2574e9a742b102417c4e2afe4ea95e8e8e2115b64c1bb0e8b230e127a757f6e4

Analysis

max time kernel
0s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4ac9a267d30bbd90e7305ecd29ed4e7.exe
Size 480KB
Sample240107-x2s8ssdcb3
SHA256 2574e9a742b102417c4e2afe4ea95e8e8e2115b64c1bb0e8b230e127a757f6e4
MD5 a4ac9a267d30bbd90e7305ecd29ed4e7
SHA1 011560d4f7264e1fe30082d531cf14d3b9093a3f
SHA512 b3af730608e4755cb517844059b9daf0a91f414c9d4317bad5e3c0f5d84f35f947319a19ac13ddd9500a06fb6f55dd46d145305aba6b243a5b7e0679cfd312be
SSDEEP 6144:Ks2t/BDCTlP8rF14db9pOfFZ4iAju7fd5CjW6c9MVdMUQqOP6msgeHgRcefczEgT:ut/BDChWFSdgNKK0yWdvQZsgeqczEd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4820	hEIoIMIU.exe
1776	rgQoYAEU.exe
2984	puIwwoYU.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rgQoYAEU.exe = "C:\\ProgramData\\waoYUQws\\rgQoYAEU.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hEIoIMIU.exe = "C:\\Users\\Admin\\EiYAQYEc\\hEIoIMIU.exe"	hEIoIMIU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rgQoYAEU.exe = "C:\\ProgramData\\waoYUQws\\rgQoYAEU.exe"	rgQoYAEU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rgQoYAEU.exe = "C:\\ProgramData\\waoYUQws\\rgQoYAEU.exe"	puIwwoYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hEIoIMIU.exe = "C:\\Users\\Admin\\EiYAQYEc\\hEIoIMIU.exe"	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\EiYAQYEc	puIwwoYU.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\EiYAQYEc\hEIoIMIU	puIwwoYU.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4408	3600	WerFault.exe	108
3116	5000	WerFault.exe	77
4352	1740	WerFault.exe	107

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
5404	reg.exe
4364	reg.exe
4324	reg.exe
324	reg.exe
5652	reg.exe
3876	reg.exe
1948	reg.exe
3228	reg.exe
3280	reg.exe
4884	reg.exe
3168	reg.exe
2472	reg.exe
5224	reg.exe
1948	reg.exe
544	reg.exe
2736	reg.exe
2336	reg.exe
3200	reg.exe
5524	reg.exe
5528	reg.exe
3660	reg.exe
3168	reg.exe
4352	reg.exe
5308	reg.exe
3196	reg.exe
4908	reg.exe
5784	reg.exe
6124	reg.exe
5188	reg.exe
1092	reg.exe
5480	reg.exe
6120	reg.exe
4276	reg.exe
4908	reg.exe
5176	reg.exe
228	reg.exe
3632	reg.exe
3628	reg.exe
860	reg.exe
3808	reg.exe
3032	reg.exe
5140	reg.exe
4276	reg.exe
1200	reg.exe
4044	reg.exe
5452	reg.exe
6016	reg.exe
6132	reg.exe
2884	reg.exe
3760	reg.exe
3244	reg.exe
220	reg.exe
5908	reg.exe
5968	reg.exe
5184	reg.exe
4044	reg.exe
2948	reg.exe
5624	reg.exe
836	reg.exe
1256	reg.exe
2440	reg.exe
4220	reg.exe
5264	reg.exe
5876	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1508	Process not Found
1508	Process not Found
1508	Process not Found
1508	Process not Found

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 4820	1508	Process not Found	1058
PID 1508 wrote to memory of 4820	1508	Process not Found	1058
PID 1508 wrote to memory of 4820	1508	Process not Found	1058
PID 1508 wrote to memory of 1776	1508	Process not Found	1057
PID 1508 wrote to memory of 1776	1508	Process not Found	1057
PID 1508 wrote to memory of 1776	1508	Process not Found	1057

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
"C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe"
1⤵
PID:1508

C:\ProgramData\ZcAsYkkY\puIwwoYU.exe
C:\ProgramData\ZcAsYkkY\puIwwoYU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2984

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5040

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:2472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:3552
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:2300
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:3940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dIckAgYM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:1244
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:2180

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kGYksQcY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:2664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fAQAUUIs.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:3076
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:2232

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vEgsgIsQ.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:4420
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:4968

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:3500

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:4276

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:1200
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mAwQkIUg.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:2156
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      PID:2472
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lWEUIEkM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
        5⤵
        
        PID:4584
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        
        PID:4928
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        
        PID:4420
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:1092
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:4124
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:5624
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:5524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:5908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:2824
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:1460
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nWcAAkEU.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:4336

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LmIAQssU.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:4248
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:3796
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:3520
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:4324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:4240

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XSEcooIw.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:2760
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:4344
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:1244
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:3764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:3724

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4568

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4560
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:3804
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:4968

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5104

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:2176
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKAgkIgc.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:5456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fiocIogA.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
      4⤵
      PID:5964
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:5940
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:3356
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      PID:5764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
      4⤵
      PID:5628
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:5600

