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1916 wrote to memory of 364 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1916 wrote to memory of 364 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1916 wrote to memory of 364 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1916 wrote to memory of 364 1916 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1096 wrote to memory of 1768 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1096 wrote to memory of 1768 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1096 wrote to memory of 1768 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 1096 wrote to memory of 1768 1096 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 672 wrote to memory of 1248 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 672 wrote to memory of 1248 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 672 wrote to memory of 1248 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe PID 672 wrote to memory of 1248 672 c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe"C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\logIEoQY\vIYssokg.exe"C:\Users\Admin\logIEoQY\vIYssokg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\TsMogogo\cWMcEUUQ.exe"C:\ProgramData\TsMogogo\cWMcEUUQ.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd43⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd45⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd47⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"10⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd411⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"12⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd413⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"14⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd415⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"16⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd417⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"18⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd419⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"20⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd421⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"22⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd423⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"24⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd425⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"26⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd427⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"28⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd429⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"30⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd431⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"32⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd433⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"34⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd435⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"36⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd437⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"38⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd439⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"40⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd441⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"42⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd443⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"44⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd445⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"46⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd447⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"48⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd449⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"50⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd451⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"52⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd453⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"54⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd455⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"56⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd457⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"58⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd459⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"60⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd461⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"62⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd463⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"64⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd465⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"66⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd467⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"68⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd469⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"70⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd471⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"72⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd473⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"74⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd475⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"76⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd477⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"78⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd479⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"80⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd481⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"82⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd483⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"84⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd485⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"86⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd487⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"88⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd489⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"90⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd491⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"92⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd493⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"94⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd495⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"96⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd497⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"98⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd499⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4"100⤵
