Analysis
-
max time kernel
155s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 05:43
Static task
static1
Behavioral task
behavioral1
Sample
f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe
Resource
win10v2004-20220812-en
General
-
Target
f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe
-
Size
442KB
-
MD5
ad1860ba37160c5cd9c8edfd9a6f244e
-
SHA1
afbcf0a29389b0dd2c404d3f510d9bad45c25766
-
SHA256
f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8
-
SHA512
3f7df7e68ba4a6156cd38240248321dff2d0e0349c3f088430709c85e8e60a453091e8d81ea58428b4dfdb40809a62b6193da4a64a9671831cbf234e3a3049b6
-
SSDEEP
6144:SD5JMGANr/Uz1u2MZXAPwCjpeiOmxpoNYyaUYsq7q91TxfUwerPzVSWh:aD2Nr/EGCwCjpeiPxkwr0RUvRSE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exeConhost.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exeConhost.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
Processes:
TYUcAAEk.exeHSEMYocM.exejiAwIgIo.exepid process 1620 TYUcAAEk.exe 2544 HSEMYocM.exe 804 jiAwIgIo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HSEMYocM.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation HSEMYocM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
HSEMYocM.exejiAwIgIo.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeTYUcAAEk.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HSEMYocM.exe = "C:\\ProgramData\\cEMUkcYY\\HSEMYocM.exe" HSEMYocM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HSEMYocM.exe = "C:\\ProgramData\\cEMUkcYY\\HSEMYocM.exe" jiAwIgIo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TYUcAAEk.exe = "C:\\Users\\Admin\\wmMMQkck\\TYUcAAEk.exe" f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HSEMYocM.exe = "C:\\ProgramData\\cEMUkcYY\\HSEMYocM.exe" f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TYUcAAEk.exe = "C:\\Users\\Admin\\wmMMQkck\\TYUcAAEk.exe" TYUcAAEk.exe -
Drops file in System32 directory 7 IoCs
Processes:
HSEMYocM.exejiAwIgIo.exedescription ioc process File opened for modification C:\Windows\SysWOW64\sheRegisterSet.pptx HSEMYocM.exe File opened for modification C:\Windows\SysWOW64\sheSendRedo.xls HSEMYocM.exe File opened for modification C:\Windows\SysWOW64\sheSyncConvertTo.xlsx HSEMYocM.exe File opened for modification C:\Windows\SysWOW64\sheUseLimit.jpg HSEMYocM.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\wmMMQkck jiAwIgIo.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\wmMMQkck\TYUcAAEk jiAwIgIo.exe File created C:\Windows\SysWOW64\shell32.dll.exe HSEMYocM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1132 reg.exe 2192 reg.exe 1508 reg.exe 3844 reg.exe 1816 reg.exe 3832 reg.exe 3408 reg.exe 1960 reg.exe 4148 reg.exe 3380 reg.exe 1056 reg.exe 3560 reg.exe 4864 reg.exe 1796 reg.exe 3956 reg.exe 5152 reg.exe 3408 reg.exe 5456 reg.exe 3320 reg.exe 5976 reg.exe 1688 reg.exe 5304 reg.exe 836 reg.exe 2260 reg.exe 624 reg.exe 1544 reg.exe 4488 reg.exe 5508 reg.exe 4280 reg.exe 1160 reg.exe 2776 reg.exe 2364 reg.exe 5784 reg.exe 5016 reg.exe 5800 reg.exe 396 reg.exe 5592 reg.exe 5864 reg.exe 4564 reg.exe 4620 reg.exe 3668 reg.exe 5288 reg.exe 1948 reg.exe 4208 reg.exe 684 reg.exe 5972 reg.exe 3980 reg.exe 4220 reg.exe 1404 reg.exe 3624 reg.exe 1404 reg.exe 2848 reg.exe 5004 reg.exe 6096 reg.exe 1380 reg.exe 116 reg.exe 2652 reg.exe 5436 reg.exe 3840 reg.exe 540 reg.exe 1460 reg.exe 4208 reg.exe 5944 reg.exe 2924 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exepid process 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4656 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4656 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4656 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4656 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4896 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4896 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4896 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4896 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3636 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3636 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3636 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3636 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 624 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 624 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 624 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 624 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2036 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2036 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2036 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2036 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4200 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4200 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4200 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 4200 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2468 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2468 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2468 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2468 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3800 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3800 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3800 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3800 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2808 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2808 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2808 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2808 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 1824 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 1824 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 1824 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 1824 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2560 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2560 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2560 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 2560 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3096 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3096 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3096 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe 3096 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
HSEMYocM.exepid process 2544 HSEMYocM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
HSEMYocM.exepid process 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe 2544 HSEMYocM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.execmd.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.execmd.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.execmd.exef680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exedescription pid process target process PID 528 wrote to memory of 1620 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe TYUcAAEk.exe PID 528 wrote to memory of 1620 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe TYUcAAEk.exe PID 528 wrote to memory of 1620 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe TYUcAAEk.exe PID 528 wrote to memory of 2544 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe HSEMYocM.exe PID 528 wrote to memory of 2544 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe HSEMYocM.exe PID 528 wrote to memory of 2544 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe HSEMYocM.exe PID 528 wrote to memory of 1216 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 528 wrote to memory of 1216 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 528 wrote to memory of 1216 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 528 wrote to memory of 5004 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 528 wrote to memory of 5004 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 528 wrote to memory of 5004 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 1216 wrote to memory of 5032 1216 cmd.exe f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe PID 1216 wrote to memory of 5032 1216 cmd.exe f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe PID 1216 wrote to memory of 5032 1216 cmd.exe f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe PID 528 wrote to memory of 1696 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 528 wrote to memory of 1696 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 528 wrote to memory of 1696 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 528 wrote to memory of 4908 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 528 wrote to memory of 4908 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 528 wrote to memory of 4908 528 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 3700 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 5032 wrote to memory of 3700 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 5032 wrote to memory of 3700 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 3700 wrote to memory of 4720 3700 cmd.exe f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe PID 3700 wrote to memory of 4720 3700 cmd.exe f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe PID 3700 wrote to memory of 4720 3700 cmd.exe f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe PID 4720 wrote to memory of 4088 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 4720 wrote to memory of 4088 