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:512

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:2336

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:8

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1408

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:4908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nicAccYM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:2884
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:4240
- - C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
    C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
    3⤵
    PID:2760

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
    C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
    3⤵
    PID:4352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ioggcosY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:448
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:1944
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:4276
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:2864

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MqIgUUso.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:4560
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:1948
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:512
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:1972
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:364

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2684

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PoEoUMkw.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:2968
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:1740
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:4196
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:4312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:3772

C:\Users\Admin\nGUIEwUY\QiUswMgw.exe
"C:\Users\Admin\nGUIEwUY\QiUswMgw.exe"
1⤵
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 372
  2⤵
  - Program crash
  PID:4352

C:\ProgramData\yGcIsoAM\AAQQYkEk.exe
C:\ProgramData\yGcIsoAM\AAQQYkEk.exe
1⤵
PID:3600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 288
  2⤵
  - Program crash
  PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 264
1⤵
- Program crash
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3600 -ip 3600
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5000 -ip 5000
1⤵
PID:3820
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:5132
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:4044
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:5768
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      PID:5860
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1740 -ip 1740
1⤵
PID:2504

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4108
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XwocgcIY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:3740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fYcQMYkk.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
      4⤵
      PID:5740
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:6116
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:6048
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:5452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
      4⤵
      PID:5700
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QocIUQQs.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
        5⤵
        
        PID:5296
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        
        PID:6128
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:6132
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        
        PID:5176
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
        5⤵
        
        PID:1176
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:5308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:5124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wSwsgsMA.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:5312
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:5452
- - C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
    C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
    3⤵
    PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
      C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
      4⤵
      PID:2852
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xqkcgUgw.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
        5⤵
        
        PID:5680
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:228
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        
        PID:5512
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        
        PID:6012
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
        5⤵
        
        PID:5612
- - C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
    C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
    3⤵
    PID:5356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EqkwMEgU.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
      4⤵
      PID:3640
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:5912
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:5936
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      PID:5644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
      4⤵
      PID:5484
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:5244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5512
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:5552

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5764

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5844

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:6056

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1628

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3804

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5952

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5376

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iUkQMUYM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:3820
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:3660
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5768
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:5784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5920

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5504

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4092

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:6020

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5472

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1684

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:6012

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5864
- - C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
    C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
    3⤵
    PID:6068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
        
        C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
        5⤵
        
        PID:5228
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:5276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MUIAwMUA.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
      4⤵
      PID:5068
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:5964
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:6000
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:5736
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:5968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\REsMccoc.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5768
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:396
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:5184
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:5792

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5168

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:6116

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5820

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5268

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5440
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yOUEEYgM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:6052
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:5528
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5980

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5624

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5748

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5492

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tcgMYcwM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:2528
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:5268
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5508
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5296

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5128

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UIQAkcwc.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5848
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:6016
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qggEkwwk.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:5892
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:5876
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:5868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:5804
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:5168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5956

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hCYkwQQA.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:5448
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:4408

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:6028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sQgEYEMM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:6072
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:6120
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5172
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:5140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5200

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5320

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:2336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TYEIkwkc.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:3504
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:5924
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5948
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:5876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5296
- - C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
    C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
    3⤵
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bCAwUswQ.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:620
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:736
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:3228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eKIsQUsM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:2948
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:3724
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:4108
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:4196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:1976

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3540

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pywccMsw.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:6136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jiQIMYIM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:2176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JWAUQUMQ.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
      4⤵
      PID:2156
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:4428
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
      4⤵
      PID:4656
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:5272
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:5212
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:5160
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:3148
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5376
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:5472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bgcwIAUg.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:5256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SMUUocgg.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
      4⤵
      PID:5616
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:5600
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:5584
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      PID:5576
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5508

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4080
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:5372

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UgEcwAwU.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5340
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:3808
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:1280
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:1672
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:324

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4848

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eosYYowE.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5544
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:5140
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5520
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:6052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:2732

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QiwwYUQw.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\scgkMkIE.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:5136
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:836
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:2156
- - C:\ProgramData\eGssYows\oOQkUUEo.exe
    "C:\ProgramData\eGssYows\oOQkUUEo.exe"
    3⤵
    PID:5000
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:3200
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:6064
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:5364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:2356

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:1584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KYoAkEQY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5276
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:1944
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5220
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:5756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGQosEYY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:5396
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:6124
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:5656
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:5680

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5504

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pycgkkYE.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5496
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:5176
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:5908
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:3032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5000

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DMAkAEwc.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:6108
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:5140
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5816
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:3876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HQUoIQQo.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:4260
- - C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
    C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
    3⤵
    PID:5336
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:3156
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:5784
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zqkgwQoE.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:4108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QQQcAEUg.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:4304
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:4584

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:6060

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:216

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ksEMookw.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:1200
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:2680
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:5264
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:2472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5452
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:724

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5988

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yIYEwQQA.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5444
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:4384
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:1672
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:5140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5812
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:5348

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:392

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:6064

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5548

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4108

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:1684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xIsEAYYA.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5904
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:5264
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:2388
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YWAYcQwo.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5312
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:4940
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5612
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:2504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:2176
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:5380

