Analysis
-
max time kernel
150s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 12:54
Static task
static1
Behavioral task
behavioral1
Sample
v4vcmk.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
v4vcmk.exe
Resource
win10v2004-20230220-en
General
-
Target
v4vcmk.exe
-
Size
235KB
-
MD5
e7a30a6b98068f2c28af36b58c314c6a
-
SHA1
4a366530e40c4ba0f6df97c8ebce2429aea6cc35
-
SHA256
fa5e38ff3f546827c5e62db27f12d68bcc4cb30285a329088c54995b2e4ec5d0
-
SHA512
8e8bff9a8c1976ca5724a8eaec77b81f7d057311021845aa3f72a6573bf25b189e715af3902fef76079e3dd2dcc6cf7ed513f9f8df9cf60c1e23439c990b33e6
-
SSDEEP
3072:be0LTBeC0bt7ipg9+HaNbVW7MKcvsh/jXo+mo5vCI3nqDEmpl7Z4ovpUsttQ:tTwC0Epg9kIWl4+moESwEmD7Z7hUst2
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
baAsAwog.exedescription ioc process File created C:\Users\Admin\Pictures\CopyReceive.png.exe baAsAwog.exe File created C:\Users\Admin\Pictures\UninstallCopy.png.exe baAsAwog.exe -
Executes dropped EXE 2 IoCs
Processes:
baAsAwog.exeUcsswkoM.exepid process 1420 baAsAwog.exe 2044 UcsswkoM.exe -
Loads dropped DLL 20 IoCs
Processes:
v4vcmk.exebaAsAwog.exepid process 1380 v4vcmk.exe 1380 v4vcmk.exe 1380 v4vcmk.exe 1380 v4vcmk.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe 1420 baAsAwog.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
baAsAwog.exev4vcmk.exeUcsswkoM.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\baAsAwog.exe = "C:\\Users\\Admin\\SaoIgsoI\\baAsAwog.exe" baAsAwog.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\baAsAwog.exe = "C:\\Users\\Admin\\SaoIgsoI\\baAsAwog.exe" v4vcmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UcsswkoM.exe = "C:\\ProgramData\\hYcgYsIQ\\UcsswkoM.exe" v4vcmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UcsswkoM.exe = "C:\\ProgramData\\hYcgYsIQ\\UcsswkoM.exe" UcsswkoM.exe -
Drops file in Windows directory 1 IoCs
Processes:
baAsAwog.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico baAsAwog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1624 reg.exe 1500 reg.exe 1236 1804 reg.exe 276 reg.exe 280 reg.exe 1748 reg.exe 1804 reg.exe 1836 reg.exe 856 reg.exe 1700 1304 reg.exe 1180 reg.exe 316 reg.exe 296 reg.exe 520 reg.exe 520 reg.exe 468 reg.exe 1504 reg.exe 1836 reg.exe 1228 reg.exe 1768 reg.exe 1056 reg.exe 684 reg.exe 276 reg.exe 1140 1228 reg.exe 1756 reg.exe 1992 reg.exe 556 reg.exe 1628 856 reg.exe 1092 reg.exe 1644 reg.exe 592 reg.exe 1192 reg.exe 316 296 reg.exe 2032 reg.exe 952 reg.exe 1104 reg.exe 1192 reg.exe 840 reg.exe 1932 reg.exe 1140 reg.exe 1728 reg.exe 2032 reg.exe 1544 reg.exe 680 reg.exe 316 reg.exe 564 reg.exe 2008 reg.exe 1228 reg.exe 768 reg.exe 1832 reg.exe 1600 reg.exe 1764 reg.exe 1932 reg.exe 1000 reg.exe 1568 reg.exe 1408 reg.exe 580 reg.exe 668 reg.exe 1308 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
v4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exev4vcmk.exepid process 1380 v4vcmk.exe 1380 v4vcmk.exe 1504 v4vcmk.exe 1504 v4vcmk.exe 524 v4vcmk.exe 524 v4vcmk.exe 468 v4vcmk.exe 468 v4vcmk.exe 612 v4vcmk.exe 612 v4vcmk.exe 1648 v4vcmk.exe 1648 v4vcmk.exe 1092 v4vcmk.exe 1092 v4vcmk.exe 316 v4vcmk.exe 316 v4vcmk.exe 1604 v4vcmk.exe 1604 v4vcmk.exe 1408 v4vcmk.exe 1408 v4vcmk.exe 280 v4vcmk.exe 280 v4vcmk.exe 2000 v4vcmk.exe 2000 v4vcmk.exe 1600 v4vcmk.exe 1600 v4vcmk.exe 1236 v4vcmk.exe 1236 v4vcmk.exe 1028 v4vcmk.exe 1028 v4vcmk.exe 1832 v4vcmk.exe 1832 v4vcmk.exe 1764 v4vcmk.exe 1764 v4vcmk.exe 1228 v4vcmk.exe 1228 v4vcmk.exe 1568 v4vcmk.exe 1568 v4vcmk.exe 1544 v4vcmk.exe 1544 v4vcmk.exe 308 v4vcmk.exe 308 v4vcmk.exe 1976 v4vcmk.exe 1976 v4vcmk.exe 564 v4vcmk.exe 564 v4vcmk.exe 1512 v4vcmk.exe 1512 v4vcmk.exe 680 v4vcmk.exe 680 v4vcmk.exe 296 v4vcmk.exe 296 v4vcmk.exe 1952 v4vcmk.exe 1952 v4vcmk.exe 668 v4vcmk.exe 668 v4vcmk.exe 276 v4vcmk.exe 276 v4vcmk.exe 1092 v4vcmk.exe 1092 v4vcmk.exe 1124 v4vcmk.exe 1124 v4vcmk.exe 2016 v4vcmk.exe 2016 v4vcmk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
v4vcmk.execmd.execmd.exev4vcmk.execmd.execmd.exedescription pid process target process PID 1380 wrote to memory of 1420 1380 v4vcmk.exe baAsAwog.exe PID 1380 wrote to memory of 1420 1380 v4vcmk.exe baAsAwog.exe PID 1380 wrote to memory of 1420 1380 v4vcmk.exe baAsAwog.exe PID 1380 wrote to memory of 1420 1380 v4vcmk.exe baAsAwog.exe PID 1380 wrote to memory of 2044 1380 v4vcmk.exe UcsswkoM.exe PID 1380 wrote to memory of 2044 1380 v4vcmk.exe UcsswkoM.exe PID 1380 wrote to memory of 2044 1380 v4vcmk.exe UcsswkoM.exe PID 1380 wrote to memory of 2044 1380 v4vcmk.exe UcsswkoM.exe PID 1380 wrote to memory of 544 1380 v4vcmk.exe cmd.exe PID 1380 wrote to memory of 544 1380 v4vcmk.exe cmd.exe PID 1380 wrote to memory of 544 1380 v4vcmk.exe cmd.exe PID 1380 wrote to memory of 544 1380 v4vcmk.exe cmd.exe PID 544 wrote to memory of 1504 544 cmd.exe v4vcmk.exe PID 544 wrote to memory of 1504 544 cmd.exe v4vcmk.exe PID 544 wrote to memory of 1504 544 cmd.exe v4vcmk.exe PID 544 wrote to memory of 1504 544 cmd.exe v4vcmk.exe PID 1380 wrote to memory of 1804 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 1804 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 1804 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 1804 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 296 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 296 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 296 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 296 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 1492 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 1492 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 1492 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 1492 1380 v4vcmk.exe reg.exe PID 1380 wrote to memory of 1776 1380 v4vcmk.exe cmd.exe PID 1380 wrote to memory of 1776 1380 v4vcmk.exe cmd.exe PID 1380 wrote to memory of 1776 1380 v4vcmk.exe cmd.exe PID 1380 wrote to memory of 1776 1380 v4vcmk.exe cmd.exe PID 1776 wrote to memory of 1308 1776 cmd.exe cscript.exe PID 1776 wrote to memory of 1308 1776 cmd.exe cscript.exe PID 1776 wrote to memory of 1308 1776 cmd.exe cscript.exe PID 1776 wrote to memory of 1308 1776 cmd.exe cscript.exe PID 1504 wrote to memory of 840 1504 v4vcmk.exe cmd.exe PID 1504 wrote to memory of 840 1504 v4vcmk.exe cmd.exe PID 1504 wrote to memory of 840 1504 v4vcmk.exe cmd.exe PID 1504 wrote to memory of 840 1504 v4vcmk.exe cmd.exe PID 840 wrote to memory of 524 840 cmd.exe v4vcmk.exe PID 840 wrote to memory of 524 840 cmd.exe v4vcmk.exe PID 840 wrote to memory of 524 840 cmd.exe v4vcmk.exe PID 840 wrote to memory of 524 840 cmd.exe v4vcmk.exe PID 1504 wrote to memory of 1752 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 1752 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 1752 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 1752 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 1652 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 1652 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 1652 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 1652 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 576 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 576 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 576 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 576 1504 v4vcmk.exe reg.exe PID 1504 wrote to memory of 1248 1504 v4vcmk.exe cmd.exe PID 1504 wrote to memory of 1248 1504 v4vcmk.exe cmd.exe PID 1504 wrote to memory of 1248 1504 v4vcmk.exe cmd.exe PID 1504 wrote to memory of 1248 1504 v4vcmk.exe cmd.exe PID 1248 wrote to memory of 1388 1248 cmd.exe cscript.exe PID 1248 wrote to memory of 1388 1248 cmd.exe cscript.exe PID 1248 wrote to memory of 1388 1248 cmd.exe cscript.exe PID 1248 wrote to memory of 1388 1248 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exe"C:\Users\Admin\AppData\Local\Temp\v4vcmk.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SaoIgsoI\baAsAwog.exe"C:\Users\Admin\SaoIgsoI\baAsAwog.exe"2⤵