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exeC:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4101⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\esUUYsoo.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""100⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\AekQsQgA.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""98⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\NGUsIoIs.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""96⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LcQMAMkI.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\HQwkUgUI.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jIsUoQAw.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""90⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\aMoEEoQU.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tYccIgsQ.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""86⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\QWwgMkEY.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""84⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RycckYAU.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""82⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\pQIIYwos.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""80⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\cOwQgUUY.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""78⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\UMAwoYcE.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CEgwMoEU.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""74⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sEIQMYcA.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SIEoAgcE.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\acwoMcUg.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ACMIwsMY.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\xkIkAkcQ.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hCQcckkE.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\KUkgUUEI.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XIYsAUAU.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\kysUcIgw.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ygIowwwA.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RWsMcoQU.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\kuUowssM.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\vMscQwUE.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RmkgQEAU.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\rUYgoMko.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GKoEoIsM.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\fSogcAEU.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\QkEkAswg.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BGAMUgcQ.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\buIwocUg.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\iiAMEAYs.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\wEkgYkEw.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\vEEAQcEw.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mUQAUAcU.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jIYkIsos.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\zmwosQEE.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\bakgYMAA.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SuMIUAgE.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XQkAQQMk.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\xecsQscM.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XsMEckgM.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""12⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\MKwgAIYY.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\wyIQwgwU.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\UUEwsowA.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\OMckQMQk.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EeAokwsk.bat" "C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\ProgramData\nmUckcow\mkEAQosg.exeC:\ProgramData\nmUckcow\mkEAQosg.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\TsMogogo\cWMcEUUQ.exeFilesize
432KB
MD5c1e2e634e7a23b5acb11a738fca95bfd
SHA1d4e5cfb41c97aa0377656866212c890030f96ce0
SHA256611e3c4ee645b22cadfd0660fd17dc67e58f460320bee34f561aaddb1412aee2
SHA5128255f4fad7c351e0bcb5978d5c25af43891441cc9011ec23b3d343ba341e6ed88d57c58e400077b5d75e074cdf849603158f92d5441851da54a682684518343c
-
C:\ProgramData\nmUckcow\mkEAQosg.exeFilesize
433KB
MD5af1de4fa4fede58a351ef34c458bf6c0
SHA1311982ab06e6be11df647212995f75066efffc47
SHA2565e7123f9717099258e2a8796004cf12301cb0792a02a58f43a5eef805a95fbe0
SHA512ef822278cfdafbc12397e1da7681632f2aaed71af210e2440161545e86077e105cd5e810b640fbcb16e659965a1b9de45ddff6636df70f627b06af265ebb45a9
-
C:\Users\Admin\AppData\Local\Temp\EeAokwsk.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\MKwgAIYY.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\OMckQMQk.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\SuMIUAgE.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\UUEwsowA.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\XQkAQQMk.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\bakgYMAA.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\buIwocUg.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\c78731db1a6c6c8b22b5364ac91df5994b330308fd45ab48a00e639de4aeacd4Filesize
32KB
MD5eae500dbfa22c2017bd87a669b92416a
SHA108042833760a0a75b568baad2bc3c05751a994eb
SHA25646ff75804a2154679d9bab146ff3e689cecd0ab88429327e81ee129492ae5c9f
SHA5120e2b71428a498c64594a8b18fc7193b5963935eb178a7e384aa4afd94bd4368d17bc68666179ba8193d5896f078fb7731e4a3a4312506292e4e7178b9296045a
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\iiAMEAYs.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\jIYkIsos.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\mUQAUAcU.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\vEEAQcEw.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\wEkgYkEw.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\wyIQwgwU.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\xecsQscM.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\zmwosQEE.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\logIEoQY\vIYssokg.exeFilesize
436KB
MD531f355103d010f7252c566b8643ebc79
SHA1afc1670da845135e2d7e672489b5e91853146e0e
SHA256241c405a8a3c92f32ad11c40931c6de127cd090c998d8f3f9e90bbff73ce1073
SHA512920fc37501ea1101127e784c4ea8f9243a9ba84a74971dcfff557fe080e9197c93ea66dd6962c81d9c8a919c90d538f3b99676f79d95f3f9d648d9899aaf61b6
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exeFilesize
145KB
MD59d10f99a6712e28f8acd5641e3a7ea6b
SHA1835e982347db919a681ba12f3891f62152e50f0d
SHA25670964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc
SHA5122141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5
-
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exeFilesize
1.0MB
MD54d92f518527353c0db88a70fddcfd390
SHA1c4baffc19e7d1f0e0ebf73bab86a491c1d152f98
SHA25697e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c
SHA51205a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452
-
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exeFilesize
1.0MB
MD54d92f518527353c0db88a70fddcfd390
SHA1c4baffc19e7d1f0e0ebf73bab86a491c1d152f98
SHA25697e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c
SHA51205a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452
-
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXEFilesize
818KB
MD5a41e524f8d45f0074fd07805ff0c9b12
SHA1948deacf95a60c3fdf17e0e4db1931a6f3fc5d38
SHA256082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7
SHA51291bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f
-
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXEFilesize
818KB
MD5a41e524f8d45f0074fd07805ff0c9b12
SHA1948deacf95a60c3fdf17e0e4db1931a6f3fc5d38
SHA256082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7
SHA51291bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f
-
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exeFilesize
507KB
MD5c87e561258f2f8650cef999bf643a731
SHA12c64b901284908e8ed59cf9c912f17d45b05e0af
SHA256a1dfa6639bef3cb4e41175c43730d46a51393942ead826337ca9541ac210c67b
SHA512dea4833aa712c5823f800f5f5a2adcf241c1b2b6747872f540f5ff9da6795c4ddb73db0912593337083c7c67b91e9eaf1b3d39a34b99980fd5904ba3d7d62f6c
-
\ProgramData\TsMogogo\cWMcEUUQ.exeFilesize
432KB
MD5c1e2e634e7a23b5acb11a738fca95bfd
SHA1d4e5cfb41c97aa0377656866212c890030f96ce0
SHA256611e3c4ee645b22cadfd0660fd17dc67e58f460320bee34f561aaddb1412aee2
SHA5128255f4fad7c351e0bcb5978d5c25af43891441cc9011ec23b3d343ba341e6ed88d57c58e400077b5d75e074cdf849603158f92d5441851da54a682684518343c
-
\ProgramData\TsMogogo\cWMcEUUQ.exeFilesize
432KB
MD5c1e2e634e7a23b5acb11a738fca95bfd
SHA1d4e5cfb41c97aa0377656866212c890030f96ce0
SHA256611e3c4ee645b22cadfd0660fd17dc67e58f460320bee34f561aaddb1412aee2
SHA5128255f4fad7c351e0bcb5978d5c25af43891441cc9011ec23b3d343ba341e6ed88d57c58e400077b5d75e074cdf849603158f92d5441851da54a682684518343c