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HCcoAwcY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5856
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:324
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:5228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asUUAIQY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:5404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:4848
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:4220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:3820

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5632

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5552

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xIkMkIwQ.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:5460

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:5580
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:3976

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:3520

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hUMQIcoA.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:5832

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:4352

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:5868

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5364

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3488

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kuwIQIMM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:2528

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5312

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:5652

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5744

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cQgAUwMM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5828
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:2736
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:6064
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:5480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:5452

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jUQAssUU.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:4428

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5824

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:4312

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:3772
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:4080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5580

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5400

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2176

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DWsoAkwo.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:5064
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:2948
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:1916
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:1740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:4408

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LqQEIowc.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:5704

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5412

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:1300

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:2260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5496

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5940

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5584

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5224

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5860

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5980
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:2948

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:6072

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oCUggIIM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:1368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YyIAIMAY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:2484
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:544
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:4860
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:2616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:3760

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5584

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:6124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:5224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bSwQwMEI.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:5868

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:6024

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:6052

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5960

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:1700

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vgsccMkQ.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:1140

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5828

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:5412

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5384

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:6124

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nAIAEAMU.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:5188

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:4352

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:3444

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:4440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:1092

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:1684
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:3216

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WcEkowkY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:6064

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:1788

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:6068

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5700

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:6088

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5780

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:5232

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jSsoQoIs.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:5572

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5348

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:5428

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5436

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5456

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DIkAwMYo.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:4260

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:5188

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:2400
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:1616

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:1948

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:6136

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:6096

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:5296

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:5288

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5280

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:5256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5216

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wiocEAUY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:3112

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:4344

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:4044

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:1684

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4452
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:3244
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:2360
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:220

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:4276

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:2212

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:2388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:4352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nsQAgQYs.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:1200

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:3168

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:2736

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:2284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ngMcwYkY.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwwEYYoM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
    3⤵
    PID:528
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:4908
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
    3⤵
    PID:1288
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:2948
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:4092
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:1668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:4092

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4304

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4248
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:2824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qEUcQskU.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:364

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:2852

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:4908

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:3628

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4992
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:3280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:4240
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:2284

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:220
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:3952

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3280

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:1368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BAMwEAoE.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:748

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:3280

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:2864

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:1256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:1684

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4716

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qgokYMsw.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:2824

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:4968

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:4364

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:4276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:3488

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ckgUkUAo.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:1256

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:1768

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:2960

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:3304

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:220

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iSMAIoUQ.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:3808

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:4044
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:2232

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:5064

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5024
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:1696

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:4348

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KGssggMU.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:4732

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:2340

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:2440

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:3632

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:3168

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3980

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:4408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eYwAYUoM.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:4892

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KUAowgcA.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:4992

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:2668

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:2884

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:2360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:2712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cskMoUwc.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:3552
- C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
  C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
  2⤵
  PID:4452

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:2736

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:3724

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:3760

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:1088

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:4452
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:1972
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:1504
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
  2⤵
  PID:2400

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:2976

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:4816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:4068

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:3168

C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe
C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
1⤵
PID:3228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:2968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GsswQMMs.bat" "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7.exe""
1⤵
PID:4044

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:860

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
PID:544

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:2616

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:2680

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3540

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:3344

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
PID:4048

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:2336

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
PID:5024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7"
1⤵
PID:5032

C:\ProgramData\waoYUQws\rgQoYAEU.exe
"C:\ProgramData\waoYUQws\rgQoYAEU.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1776

C:\Users\Admin\EiYAQYEc\hEIoIMIU.exe
"C:\Users\Admin\EiYAQYEc\hEIoIMIU.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rgQoYAEU.exe

Path C:\ProgramData\waoYUQws\rgQoYAEU.exe
Size 428KB
SHA256 ac4f9cefbf2860df0312cc7c29709ecd91f959bf084429e6cb76234a4a70d608
MD5 38ef86528a052a9755cfb9407997750b
SHA1 31b400331fdb503a5ad80e94d54d83240aea3d02
SHA512 ea80fa89179bdab7dae454bdfe934d1a4ba72334e4362286d6358abc76498d519bcda361e0d34967d873db300aba84735a485b17f18d417ede378734ff48e366
SSDEEP 6144:kuehcIjVVOWyuBsXZdzCEUJqxMjgHYyPJDKqW09z1PibAuJNhVJJMWJgvJnfmRpD:kuen2WwdgjgHYckqd9JPibA29MWLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppWhite.png.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.exe
Size 439KB
SHA256 b832a0d23d1aaeff64bcd67db4ae9613480c4c74082ce9e1f2d38cd23e2ff425
MD5 d8f0397327bd02305455a67c3b97fbe6
SHA1 0ac56e66542c59e2173af73d9c611da6cb901a46
SHA512 f323b7d79db4b1634080bbd2ad96348ba7f8010d72ae0ba6d8da942f9863db9d28f08a32cdbd29ccb9192afd7d7f1c4c7bf771f5f562ec36f6acffcee3aaae87
SSDEEP 12288:XoR50WKKmeSx71ND0d5MuxAJpYVpvR8vT7EXI:4/n9Sx7LDq5MuxAJpTvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

AAcS.exe

Path C:\Users\Admin\AppData\Local\Temp\AAcS.exe
Size 440KB
SHA256 d6ba0e3585f0425025b0b5958636a8dd82a95e8eb61ed7e8ea47ddc33a7d57ed
MD5 56de12c255876de3685003f8b2be602c
SHA1 2e9203e7452d58e79c3cd13c75e44cf7d035613d
SHA512 01508eb0fa1753de575f83d8f9b9556a2ef7b662bb75878e3f0252fd970ab8be2f4620b8c0ca017f1d0fcffb796a50b77482ce73bc5f701cde7a99acb54b88bc
SSDEEP 12288:JqLTqmok0zHt9+nYExx6fM36P4OwxCVGJDfk1y:USbLHfMKPyxCRM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Esgg.exe

Path C:\Users\Admin\AppData\Local\Temp\Esgg.exe
Size 452KB
SHA256 522fba5aca5e69d474c3b069cc2fff015d10eb9d1b4b615ea27e8ab8a10c218d
MD5 1fd62683b1becd7b9e30fbd6a6906719
SHA1 96040b9c0fd69d0dcd2d3f6f90cdbb0e2b3334be
SHA512 c99d1a63093dceba8dd366d84ae62fc0b37893aec68bd3565b5a5cd7ac48b00417786ac1a909e4b825fb1c1bf34411883a8396d226f4ea14ba3c5781297db3a1
SSDEEP 12288:67wHJgbyBPTNZQjuD44wNFAg2CCnDZRJ2ESrShOJejgdX0hmcd:FrBPJxDRwNafCCnMPGhOlZ0hT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ewgi.exe

Path C:\Users\Admin\AppData\Local\Temp\Ewgi.exe
Size 438KB
SHA256 fdce04f2e484616b0c6a0247c659eb6d55a8932cd889133936682aa05d1e4036
MD5 92ae9bdd380600fbecccd67580d2bb0a
SHA1 e6f0b62559ac9d3b9281f463a3960733c227a175
SHA512 a06f5d1a81ce5933f6cf8ef52442175d911705a75fc459d81f7362b98be7b7b2862a1fcc529141b7669c8f02c2ca35c0b378590ea1c59a1cf41e31bdfbd45da3
SSDEEP 12288:tpWkFEQ+0hyp5G6AcfyPst0wD+VWKMw6:jF5k5nPKu0wD+VWFw6
MD5 SHA1 SHA512 SSDEEP

Submit Download

GgEW.exe

Path C:\Users\Admin\AppData\Local\Temp\GgEW.exe
Size 808KB
SHA256 b878892bafe71a6fd28f21955148e2850183640c61fd2a2c018331b7992629f3
MD5 54c53bef9581dc8330cf37f3cffe04be
SHA1 dd3b97118679fcb0467f1683b2f18efd83f1b033
SHA512 675e5923bbbc2fb3ccb539fb639d074eafd96097d7598ba615e444c6212dd7a0411a4c1fb90a7181ee8ccbb028f454bc7655b217b72903fd279e480941173cd3
SSDEEP 24576:H1w2OTVom5kath8DgRziU81iI/FnwNsAJ:H1fOTVonataDgS/pMtJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

KYcG.exe

Path C:\Users\Admin\AppData\Local\Temp\KYcG.exe
Size 442KB
SHA256 98ca765fa523f1c0e69b9fc5c0c8d65969ec78b36de1ca77842837f6ae099fa8
MD5 9a2661f89a6bd94ddb9529b6d636fb03
SHA1 612c7b1e91539d0732b352d4c8877802cd3c9275
SHA512 3011534b2c5441abaf88bc54f53db21528ec3b65b6b21765a0b33553e53a0a0acd1e2e0c9c0a8b8f50f8b217afd465ba6ac9cf23b94905e1f7b5cee4297ebb48
SSDEEP 6144:RoPZdRrO6o5K5Xhfo+awVchHzov6NXJUWDxyGcbasBb7dD6mLH4AUtTu247Ef:C3dE1qOHzov61NDxXWbcmLYVTrVf
MD5 SHA1 SHA512 SSDEEP

Submit Download

QwUk.exe

Path C:\Users\Admin\AppData\Local\Temp\QwUk.exe
Size 433KB
SHA256 0ee91888327ed8e394c9cfcfffe67ebdb011421fe2143dd077c9441eeebb3b4f
MD5 b0e6148e9d6eafc7e9781fdbb64ab7b8
SHA1 b356f7813411cf992d90760ac46ab5eafdaa2430
SHA512 f0ca8962106654ddb5756d3b97e3185fe42800876a3b350a5824f8e08358a28a833ac9646f6ce46cfc2c44ec92b589f27818416663610eb4b26e10e707623f1b
SSDEEP 12288:vzja/7xTihneAhGIokrgc0XomP705UdeAXWqjPh:v+xTihQHkrr8XPYudeAJDh
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAEk.exe

Path C:\Users\Admin\AppData\Local\Temp\UAEk.exe
Size 1.3MB
SHA256 4f3ffefbcf41b1ce354cd0e1588176f04a24aa300deb68f00c7c73b49cd3b99a
MD5 7b396f4957ea94b0802e45ef324dafc6
SHA1 f1dcdad58905941e6e097375268f55e741fe85bb
SHA512 97fb4698c869814d5fb4cb7f510163150deb54ea4bf40dd928c5be0b1eb96ab4b99a96d4c67a04a22bf4e5d528523ac7b0f6542fde2174dc9a2a13f799d8ce42
SSDEEP 24576:Ca3HNnzeRonG0Zn8sFLlMo8EvLktU9GGkrOYrbYsW1+UGW8ja6fVmrkG:CgHNyRoG0Zn9MevLmU9GGIOYrA0K8jjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAsw.exe

Path C:\Users\Admin\AppData\Local\Temp\UAsw.exe
Size 436KB
SHA256 4ee265d1c7823cbf8f32d93613234d6bf75eb694a80619ca6c854b790dcbed0f
MD5 04af86dd79bbea4a325dcb31be56a0e9
SHA1 a340799c073b148751c26b6b1627eb92ec456b29
SHA512 c972f83295af0792b0cb87a0b6b030bde0436c970b79a5f7161f3569ce46b11a2bed4ddf964f8bde1d9078331f55a6389591b11396bcf7eac0d828c7a8c5d852
SSDEEP 12288:GoGIOObtBE2vM/ApGoQieU9hUAVHXVZtD5s:GoGEbti/aGTixUAtXtDy
MD5 SHA1 SHA512 SSDEEP

Submit Download

WUgk.exe

Path C:\Users\Admin\AppData\Local\Temp\WUgk.exe
Size 439KB
SHA256 7548c1d52f5236587d8db7a80e4410c151162b51c974f017b676416996e65757
MD5 4439f5fa24b89be6b733ad989414cc49
SHA1 72e4475de7647bc0829b96401eff32c33292b337
SHA512 41b508dc39d42218aba185b607ab28bdd61cf53a1f8c9e6778d8f839364a2723dc3c41b200c30cf517fc592c0708fecde9f1b9ad178cc0f73cc2cd081125176c
SSDEEP 12288:C8eCNKIcUyXI6/ndlOXwxM5n26rWJcUdW:CicU+/dYmPEWJn
MD5 SHA1 SHA512 SSDEEP

Submit Download

a4ac9a267d30bbd90e7305ecd29ed4e7

Path C:\Users\Admin\AppData\Local\Temp\a4ac9a267d30bbd90e7305ecd29ed4e7
Size 48KB
SHA256 622d8defdd6b6abd80a45ccec629363cf38a7d338945cf1af27bdfe7d0b777b6
MD5 9be40486ad4e673aec97906a636ccb2b
SHA1 19130bbaf3f33098a884ae68b3e5b0e8e2789c14
SHA512 9017b561dff451148f1f1a5da2028b2eba6162ab37dceece82b28f28269dd2bb6295d02c097f9550aa87b64841290a7cc587c6aae123168bf53efed0620172ed
SSDEEP 1536:A9Chrh8ImnBf6hHPbbnd3KO+nAUHtzRftvFS4WMCv:A9GqznR6xD53FsAUHrfBWMs
MD5 SHA1 SHA512 SSDEEP

Submit Download

aEkC.exe

Path C:\Users\Admin\AppData\Local\Temp\aEkC.exe
Size 2.0MB
SHA256 83a3af8a7f354f7b50bffb0b6a95175749292ae4bd4d4d4401d67fa698d8accd
MD5 fc31653274322f1e03e386a5139722be
SHA1 103bf9f8805f98ed93c5eeaf4fb6887ec8bf2b21
SHA512 bffcfa0549cdc4b6da6cf89f7a8837890d29991b3f92a34f7c3ac9835a5f2a1db1c8f9e39d22440431a2aa6ec37c80a30f54c55b963493cd5bfebcbc1cde4b4f
SSDEEP 12288:oYpFoLzBaKncpxdmL/IWBbDHbTlXnI5ftwZf4MqWUP3OuKGbnRV7EuyKUazhds46:oaFobcpywOFXh8WyEGDEuzUans4hx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

akYA.exe

Path C:\Users\Admin\AppData\Local\Temp\akYA.exe
Size 443KB
SHA256 264a258daa5cbcec09fc110e01ec59ba3ba460a7f199cd93bc3b801d0b899a2e
MD5 9058b09d8a8c46aeea2e77d92990e2ae
SHA1 0786dbf922a9eca715f1d83a918e09e233837292
SHA512 4e8ec7f18a943d1b1429bc677d679e409753df401d9834fb6ec341cd60534182a1454ef0454e32c34e40ac9424590a0db06d243d0a20a8280f3615fee01045b8
SSDEEP 12288:+a60FUY9CTnOQOdwHLYdlDkjK9UVAsgpPai:t60Fen3E4K9UIx
MD5 SHA1 SHA512 SSDEEP

Submit Download

eIgq.exe

Path C:\Users\Admin\AppData\Local\Temp\eIgq.exe
Size 440KB
SHA256 4257bb7a144613785131f08c91a3d44dda8734fb543c9a9260e74a1e2997c3e1
MD5 5c67a85c0df04edf58b5a670911827bc
SHA1 d7502c6a6ad69db9a3b27543f9b47529b8c78c84
SHA512 c8c41dbb0b762893bd15dfc59efd41dc405464bfbacfb954288a40a9f254513b60c9687b409cf037345023d975f8f0d099a328e0682ad632a24b005b83ce676b
SSDEEP 12288:I+UCoSnIa7rbNuL+k6IckEfpbgpgB+EOim:+FALAfPIfpb5B+Ni
MD5 SHA1 SHA512 SSDEEP

Submit Download

eMgs.exe

Path C:\Users\Admin\AppData\Local\Temp\eMgs.exe
Size 432KB
SHA256 601c2966adfef1668fe43c9b5cc0638bdd0d989f837fb30eee4bd07ca26eeed2
MD5 1146193e3343f0d005ad2c62daffe8ec
SHA1 77d16a939854cd0d9d726ff7cc67a466e56adf3b
SHA512 6babfcb2bf8774e2d3189d65ce2b9f5140aa0a866e546ea258073fe7bb57d631977b54d31bf06fda5e6f4da41c3b80b84879bccf13740ea192d3fb0d6fb067e2
SSDEEP 12288:IBF1IYE2vnzBSVkVDjmUIqufM+Q2HFPV:IL1/VDaquzV
MD5 SHA1 SHA512 SSDEEP

Submit Download

eswS.exe

Path C:\Users\Admin\AppData\Local\Temp\eswS.exe
Size 441KB
SHA256 8d257b14e00edcef03b1dd2b24b3c62d4d5431786f641b0111183c7e8bc8ccc3
MD5 eb2debbedf4594408be9eb907a619921
SHA1 5965350674a165ca9f25b476ba931a5ed0140a0c
SHA512 9d5d51c6b374dc7147e7afd98066b24acae8f402c9d42168176f116602d449bafe811605db732b8abedab76e222ae014fac4b9ee800705a3b23cb2bd35c60f6c
SSDEEP 12288:tI6TEwLWXHSMcHS1RXsV9AJQquVDfRG3MFoX:tLy3S57V9AJSFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Local\Temp\file.vbs
Size 19B
SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
MD5 4afb5c4527091738faf9cd4addf9d34e
SHA1 170ba9d866894c1b109b62649b1893eb90350459
SHA512 16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
MD5 SHA1 SHA512

Submit Download

gAEu.exe

Path C:\Users\Admin\AppData\Local\Temp\gAEu.exe
Size 438KB
SHA256 6ac3f642be7e4629e1a3a394f1e1d1ff37b2ec2cbf1c740eea9255da863fcd2f
MD5 fb6c0d2b37e52225dbb9bf9d59c8776a
SHA1 6281cfa0bad4dcedcb7d867028fdf70cc2906049
SHA512 ff7b7dcd298a4237b627dea63a336db65bd89c1c583e12cc7cc7209983e421a0f392333837cb61fe74214f2a101b05739f2e32c1b81f07509553e2ea667e54df
SSDEEP 6144:huI2P6YZBFA02T25vHVybMYu6mWP/4ASkcw/Qin7KAx2njss70PTM1AlCtqMC5:AA02THMYunWP/dY2kss70I1AOqx5
MD5 SHA1 SHA512 SSDEEP

Submit Download

gMQa.exe

Path C:\Users\Admin\AppData\Local\Temp\gMQa.exe
Size 442KB
SHA256 8b2512e9f939f431e5687746b33d0d129d09d31f5efd8c460d77db10e1e96444
MD5 dbe5689ec20dc7ea26048039d17161a3
SHA1 af33f44fd4b1610c447709680c186f9e8ea53df0
SHA512 8f07ef38d6e7a643c097d3029411c7b302794fc7c067a653e18c2344e05cda7e40806a7a7a48ec2f9d2e8ff9ef5d1af40fae9b97f58098b1205b96c1c4e5b44b
SSDEEP 12288:vn/ru8YMD8NMnXXRhGOBwYFYoEWkMlmNLA2R7k:vnjuUDZnGrYFYoVmzR7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

goQi.exe

Path C:\Users\Admin\AppData\Local\Temp\goQi.exe
Size 439KB
SHA256 d6049dcad025aa5953a16b8aff1770c4045334ffd1b0a7da389542707292ceb8
MD5 2910a7a1d3613d068450628aafb598b0
SHA1 d97eadd1ca9865e6dc745108150ff469c4b5084a
SHA512 3e4fb26890089415b33c9483ffabdebdcae98f267d00bccab4cbb1c593faa2e79eb8d109c981efe6fbf08b91115baf003cd94e5d94ed5da5b378e2375053761b
SSDEEP 6144:UbUTu2yUkWv694DHfWvV7mNEe4w69gO782fm6L99C1LaKWUU5UuCOEqsbtRWlxPy:UgTN0Wi9Ae469gV6m9aKWUUtxPIwBGR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ikks.ico

Path C:\Users\Admin\AppData\Local\Temp\ikks.ico
Size 4KB
SHA256 684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
MD5 f31b7f660ecbc5e170657187cedd7942
SHA1 42f5efe966968c2b1f92fadd7c85863956014fb4
SHA512 62787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462
SSDEEP 96:zEaAPm6L4/wJ5IS4WMsm9mxdgT+YhYvOcHa:zEaAP9L4/IqS4W+9mxdgTLYvnHa
MD5 SHA1 SHA512 SSDEEP

Submit Download

kkQE.exe

Path C:\Users\Admin\AppData\Local\Temp\kkQE.exe
Size 6.1MB
SHA256 d9a2b9d50d404e301209898f9fa369bb1098d0be53581578635da28310376c46
MD5 2b782a0a76110d1c2e5c947910afebb2
SHA1 fbbd8fdf2de66568a8b5688287d500734b3d16e1
SHA512 c19081826af35e3a6a80c7e39b410ae24c93e834f6ff8a2f409a47303133de44859564eb2c14d257354ad6e22d5ff972bba00f9b37a80087d20a7d631dbc6d13
SSDEEP 196608:qOAemhKgbYrqYAoFr5tOh4OPvAKKBRzJyCm:vRtq4DRlyz
MD5 SHA1 SHA512 SSDEEP

Submit Download

mQcU.exe

Path C:\Users\Admin\AppData\Local\Temp\mQcU.exe
Size 441KB
SHA256 51f77a6f7bfdbe5b26cae05fc617d0729729f4455581de431a58cf096966aecd
MD5 c03fec8d4a221a4b55d0dbe679a1990d
SHA1 46016a2c7ace732eace55830b61dd8fc861f68e1
SHA512 a617e20166e64a6eff955a7073af91686938c38b680680310754ea585ab9dd3d3f2d829f9a7fac83e85b4cf3ddfef4a128fb911395577f7e6c6e38824554d65b
SSDEEP 6144:IWYU2YhyQv7bZ//LK+uO7J+jBFi2QOcugSVlsCNL2At5YurCHauIEnReiOkiRhz:IehykH5tax+NCNLhYuXEnReTkazY
MD5 SHA1 SHA512 SSDEEP

Submit Download

oAow.exe

Path C:\Users\Admin\AppData\Local\Temp\oAow.exe
Size 441KB
SHA256 233c9a49c5db666894d290ed428e025bf700e3e010db1e1f72947780fbd6e14c
MD5 97d92aae83e9fbfab4b49df18218ba79
SHA1 0ecd83c01ffbb6fd14541fce8baa91428325a8c0
SHA512 f21055eebcfb3f8305a6c1ea9b40353949bdc3fd6e7138730b99737b3f5bf22c5e80c41ec737028c5aff8d999b9572f4bff7301f51c218206a5991cd47d7a9bd
SSDEEP 12288:ulZeBCyZNC48G1EeW7loTn4n0j9vD2wV+:E3J48yTnLju
MD5 SHA1 SHA512 SSDEEP

Submit Download

oosM.exe

Path C:\Users\Admin\AppData\Local\Temp\oosM.exe
Size 433KB
SHA256 2d16573516fa082ded0d359ef835d3e6858ff237bf157fb1af3b5b54a9d0024b
MD5 7b9eac56907ea13f01d2d7d9f2895fe0
SHA1 f2c4f9c3d9422ff3e43582fdd15511322e3a3bf9
SHA512 68b607ed25e6fc08d0199ac24d3b4e443844037fe84a93e3e6e9aa8a2e8f0244b017aefcb61d6b08560bdc6df4d4ebe6aa56ce5ac4ffb021a1322e76969c90dc
SSDEEP 6144:KhtMu24nzBViUqmB7wO+DcRnsaC8fMgG7iVQnpheF7EMAUEisqvdi:U12SBViqSO+DcrCqfG7iy6Fkild
MD5 SHA1 SHA512 SSDEEP

Submit Download

sAYm.exe

Path C:\Users\Admin\AppData\Local\Temp\sAYm.exe
Size 668KB
SHA256 eafbc43b45d8fe095bb2c19b0b640a2e229eb6515c8ed2e8dd9ad0109d01fc27
MD5 697f6c8980cf8c9d617a63ac43f8a8e7
SHA1 e7b5ddb5e2774171b5203877445c6f0c80e9d615
SHA512 5f4bf7e50d83e64ebb7f41452196269c9ef5c7bf0e5f57083c1db8c4fc7fd1e0adfbbd15ec0e6eb82f831d1ab47e02b14a0c7bafab569453ba903825f5478352
SSDEEP 12288:KGJSRXUuLNXIAAGkuyqzyluPCavw70AaL0C7GvnI3/VQ6KGZScccfVpn:K5U04FGkuyqzdtVA+7h39DPSccc9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

sMUA.exe

Path C:\Users\Admin\AppData\Local\Temp\sMUA.exe
Size 435KB
SHA256 ebfd009694f91dce05b9b590bc3a79ea01c6718bcaf2f8e4a23b2699c2c039ff
MD5 a1e1efe06ce1b17c9c05f50254aa4d5f
SHA1 b9a1db0a611fc6f40c83a10410c5e8b6e65c36e7
SHA512 1e2d3a40e41e8a8b82cd1251c6885d23ac75893fb93f6d43088567b7cdfac4ae8e503d674dd104aa86f3605ddd168ce5552e2e63a3c62c5b543998ea005d6922
SSDEEP 12288:qK412Ga4vsKqYjT/c1oWBSCUPPeQT5s3eyDGX/asn9/oV:qKA2G1vPqgjknBqe8S3TDGXSsn9/oV
MD5 SHA1 SHA512 SSDEEP

Submit Download

swUe.exe

Path C:\Users\Admin\AppData\Local\Temp\swUe.exe
Size 443KB
SHA256 ea78894ce0ce2d58dbdea3fca45ea0772cff2a5259a9c584dda4df36822f7609
MD5 99d3a078c256d0d0d5692eebffc3caac
SHA1 55ceccd9b3416141fb5ea97323fd45f1ab02597e
SHA512 d9d3971e36370c116e5197b963557c40cdaf06f7b46bdc1b65b6c0293adc09e61a027e49387941e6ea6e791f92a33c7eeb2a8726e2b3afc8936258d90d87d2b1
SSDEEP 6144:iDsOWwOa5k3KlRYCmBlTM8AYE8bQ4tP9GujO///fPqUB/gdDw9BdA6GWzXuHL:iIO5O6lR6BeODZ9A/XfyUFu4dAdWCH
MD5 SHA1 SHA512 SSDEEP

Submit Download

uUEy.exe

Path C:\Users\Admin\AppData\Local\Temp\uUEy.exe
Size 439KB
SHA256 865902ab0f8bb881366e880f31e4eb73d5381b8d15ffb3735ff897c1a225c219
MD5 995c655d620f2fb1269d5dbce1426ae7
SHA1 24fdbfad1a0c361ff819fb8265a13d23f20d8ee7
SHA512 fcc25ba3acb2bf9a3b6ec40b91583d548f2f2ef06c5046d1b3b0d17ece9f7ecdd312a4f333f1684186753b811b2dca3c7bbecbace7a510c0895586f9f65d3fb2
SSDEEP 12288:9gOsh3GY9hEQA7H1zwpOTjuFoQZ3hVHBplM8dL/9:9nstGqEApESFoO3hVHBpW8d
MD5 SHA1 SHA512 SSDEEP

Submit Download

ugwO.exe

Path C:\Users\Admin\AppData\Local\Temp\ugwO.exe
Size 437KB
SHA256 26c27a97cfd57964a0b0334cf9912a822e39eaa5b5dabb0d8692f8adfa0ceb42
MD5 2483cbe4055fc4248ccd9715fdf1b5fe
SHA1 c692802da7ab05dbb6a8c3a4c95f9735d301568e
SHA512 a1fc49674e2452cc4ea5264b246288266e9390453dd1990da269bdc0110857931475e4afe48181b84dcfe7a606672b885f8702b1a439b1ddd77ed3aea2f0257d
SSDEEP 12288:M5VVYpJcj7ExeZboR2/O1zmfJEDaAkfur:MbVV7ExeCppmGDaAuu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vEgsgIsQ.bat

Path C:\Users\Admin\AppData\Local\Temp\vEgsgIsQ.bat
Size 112B
SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
MD5 bae1095f340720d965898063fede1273
SHA1 455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA512 4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
MD5 SHA1 SHA512

Submit Download

hEIoIMIU.exe

Path C:\Users\Admin\EiYAQYEc\hEIoIMIU.exe
Size 431KB
SHA256 1487f2b0d6fcf018c6701a755708ba410097a8db7f0dd0d4ab50917d7db58401
MD5 fa10f15d2c2b900ec50d54ba5ce88029
SHA1 7db6d67e474e791018cc08a2b755880271615d5e
SHA512 47b7389df2497d40453341d721c419babb1ff68112cce7630a732abc94519e16b5795f17bf9b654e49632b2ce786a88a0fd2b0cfaa85a3a94926de9ed447d4d9
SSDEEP 6144:+EdWBkiq7GfN3viXsByfLkse4/Sq032Rf+xP2JIFo3N94ciKeW42:z0kij5vMwUpe4/S3gfglKWKeo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-547-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/220-630-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/512-311-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/512-254-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/992-79-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/992-63-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1368-564-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1368-413-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1460-119-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1460-131-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1508-0-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1508-146-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1508-87-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1616-52-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1616-67-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1696-102-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1696-116-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1776-12-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1776-118-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2056-932-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2176-229-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2176-245-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2284-157-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2284-827-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2284-906-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2284-177-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2336-431-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2336-301-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2472-42-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2472-27-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2760-764-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2760-617-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2984-126-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2984-17-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3096-156-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3096-139-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3228-75-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3228-92-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3244-181-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3244-169-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3576-205-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3576-221-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3980-185-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3980-197-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4248-844-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4248-747-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4452-105-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4452-43-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4452-928-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4452-55-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4452-88-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4452-936-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4560-193-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4560-209-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4716-241-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4716-258-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4820-100-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/4820-6-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/4860-143-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4860-130-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/5040-218-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/5040-233-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/5040-21-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/5040-31-0x0000000000400000-0x000000000047A000-memory.dmp

Download