- Modifies extensions of user files
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
-
C:\ProgramData\hYcgYsIQ\UcsswkoM.exe"C:\ProgramData\hYcgYsIQ\UcsswkoM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"6⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"8⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"10⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"12⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"14⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"16⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"18⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"20⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"22⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"24⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"26⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"28⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"30⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"32⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"34⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"36⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"38⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"40⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"42⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"44⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"46⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"48⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"50⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"52⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"54⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"56⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"58⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"60⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"62⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"64⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"66⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"68⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"70⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"72⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"74⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"76⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"78⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"80⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"82⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"84⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"86⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"88⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"90⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"92⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"94⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"96⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"98⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"100⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"102⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"104⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"106⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"108⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"110⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"112⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"114⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"116⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"118⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"120⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"122⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"124⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"126⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"128⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"130⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"132⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"134⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"136⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"138⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"140⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"142⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"144⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"146⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"148⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"150⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"152⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"154⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"156⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"158⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"160⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"162⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"164⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"166⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"168⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"170⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"172⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"174⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"176⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"178⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"180⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"182⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"184⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"186⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"188⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"190⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"192⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"194⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"196⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"198⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"200⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"202⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"204⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"206⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"208⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"210⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"212⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"214⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"216⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"218⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"220⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"222⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"224⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"226⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"228⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"230⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"232⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"234⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"236⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"238⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\v4vcmk"240⤵
-
C:\Users\Admin\AppData\Local\Temp\v4vcmk.exeC:\Users\Admin\AppData\Local\Temp\v4vcmk241⤵