-
\Users\Admin\logIEoQY\vIYssokg.exeFilesize
436KB
MD531f355103d010f7252c566b8643ebc79
SHA1afc1670da845135e2d7e672489b5e91853146e0e
SHA256241c405a8a3c92f32ad11c40931c6de127cd090c998d8f3f9e90bbff73ce1073
SHA512920fc37501ea1101127e784c4ea8f9243a9ba84a74971dcfff557fe080e9197c93ea66dd6962c81d9c8a919c90d538f3b99676f79d95f3f9d648d9899aaf61b6
-
\Users\Admin\logIEoQY\vIYssokg.exeFilesize
436KB
MD531f355103d010f7252c566b8643ebc79
SHA1afc1670da845135e2d7e672489b5e91853146e0e
SHA256241c405a8a3c92f32ad11c40931c6de127cd090c998d8f3f9e90bbff73ce1073
SHA512920fc37501ea1101127e784c4ea8f9243a9ba84a74971dcfff557fe080e9197c93ea66dd6962c81d9c8a919c90d538f3b99676f79d95f3f9d648d9899aaf61b6
-
memory/360-117-0x0000000000000000-mapping.dmp
-
memory/364-92-0x0000000000000000-mapping.dmp
-
memory/468-151-0x0000000000000000-mapping.dmp
-
memory/532-122-0x0000000000000000-mapping.dmp
-
memory/624-139-0x0000000000000000-mapping.dmp
-
memory/672-72-0x0000000000000000-mapping.dmp
-
memory/672-125-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/672-78-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/692-123-0x0000000000000000-mapping.dmp
-
memory/740-176-0x0000000000000000-mapping.dmp
-
memory/764-63-0x0000000000000000-mapping.dmp
-
memory/764-203-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/764-67-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/860-99-0x0000000000000000-mapping.dmp
-
memory/864-98-0x0000000000000000-mapping.dmp
-
memory/924-116-0x0000000000000000-mapping.dmp
-
memory/952-225-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/952-70-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/980-168-0x0000000000000000-mapping.dmp
-
memory/1004-299-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1004-120-0x0000000000000000-mapping.dmp
-
memory/1004-164-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1004-132-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1004-298-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-82-0x0000000000000000-mapping.dmp
-
memory/1008-153-0x0000000000000000-mapping.dmp
-
memory/1008-84-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-129-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1084-174-0x0000000000000000-mapping.dmp
-
memory/1096-170-0x0000000000000000-mapping.dmp
-
memory/1096-128-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1096-54-0x00000000768A1000-0x00000000768A3000-memory.dmpFilesize
8KB
-
memory/1096-55-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1100-100-0x0000000000000000-mapping.dmp
-
memory/1112-119-0x0000000000000000-mapping.dmp
-
memory/1164-156-0x0000000000000000-mapping.dmp
-
memory/1184-75-0x0000000000000000-mapping.dmp
-
memory/1204-126-0x0000000000000000-mapping.dmp
-
memory/1224-127-0x0000000000000000-mapping.dmp
-
memory/1248-94-0x0000000000000000-mapping.dmp
-
memory/1284-163-0x0000000000000000-mapping.dmp
-
memory/1320-95-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1320-87-0x0000000000000000-mapping.dmp
-
memory/1320-130-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1324-108-0x0000000000000000-mapping.dmp
-
memory/1364-131-0x0000000000000000-mapping.dmp
-
memory/1464-110-0x0000000000000000-mapping.dmp
-
memory/1472-58-0x0000000000000000-mapping.dmp
-
memory/1472-66-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/1472-202-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/1480-96-0x0000000000000000-mapping.dmp
-
memory/1484-146-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1484-111-0x0000000000000000-mapping.dmp
-
memory/1484-114-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1484-161-0x0000000000000000-mapping.dmp
-
memory/1512-173-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1512-187-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1512-165-0x0000000000000000-mapping.dmp
-
memory/1544-91-0x0000000000000000-mapping.dmp
-
memory/1544-133-0x0000000000000000-mapping.dmp
-
memory/1544-115-0x0000000000000000-mapping.dmp
-
memory/1572-103-0x0000000000000000-mapping.dmp
-
memory/1592-195-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1592-191-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1592-178-0x0000000000000000-mapping.dmp
-
memory/1608-155-0x0000000000000000-mapping.dmp
-
memory/1616-152-0x0000000000000000-mapping.dmp
-
memory/1624-171-0x0000000000000000-mapping.dmp
-
memory/1628-97-0x0000000000000000-mapping.dmp
-
memory/1672-263-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1672-104-0x0000000000000000-mapping.dmp
-
memory/1672-113-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1676-175-0x0000000000000000-mapping.dmp
-
memory/1692-280-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1692-107-0x0000000000000000-mapping.dmp
-
memory/1692-140-0x0000000000000000-mapping.dmp
-
memory/1692-283-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1704-236-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1704-90-0x0000000000000000-mapping.dmp
-
memory/1704-241-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1728-154-0x0000000000000000-mapping.dmp
-
memory/1768-124-0x0000000000000000-mapping.dmp
-
memory/1768-93-0x0000000000000000-mapping.dmp
-
memory/1772-71-0x0000000000000000-mapping.dmp
-
memory/1800-81-0x0000000000000000-mapping.dmp
-
memory/1832-101-0x0000000000000000-mapping.dmp
-
memory/1860-106-0x0000000000000000-mapping.dmp
-
memory/1860-262-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1860-257-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1916-196-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1916-79-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1916-76-0x0000000000000000-mapping.dmp
-
memory/1924-89-0x0000000000000000-mapping.dmp
-
memory/1924-157-0x0000000000000000-mapping.dmp
-
memory/1940-141-0x0000000000000000-mapping.dmp
-
memory/1972-149-0x0000000000000000-mapping.dmp
-
memory/1972-160-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1972-86-0x0000000000000000-mapping.dmp
-
memory/1972-177-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1996-158-0x0000000000000000-mapping.dmp
-
memory/2056-272-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2056-271-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2068-182-0x0000000000000000-mapping.dmp
-
memory/2100-279-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2100-275-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2252-291-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2256-200-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2256-192-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2272-248-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2272-249-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2424-286-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2424-287-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2432-297-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2464-264-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2464-267-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2504-204-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2504-219-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2512-254-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2512-247-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2748-228-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2748-227-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2780-259-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2780-258-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2868-290-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2868-294-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2972-226-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2972-234-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/3000-276-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/3000-270-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB