193e18be0153cf3f5a3bb5f17993bbbec837a23bdb8cbf99e041044491566fce

Analysis

max time kernel
3s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

689ed592145b2399df46ba774bfc3a35.exe
Size

484KB
MD5

689ed592145b2399df46ba774bfc3a35
SHA1

9ca9ef54ed8c8fe3efd57dbb386023b3feee8d98
SHA256

193e18be0153cf3f5a3bb5f17993bbbec837a23bdb8cbf99e041044491566fce
SHA512

5917aad03cf9162531cfa12517b2257e3cde1427a7a9213d434bc86c822ba21fb589ebcfbf2bbfaa0023d4a16a8c9e60edc9bf2ab40f70a12aef0228c6e1c865
SSDEEP

12288:I9wNF8FZxNnYEDLXtXxi6nj9GUMMcNm3JJWTSUToCW444:IeN8NPDLJ8tU7KmZJWTSUsCW4t

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3164	euoIkQco.exe
4140	kUEUooQE.exe
1460	bckcEoQA.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\euoIkQco.exe = "C:\\Users\\Admin\\vQMosIMA\\euoIkQco.exe"	euoIkQco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kUEUooQE.exe = "C:\\ProgramData\\PmoIIMUo\\kUEUooQE.exe"	kUEUooQE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kUEUooQE.exe = "C:\\ProgramData\\PmoIIMUo\\kUEUooQE.exe"	bckcEoQA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\euoIkQco.exe = "C:\\Users\\Admin\\vQMosIMA\\euoIkQco.exe"	689ed592145b2399df46ba774bfc3a35.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kUEUooQE.exe = "C:\\ProgramData\\PmoIIMUo\\kUEUooQE.exe"	689ed592145b2399df46ba774bfc3a35.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\vQMosIMA	bckcEoQA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\vQMosIMA\euoIkQco	bckcEoQA.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
4432	reg.exe
4616	reg.exe
4144	reg.exe
396	reg.exe
4228	reg.exe
1408	reg.exe
3432	reg.exe
1408	reg.exe
4836	reg.exe
1436	reg.exe
4868	reg.exe
3788	reg.exe
3344	reg.exe
2936	reg.exe
1408	reg.exe
4440	reg.exe
3844	reg.exe
5052	reg.exe
4516	reg.exe
1064	reg.exe
4456	reg.exe
4556	reg.exe
336	reg.exe
5100	reg.exe
3724	reg.exe
404	reg.exe
4588	reg.exe
4464	reg.exe
4500	reg.exe
4572	reg.exe
1892	reg.exe
3148	reg.exe
404	reg.exe
5100	reg.exe
1468	reg.exe
3344	reg.exe
3724	reg.exe
2420	reg.exe
3796	reg.exe
396	reg.exe
4508	reg.exe
4080	reg.exe
1952	reg.exe
960	reg.exe
4908	reg.exe
4604	reg.exe
796	reg.exe
2788	reg.exe
4980	reg.exe
2200	reg.exe
1572	reg.exe
2464	reg.exe
1692	reg.exe
5048	reg.exe
2692	reg.exe
1208	reg.exe
3380	reg.exe
4144	reg.exe
1648	reg.exe
3748	reg.exe
536	reg.exe
1468	reg.exe
5088	reg.exe
4172	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4944	689ed592145b2399df46ba774bfc3a35.exe
4944	689ed592145b2399df46ba774bfc3a35.exe
4944	689ed592145b2399df46ba774bfc3a35.exe
4944	689ed592145b2399df46ba774bfc3a35.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3164	4944	689ed592145b2399df46ba774bfc3a35.exe	50
PID 4944 wrote to memory of 3164	4944	689ed592145b2399df46ba774bfc3a35.exe	50
PID 4944 wrote to memory of 3164	4944	689ed592145b2399df46ba774bfc3a35.exe	50
PID 4944 wrote to memory of 4140	4944	689ed592145b2399df46ba774bfc3a35.exe	48
PID 4944 wrote to memory of 4140	4944	689ed592145b2399df46ba774bfc3a35.exe	48
PID 4944 wrote to memory of 4140	4944	689ed592145b2399df46ba774bfc3a35.exe	48
PID 4944 wrote to memory of 2540	4944	689ed592145b2399df46ba774bfc3a35.exe	254
PID 4944 wrote to memory of 2540	4944	689ed592145b2399df46ba774bfc3a35.exe	254
PID 4944 wrote to memory of 2540	4944	689ed592145b2399df46ba774bfc3a35.exe	254

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
"C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944
- C:\ProgramData\PmoIIMUo\kUEUooQE.exe
  "C:\ProgramData\PmoIIMUo\kUEUooQE.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4140
- C:\Users\Admin\vQMosIMA\euoIkQco.exe
  "C:\Users\Admin\vQMosIMA\euoIkQco.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3164
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:3496
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:4496
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:5088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GUckUscM.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:2420

C:\ProgramData\EoEIQMMs\bckcEoQA.exe
C:\ProgramData\EoEIQMMs\bckcEoQA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1460

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:4828
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:4760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iQQMEAMw.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:3172
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:392

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3940
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:2564
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:636
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ViYQYYQs.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:4852

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3140

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:860
- C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
  C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
  2⤵
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
    C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
    3⤵
    PID:3208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
      4⤵
      PID:4448
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
        6⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wAcskgUU.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
        7⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        7⤵
        Modifies registry key
        
        PID:1468
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        7⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        7⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
        7⤵
        
        PID:1604
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DcsIMMUI.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
        5⤵
        
        PID:3796
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:404
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies registry key
        
        PID:3344

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4056

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgkksQwI.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:2936
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:3844
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:3356
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:5048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uawkwAoQ.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
      4⤵
      PID:4556
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:3448
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:4328
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:2464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
      4⤵
      PID:2884

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2684

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:1920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xqsEEcAc.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:1132
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:3432

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HcQAgcko.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:4948
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:1788
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:4868
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:4996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:4416

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cOkMgsgE.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:4700
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:5052
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:1784
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:3668
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:5028

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:664
- - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
    C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
    3⤵
    PID:3484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WgcMYsQw.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
      4⤵
      PID:3496
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:4460
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
        5⤵
        
        PID:4460
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EIkQAUoU.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
        6⤵
        
        PID:1424
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:404
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        
        PID:5052
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        
        PID:1228
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
        6⤵
        
        PID:3364
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:3944
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      PID:3244
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
      4⤵
      PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKwscIAY.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:3660
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:1468
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
      C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
      4⤵
      PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wUIQwsUU.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
    3⤵
    PID:664
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
      C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
      4⤵
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
        5⤵
        
        PID:4052
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:1064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
    3⤵
    PID:1172
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:4456
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:960
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3380
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:3796
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:3724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
      4⤵
      PID:3320
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:836
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:4464
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:4228
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:4100

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4056
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
    3⤵
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
      C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
      4⤵
      PID:2936
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
        5⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
        6⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
        7⤵
        
        PID:2932
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pwgIokUI.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
        5⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
        6⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
        7⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kUcUUAIk.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
        8⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
        8⤵
        
        PID:2984
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        
        PID:3660
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        
        PID:4868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        
        PID:2904

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VKMUEMEA.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4128

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:1812

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:1064
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:1128

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:5100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:1604

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:1036

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eScIYYkU.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:536

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:1408

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:636

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:4780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3844

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4932
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:1576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FwoQEwks.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:660

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:2788

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:5100

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:3256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LOEoEocM.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:336
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:1036
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:2364
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:1408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\omEAoMkI.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:4172
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:2528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YuUckogI.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
      4⤵
      PID:1464
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:4496
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:2368
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      PID:2220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
      4⤵
      PID:4432
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
    3⤵
    PID:3364

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:796

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:4324

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:5048

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:4508

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:4312

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VuckIAEc.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:5004

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:4572

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:3216

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:1844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iEAksMck.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4760

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:1812

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:3384

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:3144

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3448

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:796

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:1484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QAYUcwAs.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:1800

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:4800

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:3724

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:4080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:1788

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:3280

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:4836

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:1776

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:4480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:3264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BQgoIcMI.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:1064

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:3080

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:1436

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:2324

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:2740

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:2056

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:4464
- - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
    C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
    3⤵
    PID:2528

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3812

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1012

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2348

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SsgccYoE.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:3668
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:4616

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2292

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bSoskMAg.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:5096
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:2220

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BCooUcMg.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:3792
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:404

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:3240

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:4636

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:4516
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:3944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PSQYIkcc.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:456

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:2176

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:4004

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\taYsgwAs.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4264

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:396
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:3780

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:1568

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:5104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SoQwkooo.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4828

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:1208

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:5072

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:2904

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:4536

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3488

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:3136

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:1892
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MCIgUUMQ.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:3076
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:4144
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:4980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XSMoogwU.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
    3⤵
    PID:664
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:3844
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JggQAkUY.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
        
        C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
        5⤵
        
        PID:3780
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      PID:4828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
      4⤵
      PID:552
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
      C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
      4⤵
      PID:760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
    3⤵
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:2484

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:2052
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:1328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xqEMAcAk.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:836

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:3724

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:3792

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:4588

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xksoQcUs.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4400

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5088
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:1568

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:3336

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:1724

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:4448
- C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
  C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
  2⤵
  PID:1892

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:2368

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4708

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1448

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZSwgwckQ.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:880
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:4588
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:1572
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:3896

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:4564

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2740

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3284

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3208

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uysIwQsc.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:2420
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:4556
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5028
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:404

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:4780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:536
- C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
  C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
  2⤵
  PID:4980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rUIYMAcg.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4132
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:3792

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:4004
- - C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
    C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
    3⤵
    PID:4840
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      PID:4072

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3240

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3608
- C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
  C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
  2⤵
  PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BiIkUIcE.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:3788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
    3⤵
    PID:4136

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:376

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:1484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xesYUMoo.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:5008
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:336
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:2200
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:3608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ySgYcgQM.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:5088
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:2992
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:1784
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:4556

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4708

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4420

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:5008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KcMUsMAU.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4504

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:3724

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:4576

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:4588
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:2176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AKcIYYoQ.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4812

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:4448
- C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
  C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
  2⤵
  PID:5092

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:1860

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:4616

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:1572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wmMYUkUs.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:3380

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:404
- C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
  C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
  2⤵
  PID:4524

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:3148

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:4708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:1172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eEMEYMUA.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4588

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:4812

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:1376

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:2788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KqAAwMgU.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:4428
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:4604
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:1408
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:2564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CcgQQcYI.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:2752

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:2420

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:4772

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:1348

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EewoAkEg.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4584

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5052

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jAwsAQgU.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:4576
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:1576
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5112
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:900

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:3344

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4312

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:3432

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:1408

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:4500

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:4984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rskEsMMQ.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:2052

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:3240

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:2936

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:1208

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wukEYYkc.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:5052
- C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
  C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
  2⤵
  PID:1692

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:4464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LEoIAUcg.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
  2⤵
  PID:396
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:1228
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:2564
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:1328

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:760
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:3748
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:404
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:1440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
  2⤵
  PID:4144

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:4136

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:3804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pWQsUsUs.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:3380

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:1812

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:3148

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:4452

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:4464

C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35
1⤵
PID:4060

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NEYIYMkM.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:1720

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:1648

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:4516

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:5052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fSgEUoww.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:2220

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:3760

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:336

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35"
1⤵
PID:3796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lAQYoYoA.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:1940

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:3380

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:1692

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KoscwQcE.bat" "C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35.exe""
1⤵
PID:4056

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:796

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:1692

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:536

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe

Filesize
1.0MB

MD5
01c3f2e760f665473ee8d938430509bd

SHA1
ba9f356389469fbc3577edb1569554c83e04d475

SHA256
0ab8f63a8b2fec6eca50f42ce8cafbea09096d589ae8f860a627da9f1c6f3200

SHA512
c21b5cf05bd5190e10c63de7076422b72f2c97318db8dd91cd428b02c8aa3d96c011aa3f9a83933c4a982414f4b992522524903928e0673efebe5af6ba61fbad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.exe

Filesize
439KB

MD5
1cfbe5fafaf4550ef3b2ab7c673d77dd

SHA1
77a94d67a656100372c6e519d3fec68754cca316

SHA256
b4f2f497331380f7be8ff743bef66ff2fb2ae567d95ffc01bbe626270f81de06

SHA512
5c939321dc0d4c2dd9bee96423d33ceeb9398e4af1a58885c1ded3d788f49e3a139e12fccd82ef2f0b70051a63b4c9c2f9cd911361057e112b3da9dae88796c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.exe

Filesize
186KB

MD5
71afde6a74ae6a82fd4fb0a5375bbabf

SHA1
5c0b3331ed94af9dc4ef1a2f781c3d8b87e63bbd

SHA256
1c9f17c8d5386e9799444b304b0354aac0427213a794d6eb19e7790c12a7a8bc

SHA512
dbceade131104c14e3c29408f792920afb5dc4b33243a943e0d47c14a3fff9f25085bf9ed2526fdf1b30ac29ea9582611b8b86f8858d413279e63bf58a209a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png.exe

Filesize
209KB

MD5
ebfd4a30cf723f43422914d69e60a630

SHA1
2e1d4c741cbbc8205b5770b8c270ac79cf1a7078

SHA256
99cfbda4a5fd6a90f7ed0b04cd02ef9ffc1fe9d2d90bcfd43d45be2bf96fe544

SHA512
f63cd6b7f845cfe91b9188bc696b7e40952d63be696ee22917040adab2e3d46b42067332c224cd4aa2807fb8fb52a9d31efccb5aa7d356d36de139f133e216ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\689ed592145b2399df46ba774bfc3a35

Filesize
48KB

MD5
343fa15c150a516b20cc9f787cfd530e

SHA1
369e8ac39d762e531d961c58b8c5dc84d19ba989

SHA256
d632e9dbacdcd8f6b86ba011ed6b23f961d104869654caa764216ea57a916524

SHA512
7726bd196cfee176f3d2002e30d353f991ffeafda90bac23d0b44c84c104aa263b0c78f390dd85833635667a3ca3863d2e8cd806dad5751f7984b2d34cafdc57

Download Submit
C:\Users\Admin\AppData\Local\Temp\CgIU.exe

Filesize
132KB

MD5
f08bf9576cee3793a400ed7399f95b16

SHA1
2d28a0b830f8fa654b39cf641c414b9a9f459853

SHA256
312dbbc1e48b52a92f859e16b52e1aa42531e6225f1a0da04088f738aa829643

SHA512
a0460a16954c67023d7388067a2c3037967b3dd4e99a6a54ba898e5096c61709203e7c752aa66ba4d9beac7650914791a9691284c9bfed8e8b33ab860d9c23b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ckou.exe

Filesize
436KB

MD5
be3c647ca41aab0413239f10542c9d52

SHA1
cc4ff508224fa4ea70043804c4822979b9b60708

SHA256
fceda6442ce6e9ca6ac4736ea2b727f1b978768ba6dd815a268a69ff57c55358

SHA512
2ac70837e78df0aa797301a3d54b3e2f43b0d7b4425b8da6ce9a5836d24026d87de80636b262212672fb384d461195eb4e7d9053be605a41e0b3d67ab45ccf4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cosa.exe

Filesize
280KB

MD5
c859cf6d0e4cc58f59ff1cbf57e2aab2

SHA1
501d0853ea2e2dc42c63d90d19b6b178c02bc453

SHA256
a5b1ba3939685653bccdde2969a9a1a56b9474d4a8af26ec3d821f7311064db7

SHA512
4297e6ea7ce8ca03b8100cf84e1ffb112118a3618134eaa2f73fc4307e4516fa233d223798ccb960ebd0dd9facff07c80d0efed01fbe64ab350e3d168de42dfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\DUkK.exe

Filesize
322KB

MD5
f85bf990809b61b3ad095896ce3207a3

SHA1
0cf5a9718d9d21e985c26d739df15f6938baab9e

SHA256
bbe103f1547605a0e9d7bfc373b904331da18a17a3bd558b2d4ac05a55f2394b

SHA512
917ccb81db9f77388fa9ed6a6aa4f73b1624d176d5567206df261936c7f23b694e70acfd8e43190b933a5178ea75f36820e805d802559e0cecfdaaeb786a0a0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\EUwY.exe

Filesize
232KB

MD5
740247c9aefcd21bf08af72cb85e1736

SHA1
d01817424c40c170acf7581bcf572f8b80bfc122

SHA256
13ff30d447773325a1b347c825e6fe48101ae97cd2d0a70587aec80fc2636714

SHA512
6f5fa3f5e111158cb35863a56d3d3772a5af9f19dd79e896749f663513ac2faf3c48c1fa6f8b8a8dfc0016c9bf96c4c77558521531165f0ac7b5b948ec6c60eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\FMce.exe

Filesize
283KB

MD5
19fcc34f92b2263bc73321cf31185d58

SHA1
7cdebafeb71cde33442c8be134db4b03ad85fda2

SHA256
31f842aeb7cefbb79ea445f1dc698b7d31b30f8dfc603a6abe11232a7f55eac5

SHA512
f8dce3c43ae13ca724a0e4e52c1fb1e18443238d119b19296e5643447a6e1fe73df798283d38e435ca39ccd188ec58745f539dc94cd1e21c255bf9f4527763ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\KoscwQcE.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\MssC.exe

Filesize
78KB

MD5
1edfca4e9662d1700cc267b5c1e88989

SHA1
2fe786af326da94b6ea04d91f9ebd31f0e097b28

SHA256
bf55efa6eec412d744589b16718f022c3e12af3a9611496211db583647186703

SHA512
0cdf3b5f92d4b3eb96745a3297c1a5bf087d03e72f273ffb1d6cadf872b1139ebd91c0e87f2f4b872d2101e8b8f7f7dc1a42efad06411277a345571cd40b304b

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEII.exe

Filesize
128KB

MD5
fd9f61b17d8379bd827668ca8476cdf1

SHA1
673ec3d6a71428be49dd272c893d7d84b0b57433

SHA256
652d313b795d7bc8648f085e1b9e9c9a04277e9850286a5f7791ff005cb7d73c

SHA512
66494a76a6d579d13dec6326c48fbbf4615b54863ee0eb143e13068ed548732ea74a4ce7b0fc295334c4dec400e04be83a602956924692be4c7b869f1ce9ec0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OwMw.ico

Filesize
4KB

MD5
f31b7f660ecbc5e170657187cedd7942

SHA1
42f5efe966968c2b1f92fadd7c85863956014fb4

SHA256
684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6

SHA512
62787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462

Download Submit
C:\Users\Admin\AppData\Local\Temp\PMoA.exe

Filesize
438KB

MD5
7b8b398241d9fba303f3b90c94a266e2

SHA1
078c1f78a92c4feec03a85dc4de47d74e92abdf3

SHA256
831fd143c899673aedd249d7ad545bf0b6fbfe0f54250b2c66d27be5584f45a4

SHA512
ca57691899313b528b030f53d4511f006977de0fdb5450705cbc103603498194c436e8e876b92023609ebc89bde16f310144c57d3173b3ca23b9c6bc98bd986b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SUoC.exe

Filesize
441KB

MD5
b023399f71a123d835b0652f4e3f90dc

SHA1
9136d324ad8001411576ea05ea725701282b37f6

SHA256
40c7bfa6c55d21822be789695f6495f5d94f3e966523f4c58fab9238bbef7cb3

SHA512
0c864848305c5d144a6a1d7da899c0868f32882c4a11bc4f66703802e22b9c482f56377126f9e66344f9f828161a44b38706bcdcb14f10da7b65006051d83460

Download Submit
C:\Users\Admin\AppData\Local\Temp\SwYa.exe

Filesize
94KB

MD5
888a6d2ab3ef2feec97f11bf58e887ad

SHA1
1b32128b4e6d6238ef6785f8ddb063f2a7aee543

SHA256
5c67af59f84066db2470324dec2454019fedb7e846c6c090a1e3767702ba8768

SHA512
4c8330a4f3ecac90a16a2d8e3bc73b4ffa14f5c7fe1fd3f100cbcfac22bcb54ff6e898a5ac4ed9c750f6bdc9713dbcfefd5e9b98b96ef6baf0f2cc47c257025f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tkcy.exe

Filesize
75KB

MD5
310390933c99f1828e7141deb87458ab

SHA1
b791b5dcb723e0016e27e06f7e1b73c8973fdea6

SHA256
2709d270bae76867a6542496fd1f4479bdb021da2958b2c21a9489a1b9fa5391

SHA512
76e5b01ff1c0e86e496864c1a65ef3a28de58de7ecedd9111a694e0dd62161e4a252e6153de9f0c89de3228a6ac163037ac3ab0c15bdfe2c4996d2ec480c8201

Download Submit
C:\Users\Admin\AppData\Local\Temp\YgMS.exe

Filesize
887KB

MD5
749a23a073e5850f069ced82fa2bb6be

SHA1
d8b6e99d98a15367148f20fa11973a25fdf1e6a7

SHA256
0188089b44dcc0edcb2c541f642c069f0d962b0d11eed5c4e84dcd95df3c2a28

SHA512
ce7ec93fdfaad642bdf808f742a9017c24123542068976b724bc741beec3a6c60d4d3197e3c7690040532998e1c1971545ff764dac1b275284ff31fd69be80e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZkEy.exe

Filesize
1.0MB

MD5
92318053f06f8e446994ec7b8de059fb

SHA1
c3a62b9454f4a1a9871d8d31735340a3b837b92f

SHA256
3c5f89b781279004c9c7ff100296aa1fc09bb40955865eb7a5127c3a42ed8dd4

SHA512
f3d118a3b3a36a76e7f7deb00f6c41a7a5995e07d353f6dbfea7ac18f92ba78f2158013f18f8a14503b56213dd51f6d04aed8739610bc435cbdb186b3dac75ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\awII.exe

Filesize
64KB

MD5
a77a1ac64e67fd2e88fc469e4f35ccdb

SHA1
fc8dfb5191c4febc69d680d4d4ffcff5bda36612

SHA256
0f871515f476633fe3a9ad5a37318b20c867c625f2f626110c684a1139055025

SHA512
6e1b5a6ec5ebb9b03973cd712e47849e0466bbb346fa4004cf322991a25a5d6cdf9e9876762b42e4c937a4ed2333794ea91c905ef2d77e7d09d56760c8e9683a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cEsW.exe

Filesize
168KB

MD5
f653c34aa33f8601247ebf4f95be9a54

SHA1
839dd0ab98c6935c9672e52fe75b31fa72164a90

SHA256
28bfced72a2c6c982e4345bc38be03c493fcf09bcfa22288b9c598e77ae3d045

SHA512
33218ee2815ea81b0fd561a8a82eee1ba071e825f89e92c0223dbde00bfc9ad5ea21f97cf6cc741ae4dd02e3f68b0afd773c05d1b40023922f60a854d67bf48c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cwEG.exe

Filesize
419KB

MD5
52003e8262315151283bb6f3c3d4cd33

SHA1
f03e9cd99bd0bb1c7908d909160c9a6d82bc5949

SHA256
5b8bb0f571981b04f0f23f9d2bb939edc68d0dbe10d3358237a6da409d38c70b

SHA512
75d9d65fd2555b8446aff3a291180f2530a60784b38275d1c09a50712300be7fc6b66d0898fe8a57b47f574cc69f304f66cbc07f5a3988259f890436392e18d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcgK.exe

Filesize
130KB

MD5
8ab2cd73e6a79598ba4908eb0441e200

SHA1
c9b0858a598bee8c77c0c84a1d927357813bebda

SHA256
646e553a862079cae49e6ea2b7f70b3db800c6a4696f4e023fffa12e6ff47535

SHA512
4c99685e04c6bc39b3e049c7f8780455a9492817c8741a255d41aea3340042ff9f1636eab9123b696af3e3d68ed2e63133db51878b57082937fda89b679d24ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\dgwO.exe

Filesize
156KB

MD5
76fd1b8dde1c79b6154f661183aa0a57

SHA1
8c25e9f2ecd57a1af01e745c8ce7d00e2589392b

SHA256
5b5201eacb97c23103a969ff60139ea0afdab8aa77565d810699f7e66dd96cb6

SHA512
5b4cfe9e330a1fb57a61403794568d964a57bcd6623e49ddef1631609a1d7d943b895b67a2548b75deb1cef765705f720862eba4df099952e75b1e34e4363f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\dwYk.exe

Filesize
167KB

MD5
90c12e5e6ac8a54504b766c0b7b994d3

SHA1
39d96c61c57de91e0832d6a40ff5f8981856dd06

SHA256
3a5f5c38215817e585f62c54acad02d18c985ade0fae6816a3b016e9dc59e5b0

SHA512
8993bdece43d128f4e72f80259269eb5592103f5d82326cb3fbfb77100e8350b44e6dfcca411903ea699d96fed5cb1244fbbcf363371554e01f39ac346045d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hYQk.exe

Filesize
132KB

MD5
9dd7ce31a0fba3b25ab7c69046a2467c

SHA1
d1f87d9c2dc48c2feace8c22cdb5accfcccbb5e2

SHA256
e68b34479e1e28f0d738bc97264d22e8cda4e05f22dba41aee218d344d4f324a

SHA512
99551943309e6fd5aec40aa8af78ed5e1ecfddf4f808e454b38e7f5c90ec7f5d0b35ecce36c56c6e895afe00383967350568af4abf408d1ad8b4708a7cc4089d

Download Submit
C:\Users\Admin\AppData\Local\Temp\iYcS.exe

Filesize
502KB

MD5
d22b004ce77e53f7c6e410c385eb96d0

SHA1
8c93769f8cfee684825e07ec58c302ec2a1b2109

SHA256
ab06db38d2ec867a9d8f5bae66178a50972f3a9a6716baf5e6a9b4141ac7ccae

SHA512
6e32a8713fd609a07f7a73a789fadfa84faea79d1b34fdaefe931aff39cd2adc8d2db860716991aa4af4ca4a92e3aa3583869eb6c78ea349029c5bacab238033

Download Submit
C:\Users\Admin\AppData\Local\Temp\iwsi.exe

Filesize
85KB

MD5
92ba718380640c682db8e9c962fbbba2

SHA1
8a9f9278a56e2456af09cda3ee5bcfd4e1efb021

SHA256
2e5b810159e33e17284be821b242375ba57a6f6be40712df7d50d875485d71c9

SHA512
1ea1ecf168bd180d7408b5348205138e66185168ac73e331908916edcf4a55032b314eaec083efd76eb8fd70104adeeb36592f08ccb1a098d30d4d051e5183a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\kMkm.exe

Filesize
70KB

MD5
d69514355ad64c867f8f92d20740ba61

SHA1
424509cce53ca7997dc4d8c59afd5d6cec543c3a

SHA256
171946bdf150dc2c3fda025d3eb47c89e629aa9b849c009f303190a89bc682ef

SHA512
2969e74f41d1f425bb0a8d692539888fa5b5fa8c2c39b7f4b395a4683f31e11fa5ad0ed80bee5dd31b724bcc1dcb6d846e4daed75ae3ec7ea07a9d6a489fc9f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nIAA.exe

Filesize
437KB

MD5
63245b60cc730c51d64f0753e4a5e043

SHA1
0fb8d71b51ae6d6fd3430390332d83ce07e37f9f

SHA256
445832586421d1861325d3f96b3a703596ea16fc6a9b280b91b69d61dd284cee

SHA512
27a2d782e7b602ebe87d5076393fee5b4ed5f20183be1092d515b24da557c6bfaf92ea7a982b1b31be72769292c525af0ba10fda41111d892098c968122cf34e

Download Submit
C:\Users\Admin\AppData\Local\Temp\oMsQ.exe

Filesize
455KB

MD5
29389e65c5eee6c5c9dbc775cf513a72

SHA1
d4143bcd6ad4b8d06927f965bc1cb3bd71808e9b

SHA256
e34564f02e5b714c636c62f40c3a96057a02939fd3362ed3a2c9237926b548ce

SHA512
65d75e75a8895163fd35ab88d6f7e5a20d1a0c1f999e80444a25c84c8a7488a0f64d86273ab07bc5f70d2729b2e32d55fc21783526885117c6eebcffbbfd9ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\pMUk.exe

Filesize
346KB

MD5
7756b9082772f8199f4681d27c31adf7

SHA1
fe2b6f294d139b9be0c436147d44ed8cf80582b1

SHA256
bbdedfad071a271775f18ee729cbb6c710f3412e2746b70e011e9d17b6c9f969

SHA512
080f50c0e0d4cb115090053d4f67384464d62131e66873b7cf82c48f1d1b0244126c2310d9ecc5f763d4b17493a3b821fca35c4e1138ab3e146319d972ebbdab

Download Submit
C:\Users\Admin\AppData\Local\Temp\qUYO.exe

Filesize
439KB

MD5
368e45c0a0adac1db750752f7c152d84

SHA1
cec7a509c3d85761dfe62bbde34095e6c1218dee

SHA256
ef7a8b0892335587da6284bdfc7a0d320dca74731c4d983fa9a9e3f8305b09ec

SHA512
1f2631a97764c4a85cbd8557684cd401f4d601b136ea448a18b4526edcb212931684adcbecfc5e6f448a6643f85fcded88a5060e48eb1ec1c9d662fe4c94dfd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\rEUo.exe

Filesize
185KB

MD5
4250348403c33c9f00e86893f6486a60

SHA1
0eae51076ebd2c24d0c9089de6c244b59812878a

SHA256
fc6ef54837cfce6987dc401f8d264498c2a9bff228bc139b768a1f17ae7b84c9

SHA512
363eaba7fc0f4bce7ee4fdc51b1e5bedfe92699f6556c36e7501d8b069ddc2881abf75479bc7a66f8c1ab00ed24429e89aca7d58a8234cd502973f3587a29743

Download Submit
C:\Users\Admin\AppData\Local\Temp\sUMQ.exe

Filesize
82KB

MD5
4e51e9055c7130b765026adf3e20d5b0

SHA1
675b95e88fa29aa5a447895a669373249cd21c8b

SHA256
62c2c3dabf3f9293ed1aeffd7fbe1318dc3f312ef90e4ec6642fae4bca8d1f6d

SHA512
26b0248838f0b2e05fd63b1277c6b38dfa795f0ca4049f26764e48bf0a8eda2ec18e3464d16a8e07ff6505147b98967f38d5ed6b57a80f25a138587afdffd41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tgwC.exe

Filesize
265KB

MD5
3a4672eeae8565f5432bed00d2c96428

SHA1
38c3b360cf347c22d9eb8be7bec79211cd8a3b9a

SHA256
3ad90fe7048c6a4781df1d787e9cc1885a95c429e971d92f14265626ff7024fe

SHA512
ae5b3a96690f54d5fbab3fa643a5903f0f27583154f515edfccb271f38f62cb6a1ea7f7d339e3594289d19b888fc4c77bc02555d6f9210f69dd24749a5111aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\xAwa.exe

Filesize
442KB

MD5
a2054fff5bc332b6b582783a704099a5

SHA1
d45b5a5da317b3bb4092badb1fc079986bcc9038

SHA256
c05f7c0f37089defe96dee8c5af5b6a06e93aa638c99cbcce5b2d77745b2f83b

SHA512
72dc5516ffe459fd085c69af3dff3a71c422ca0f4f3ac2293d8001ee3da036bf7da6ed78f0fea17cbda45a3cdbff2bcde2a3160144d4d33affd11bcbf3699e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\xgAm.exe

Filesize
76KB

MD5
d5edcf829df3962b789fbaa92d470fb9

SHA1
7a04f8c6d117a4b8f525ec3d9038624147dab7eb

SHA256
8278ffbebb9ab3cad87b7b2166fb23b3613224adfce8252b28e351f8f0507329

SHA512
5f1cf28af3c9d872951849f42bdaa85adbe6638806681ecbb5fa288d795c44d9d2c708b45acfd5333318fa4cd27bb4625402d237ea60e0d34146709818f0ea8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\yMQK.exe

Filesize
175KB

MD5
a4e0ae8d679bd60c5ab2c81dff63d672

SHA1
40a666ea43d5231853121a19040e7e91c9d5d3a9

SHA256
01f752c8b2a79e4d850094e9a7c11bf019b433fa5595013e3b66d984196ee1e4

SHA512
4897cac59196532bf163f97404b8acb5334fec09b6b131abbf43b28b43bceab37047a2c234ffa0594be02d21d8d779b4d1b7032285b30900f7b6353ed84af00d

Download Submit
C:\Users\Admin\AppData\Roaming\InvokePublish.xls.exe

Filesize
33KB

MD5
3dd4eb6a40d9070b04adb92ac2352701

SHA1
8094f5867008459847f4a25fb5a13cf3457cae9b

SHA256
2c31c8988089e5af6cebebd28f9cb754c8bbbbd51d1ac3dc8deb4aca0060dc0e

SHA512
a03eadca20fd58b715b9d1b0259b8430b0d1f4edd871832d8eb2ab4c318e28dee51a6edd18b01a089bf91c8e2b9cfe1833eb111f164e6e38ac56c61ceb632587

Download Submit
memory/336-208-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/336-276-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/760-552-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/760-539-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1036-400-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1036-454-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1460-17-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1460-129-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1484-459-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1484-480-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1692-570-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1692-560-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1920-128-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1920-114-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2056-22-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2056-31-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2324-27-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2324-42-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2528-500-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2528-516-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2788-504-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2788-489-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2884-103-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2884-91-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3164-104-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3164-6-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3172-576-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3208-534-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3208-521-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3256-75-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3256-64-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3448-89-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3448-77-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3484-343-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3484-290-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3712-155-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3712-140-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3776-118-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3776-105-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3780-549-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3780-561-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3844-180-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3844-164-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3940-71-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3940-51-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4140-12-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4140-113-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4324-130-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4324-143-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4448-579-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4448-566-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4460-477-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4460-492-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4480-54-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4480-41-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4516-151-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4516-167-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4588-585-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4944-90-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4944-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5048-525-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5048-512-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5092-533-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5092-543-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download