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 4720 wrote to memory of 4088 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 4088 wrote to memory of 1952 4088 cmd.exe f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe PID 4088 wrote to memory of 1952 4088 cmd.exe f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe PID 4088 wrote to memory of 1952 4088 cmd.exe f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe PID 5032 wrote to memory of 4564 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 4564 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 4564 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 4720 wrote to memory of 3380 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 4720 wrote to memory of 3380 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 4720 wrote to memory of 3380 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 116 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 116 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 116 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 1600 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 1600 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 1600 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 4720 wrote to memory of 1704 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 4720 wrote to memory of 1704 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 4720 wrote to memory of 1704 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 4720 wrote to memory of 1284 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 4720 wrote to memory of 1284 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 4720 wrote to memory of 1284 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 5032 wrote to memory of 2784 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 5032 wrote to memory of 2784 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 5032 wrote to memory of 2784 5032 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 4720 wrote to memory of 1676 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 4720 wrote to memory of 1676 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 4720 wrote to memory of 1676 4720 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 1952 wrote to memory of 4276 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 1952 wrote to memory of 4276 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 1952 wrote to memory of 4276 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe cmd.exe PID 1952 wrote to memory of 1404 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 1952 wrote to memory of 1404 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 1952 wrote to memory of 1404 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe PID 1952 wrote to memory of 1132 1952 f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe"C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\wmMMQkck\TYUcAAEk.exe"C:\Users\Admin\wmMMQkck\TYUcAAEk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\cEMUkcYY\HSEMYocM.exe"C:\ProgramData\cEMUkcYY\HSEMYocM.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d85⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d87⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"8⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d89⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"10⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d811⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"12⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d813⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"14⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d815⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"16⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d817⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"18⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d819⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"20⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d821⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"22⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d823⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"24⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d825⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"26⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d827⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"28⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d829⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"30⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d831⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"32⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d833⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"34⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d835⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"36⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d837⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"38⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d839⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"40⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d841⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"42⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d843⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"44⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d845⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"46⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d847⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"48⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d849⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"50⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d851⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"52⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d853⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"54⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d855⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"56⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d857⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"58⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d859⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"60⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d861⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"62⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d863⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"64⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d865⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"66⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d867⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"68⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d869⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zEMgkAwU.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"70⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d871⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"72⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d873⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"74⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d875⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"76⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d877⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"78⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d879⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"80⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d881⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"82⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d883⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"84⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d885⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"86⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d887⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"88⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d889⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"90⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d891⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"92⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d893⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"94⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d895⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"96⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d897⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"98⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d899⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"100⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"102⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"104⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"106⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"108⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"110⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"112⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"114⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"118⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"122⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"126⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"128⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"130⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"132⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"134⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"136⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"138⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"140⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"142⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"144⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"146⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"148⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"150⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"152⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"154⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"156⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"158⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"160⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"162⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"164⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"166⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"168⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"170⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8"172⤵
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exeC:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8173⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f174⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2174⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1174⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1172⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2172⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f172⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fakkEgoI.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""172⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs173⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1170⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f170⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egwgoAgo.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""170⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs171⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2170⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1168⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZYIEkwAY.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""168⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs169⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f168⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2168⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tYkYcEoU.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""166⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs167⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f166⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2166⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1166⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\byEAMwcc.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""164⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs165⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f164⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2164⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1164⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f162⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\haEMAMww.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""162⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs163⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2162⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1162⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1160⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hAsUIgEw.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""160⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs161⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f160⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2160⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gMogkgII.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""158⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs159⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f158⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2158⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IgEswgYg.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""156⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs157⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f156⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2156⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1156⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1154⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2154⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DQAQIIcA.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""154⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs155⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f154⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PykcUQUo.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""152⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs153⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f152⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2152⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1152⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NecoEwww.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""150⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs151⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f150⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2150⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1150⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1148⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2148⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f148⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bYMgEMYk.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""148⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AGQYIksY.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""146⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs147⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f146⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2146⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1146⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1144⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2144⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f144⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZSoQEkAM.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""144⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oQIgYUkU.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""142⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs143⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f142⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2142⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1142⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f140⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWkssQww.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""140⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs141⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2140⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1140⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UCUkMYkc.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""138⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs139⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f138⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2138⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1138⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1136⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2136⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f136⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aGssIokU.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""136⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs137⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2134⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YakEEckI.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""134⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs135⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f134⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f132⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWMowYEY.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""132⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs133⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2132⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1132⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NUcwscAg.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""130⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs131⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f130⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2130⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1130⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1128⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGUAMokQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""128⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs129⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f128⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2128⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1126⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2126⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f126⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oWookEkQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""126⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs127⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f124⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VoYwIkAA.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""124⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs125⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2124⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1124⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f122⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ouUUMAsI.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""122⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs123⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2122⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f120⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QaUEYQQM.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""120⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs121⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2120⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1120⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1118⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f118⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EakcgQkc.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""118⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs119⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2116⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1116⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cEgsYwQE.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""116⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs117⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f116⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1114⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2114⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f114⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zQYUoYQw.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""114⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs115⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1112⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f112⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2112⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QkIscEMk.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""112⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egkAAEkY.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""110⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs111⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f110⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2110⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1110⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rekYcgMo.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""108⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs109⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TMgMkwUg.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""106⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oqAkgwkE.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""104⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dgAYQIAw.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""102⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QSokEgEc.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""100⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BCscosAQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""98⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LaQgwAQs.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""96⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ewQQEQIY.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FAYkIwwE.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YCsYgUwc.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""90⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LSMgkgcc.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BscAAwMQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""86⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IaUwcwUg.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""84⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lioscoAQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""82⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BegkYQUo.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""80⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NoksgAcA.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""78⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\USokAUMw.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CMksQkAU.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""74⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jckAcQoc.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PUEkoIMk.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nkwkMEIA.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gAgwwwYQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nkIUkQYU.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JMEUgkYg.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NYkAYQAA.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MesQMgkw.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eAkscccQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ckswgYYI.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ISgkEcgA.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xEUggQwA.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZCEcAwoQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UiMUgwgQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NokgccMQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wCgogAMo.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WqIcQIco.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EisAsMMk.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aMAoIQIk.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gqYkIIIo.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eEMAscYg.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PasEgMYs.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eMAEIwko.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tUMQwwEE.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zMssgcoQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ASIcIUYM.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CgAMgIYs.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ayQgEYcE.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NQwMIQkI.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bCEAsUsQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UoYQkIkk.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JiwUIcIs.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AwUEoosI.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PmkEAUMQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QmAQcoIQ.bat" "C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\ProgramData\vIAYsoQI\jiAwIgIo.exeC:\ProgramData\vIAYsoQI\jiAwIgIo.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\cEMUkcYY\HSEMYocM.exeFilesize
434KB
MD568906058ce0d8c09314da0086ac6ce05
SHA1bc7d2bb6dcaae163e99b2d92eb75b8e86a5c90c6
SHA2564f01444323ec57a35dbf05fe91e051d0938544cc06e4b9705b10dc59c5e8cb62
SHA51257f3b54a122e1a79dc4291f36f43517a890356acf7db49040616cc1a9505450c4e8910ccb50dfd833f11ab69681c68fba9a8ced2f5dd44d5b5382901c02ef860
-
C:\ProgramData\cEMUkcYY\HSEMYocM.exeFilesize
434KB
MD568906058ce0d8c09314da0086ac6ce05
SHA1bc7d2bb6dcaae163e99b2d92eb75b8e86a5c90c6
SHA2564f01444323ec57a35dbf05fe91e051d0938544cc06e4b9705b10dc59c5e8cb62
SHA51257f3b54a122e1a79dc4291f36f43517a890356acf7db49040616cc1a9505450c4e8910ccb50dfd833f11ab69681c68fba9a8ced2f5dd44d5b5382901c02ef860
-
C:\ProgramData\vIAYsoQI\jiAwIgIo.exeFilesize
430KB
MD563450b2784278e078fe1bb1b96f27c28
SHA15c9d0b8f10998d78fc1a885f3c83372da3126aa9
SHA256aa167ebb4c93cf51cb2720a9255d1b2530c4001d96d38aff0a755a26a808d3be
SHA5122cd3c720d89315dfe3f0582ad1925b043ec142e7151fd4bd1edb3d62e8c2e2ed791e3ba31f7f31ee70d51d1df8759f9d244f3395871be91fee955ba8d3529b97
-
C:\ProgramData\vIAYsoQI\jiAwIgIo.exeFilesize
430KB
MD563450b2784278e078fe1bb1b96f27c28
SHA15c9d0b8f10998d78fc1a885f3c83372da3126aa9
SHA256aa167ebb4c93cf51cb2720a9255d1b2530c4001d96d38aff0a755a26a808d3be
SHA5122cd3c720d89315dfe3f0582ad1925b043ec142e7151fd4bd1edb3d62e8c2e2ed791e3ba31f7f31ee70d51d1df8759f9d244f3395871be91fee955ba8d3529b97
-
C:\Users\Admin\AppData\Local\Temp\ASIcIUYM.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\AwUEoosI.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\CgAMgIYs.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\EisAsMMk.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\ISgkEcgA.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\JiwUIcIs.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\NQwMIQkI.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\NokgccMQ.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\PasEgMYs.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\PmkEAUMQ.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\UiMUgwgQ.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\UoYQkIkk.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\WqIcQIco.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\ZCEcAwoQ.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\aMAoIQIk.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\ayQgEYcE.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\bCEAsUsQ.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\ckswgYYI.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\eEMAscYg.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\eMAEIwko.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\f680331d4c0abf81777b43629de4be6ca10d2c808588f5b429d7b2efcfd7f7d8Filesize
7KB
MD58995c7a53e0a148026fbd0da69be9f59
SHA105a9908e9e3e640a426214276de1cbca6f72307c
SHA256d2b2becd2a849a6a716fcab0aaddb41ffaec79dfc4769b61e4355d65897193e3
SHA51245480d070b7014519719cc8de7bf7e1317690732cf80b272df4611b74da1667baf6a886253635ab8735c7bf537cf937902240847387283aa81c4cb7c7b9bf969
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\gqYkIIIo.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\tUMQwwEE.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\wCgogAMo.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\xEUggQwA.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\zMssgcoQ.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\wmMMQkck\TYUcAAEk.exeFilesize
432KB
MD5ddc57fb17b098fd204c9feceb730a8d7
SHA1b3488de66d597a9a8c00c5e8da4061c2f3ed6a10
SHA256334d1ff63a7949789ac9fa3b3de3efea77a807243bd9a021d4da730b6343f061
SHA512529723131fd011a5ffcbcefb573617cdf75bf853c66d884f311e514b56b228707bcbd28a6d64c58f47037c97676f5ef5ddffe81be27fe15610894d7acf15d2c4
-
C:\Users\Admin\wmMMQkck\TYUcAAEk.exeFilesize
432KB
MD5ddc57fb17b098fd204c9feceb730a8d7
SHA1b3488de66d597a9a8c00c5e8da4061c2f3ed6a10
SHA256334d1ff63a7949789ac9fa3b3de3efea77a807243bd9a021d4da730b6343f061
SHA512529723131fd011a5ffcbcefb573617cdf75bf853c66d884f311e514b56b228707bcbd28a6d64c58f47037c97676f5ef5ddffe81be27fe15610894d7acf15d2c4
-
memory/116-162-0x0000000000000000-mapping.dmp
-
memory/228-305-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/240-220-0x0000000000000000-mapping.dmp
-
memory/528-256-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/528-135-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/624-207-0x0000000000000000-mapping.dmp
-
memory/624-222-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/760-311-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/804-151-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/908-229-0x0000000000000000-mapping.dmp
-
memory/1068-227-0x0000000000000000-mapping.dmp
-
memory/1072-226-0x0000000000000000-mapping.dmp
-
memory/1132-174-0x0000000000000000-mapping.dmp
-
memory/1216-144-0x0000000000000000-mapping.dmp
-
memory/1284-165-0x0000000000000000-mapping.dmp
-
memory/1292-276-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1388-194-0x0000000000000000-mapping.dmp
-
memory/1404-173-0x0000000000000000-mapping.dmp
-
memory/1432-219-0x0000000000000000-mapping.dmp
-
memory/1536-184-0x0000000000000000-mapping.dmp
-
memory/1544-325-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1544-326-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1548-313-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1548-312-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1600-163-0x0000000000000000-mapping.dmp
-
memory/1604-233-0x0000000000000000-mapping.dmp
-
memory/1620-258-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1620-136-0x0000000000000000-mapping.dmp
-
memory/1620-148-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1676-167-0x0000000000000000-mapping.dmp
-
memory/1696-147-0x0000000000000000-mapping.dmp
-
memory/1704-164-0x0000000000000000-mapping.dmp
-
memory/1824-264-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1824-265-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1952-168-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1952-157-0x0000000000000000-mapping.dmp
-
memory/1952-177-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2036-217-0x0000000000000000-mapping.dmp
-
memory/2036-238-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2116-298-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2144-282-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2144-284-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2164-185-0x0000000000000000-mapping.dmp
-
memory/2192-210-0x0000000000000000-mapping.dmp
-
memory/2468-250-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2468-246-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2540-225-0x0000000000000000-mapping.dmp
-
memory/2544-149-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/2544-139-0x0000000000000000-mapping.dmp
-
memory/2544-257-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/2560-269-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2560-266-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2560-234-0x0000000000000000-mapping.dmp
-
memory/2780-216-0x0000000000000000-mapping.dmp
-
memory/2784-166-0x0000000000000000-mapping.dmp
-
memory/2796-321-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2796-322-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2808-255-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2808-260-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3092-209-0x0000000000000000-mapping.dmp
-
memory/3096-273-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3096-271-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3152-300-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3152-302-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3264-186-0x0000000000000000-mapping.dmp
-
memory/3380-161-0x0000000000000000-mapping.dmp
-
memory/3428-242-0x0000000000000000-mapping.dmp
-
memory/3528-175-0x0000000000000000-mapping.dmp
-
memory/3636-306-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3636-212-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3636-190-0x0000000000000000-mapping.dmp
-
memory/3636-205-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3636-309-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3684-218-0x0000000000000000-mapping.dmp
-
memory/3692-192-0x0000000000000000-mapping.dmp
-
memory/3700-153-0x0000000000000000-mapping.dmp
-
memory/3784-228-0x0000000000000000-mapping.dmp
-
memory/3800-254-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3832-235-0x0000000000000000-mapping.dmp
-
memory/4032-206-0x0000000000000000-mapping.dmp
-
memory/4056-181-0x0000000000000000-mapping.dmp
-
memory/4088-156-0x0000000000000000-mapping.dmp
-
memory/4200-239-0x0000000000000000-mapping.dmp
-
memory/4200-245-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4216-189-0x0000000000000000-mapping.dmp
-
memory/4276-170-0x0000000000000000-mapping.dmp
-
memory/4280-193-0x0000000000000000-mapping.dmp
-
memory/4348-230-0x0000000000000000-mapping.dmp
-
memory/4380-292-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4380-290-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4400-316-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4420-236-0x0000000000000000-mapping.dmp
-
memory/4428-211-0x0000000000000000-mapping.dmp
-
memory/4460-191-0x0000000000000000-mapping.dmp
-
memory/4548-237-0x0000000000000000-mapping.dmp
-
memory/4564-160-0x0000000000000000-mapping.dmp
-
memory/4656-179-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4656-178-0x0000000000000000-mapping.dmp
-
memory/4656-187-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4716-221-0x0000000000000000-mapping.dmp
-
memory/4720-171-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4720-159-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4720-154-0x0000000000000000-mapping.dmp
-
memory/4808-208-0x0000000000000000-mapping.dmp
-
memory/4852-176-0x0000000000000000-mapping.dmp
-
memory/4876-244-0x0000000000000000-mapping.dmp
-
memory/4896-182-0x0000000000000000-mapping.dmp
-
memory/4896-195-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4908-150-0x0000000000000000-mapping.dmp
-
memory/4944-231-0x0000000000000000-mapping.dmp
-
memory/4996-280-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4996-278-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5004-145-0x0000000000000000-mapping.dmp
-
memory/5016-315-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5016-183-0x0000000000000000-mapping.dmp
-
memory/5016-314-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5032-172-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5032-158-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5032-146-0x0000000000000000-mapping.dmp
-
memory/5040-286-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5040-288-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5052-295-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5380-317-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5512-323-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5512-324-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5660-318-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5920-319-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5920-320-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB