Analysis
-
max time kernel
23s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 09:51
General
-
Target
loader.exe
-
Size
6.6MB
-
MD5
7ccb67211d3217bf81a5cba6646aa71e
-
SHA1
41ae6435dc0872ebffb2377175eac043c75aa47b
-
SHA256
4a6d7294cd902595eddc8888ef313abf4839b766e5aa3a7e1f7932396862ddc7
-
SHA512
91e1e343ef88167847f636cf90aa2aac9cd9c82520f4c4d3cffca072703f8067ec964f62b08a76a6f8350330a21ac8c7306b5cb603d0a8fef0353c47c1b5f43d
-
SSDEEP
98304:MQU/vazHb9LcFW5ifLq9yigKhlQUxqXR68lY2mzEn/HH3MW:MQqqiipQUxqXm2mzI/HXMW
Malware Config
Extracted
darkcomet
Guest16
23.27.245.112:443
DC_MUTEX-5SPHHX7
-
gencode
HqxpjeTgUiwn
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Sets file to hidden 1 TTPs 64 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 7208 attrib.exe 7532 attrib.exe 8984 attrib.exe 8396 attrib.exe 10588 attrib.exe 1368 attrib.exe 6644 attrib.exe 7512 attrib.exe 5576 attrib.exe 5400 attrib.exe 4656 attrib.exe 9304 attrib.exe 8288 attrib.exe 1988 attrib.exe 9208 attrib.exe 3916 attrib.exe 2712 attrib.exe 7784 attrib.exe 6236 attrib.exe 776 attrib.exe 7988 attrib.exe 9340 attrib.exe 2360 attrib.exe 5940 attrib.exe 5604 attrib.exe 9968 attrib.exe 10060 attrib.exe 4048 attrib.exe 5532 attrib.exe 6968 attrib.exe 7508 attrib.exe 3248 attrib.exe 7260 attrib.exe 3056 attrib.exe 8268 attrib.exe 5688 attrib.exe 9560 attrib.exe 5776 attrib.exe 5856 attrib.exe 8296 attrib.exe 6020 attrib.exe 7540 attrib.exe 8868 attrib.exe 9160 attrib.exe 5228 attrib.exe 7160 attrib.exe 5892 attrib.exe 7212 attrib.exe 2452 attrib.exe 4424 attrib.exe 7072 attrib.exe 8496 attrib.exe 9016 attrib.exe 10280 attrib.exe 7268 attrib.exe 7952 attrib.exe 7940 attrib.exe 4696 attrib.exe 9980 attrib.exe 10228 attrib.exe 4792 attrib.exe 8004 attrib.exe 8164 attrib.exe 8152 attrib.exe -
Checks computer location settings 2 TTPs 20 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXEloader.exeLOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation LOADER.EXE -
Executes dropped EXE 19 IoCs
Processes:
LOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXELOADER.EXEpid process 1656 LOADER.EXE 2224 LOADER.EXE 440 LOADER.EXE 4764 LOADER.EXE 396 LOADER.EXE 4384 LOADER.EXE 3852 LOADER.EXE 2120 LOADER.EXE 4588 LOADER.EXE 5428 LOADER.EXE 5800 LOADER.EXE 5132 LOADER.EXE 5744 LOADER.EXE 5924 LOADER.EXE 776 LOADER.EXE 5824 LOADER.EXE 1068 LOADER.EXE 5604 LOADER.EXE 5800 LOADER.EXE -
Obfuscated with Agile.Net obfuscator 61 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\BUNIFU.CORE.DLL agile_net C:\Users\Admin\AppData\Local\Temp\loader.exe agile_net behavioral1/memory/4860-62-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/1656-83-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/2224-85-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/440-99-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/4764-105-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/2536-121-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/396-127-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/4384-140-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/3852-164-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/2120-174-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/4588-182-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5428-187-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5800-197-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5132-215-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5744-219-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5924-236-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/776-237-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5824-256-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/1068-257-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5604-275-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5800-282-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5628-298-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/1500-308-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5140-315-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/3932-326-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/6436-336-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/6832-343-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5576-350-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/6448-369-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/6820-371-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/6216-385-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5464-390-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5392-406-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/1632-408-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5356-426-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/6316-431-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7004-450-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7212-451-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7464-467-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7912-471-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/3840-489-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7620-490-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7772-506-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/6412-510-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7280-525-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7476-526-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/6488-545-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/8160-553-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/3884-557-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/6896-572-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7484-583-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7844-590-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/8264-602-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/8616-608-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/8892-623-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/5240-627-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/7232-644-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/8928-648-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net behavioral1/memory/8568-667-0x0000000000400000-0x0000000000AA5000-memory.dmp agile_net -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
Processes:
LOADER.EXEOpenWith.exeOpenWith.exeOpenWith.exeLOADER.EXEOpenWith.exeLOADER.EXELOADER.EXELOADER.EXELOADER.EXEOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeLOADER.EXELOADER.EXEOpenWith.exeOpenWith.exeLOADER.EXELOADER.EXEOpenWith.exeLOADER.EXELOADER.EXEOpenWith.exeLOADER.EXEOpenWith.exeOpenWith.exeOpenWith.exeLOADER.EXELOADER.EXEOpenWith.exeOpenWith.exeLOADER.EXEloader.exeLOADER.EXEOpenWith.exeOpenWith.exeLOADER.EXEOpenWith.exeLOADER.EXEOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings loader.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LOADER.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
loader.exeLOADER.EXELOADER.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 2536 loader.exe Token: SeSecurityPrivilege 2536 loader.exe Token: SeTakeOwnershipPrivilege 2536 loader.exe Token: SeLoadDriverPrivilege 2536 loader.exe Token: SeSystemProfilePrivilege 2536 loader.exe Token: SeSystemtimePrivilege 2536 loader.exe Token: SeProfSingleProcessPrivilege 2536 loader.exe Token: SeIncBasePriorityPrivilege 2536 loader.exe Token: SeCreatePagefilePrivilege 2536 loader.exe Token: SeBackupPrivilege 2536 loader.exe Token: SeRestorePrivilege 2536 loader.exe Token: SeShutdownPrivilege 2536 loader.exe Token: SeDebugPrivilege 2536 loader.exe Token: SeSystemEnvironmentPrivilege 2536 loader.exe Token: SeChangeNotifyPrivilege 2536 loader.exe Token: SeRemoteShutdownPrivilege 2536 loader.exe Token: SeUndockPrivilege 2536 loader.exe Token: SeManageVolumePrivilege 2536 loader.exe Token: SeImpersonatePrivilege 2536 loader.exe Token: SeCreateGlobalPrivilege 2536 loader.exe Token: 33 2536 loader.exe Token: 34 2536 loader.exe Token: 35 2536 loader.exe Token: 36 2536 loader.exe Token: SeIncreaseQuotaPrivilege 4860 LOADER.EXE Token: SeSecurityPrivilege 4860 LOADER.EXE Token: SeTakeOwnershipPrivilege 4860 LOADER.EXE Token: SeLoadDriverPrivilege 4860 LOADER.EXE Token: SeSystemProfilePrivilege 4860 LOADER.EXE Token: SeSystemtimePrivilege 4860 LOADER.EXE Token: SeProfSingleProcessPrivilege 4860 LOADER.EXE Token: SeIncBasePriorityPrivilege 4860 LOADER.EXE Token: SeCreatePagefilePrivilege 4860 LOADER.EXE Token: SeBackupPrivilege 4860 LOADER.EXE Token: SeRestorePrivilege 4860 LOADER.EXE Token: SeShutdownPrivilege 4860 LOADER.EXE Token: SeDebugPrivilege 4860 LOADER.EXE Token: SeSystemEnvironmentPrivilege 4860 LOADER.EXE Token: SeChangeNotifyPrivilege 4860 LOADER.EXE Token: SeRemoteShutdownPrivilege 4860 LOADER.EXE Token: SeUndockPrivilege 4860 LOADER.EXE Token: SeManageVolumePrivilege 4860 LOADER.EXE Token: SeImpersonatePrivilege 4860 LOADER.EXE Token: SeCreateGlobalPrivilege 4860 LOADER.EXE Token: 33 4860 LOADER.EXE Token: 34 4860 LOADER.EXE Token: 35 4860 LOADER.EXE Token: 36 4860 LOADER.EXE Token: SeIncreaseQuotaPrivilege 1656 LOADER.EXE Token: SeSecurityPrivilege 1656 LOADER.EXE Token: SeTakeOwnershipPrivilege 1656 LOADER.EXE Token: SeLoadDriverPrivilege 1656 LOADER.EXE Token: SeSystemProfilePrivilege 1656 LOADER.EXE Token: SeSystemtimePrivilege 1656 LOADER.EXE Token: SeProfSingleProcessPrivilege 1656 LOADER.EXE Token: SeIncBasePriorityPrivilege 1656 LOADER.EXE Token: SeCreatePagefilePrivilege 1656 LOADER.EXE Token: SeBackupPrivilege 1656 LOADER.EXE Token: SeRestorePrivilege 1656 LOADER.EXE Token: SeShutdownPrivilege 1656 LOADER.EXE Token: SeDebugPrivilege 1656 LOADER.EXE Token: SeSystemEnvironmentPrivilege 1656 LOADER.EXE Token: SeChangeNotifyPrivilege 1656 LOADER.EXE Token: SeRemoteShutdownPrivilege 1656 LOADER.EXE -
Suspicious use of SetWindowsHookEx 43 IoCs
Processes:
OpenWith.exeOpenWith.exeloader.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exepid process 4792 OpenWith.exe 2740 OpenWith.exe 2536 loader.exe 1504 OpenWith.exe 1188 OpenWith.exe 4540 OpenWith.exe 3296 OpenWith.exe 1916 OpenWith.exe 2716 OpenWith.exe 3884 OpenWith.exe 1356 OpenWith.exe 3204 OpenWith.exe 768 OpenWith.exe 2680 OpenWith.exe 4424 OpenWith.exe 3660 OpenWith.exe 1516 OpenWith.exe 1608 OpenWith.exe 2612 OpenWith.exe 5136 OpenWith.exe 5464 OpenWith.exe 5392 OpenWith.exe 5748 OpenWith.exe 5832 OpenWith.exe 6092 OpenWith.exe 4656 OpenWith.exe 5560 OpenWith.exe 3884 OpenWith.exe 5736 OpenWith.exe 6000 OpenWith.exe 1064 OpenWith.exe 6000 OpenWith.exe 6000 OpenWith.exe 6000 OpenWith.exe 6000 OpenWith.exe 4576 OpenWith.exe 5816 OpenWith.exe 6092 OpenWith.exe 5148 OpenWith.exe 1456 OpenWith.exe 3424 OpenWith.exe 5552 OpenWith.exe 5768 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
loader.execmd.execmd.exeLOADER.EXEcmd.execmd.exeLOADER.EXEcmd.execmd.exeLOADER.EXEcmd.execmd.exedescription pid process target process PID 2536 wrote to memory of 4376 2536 loader.exe cmd.exe PID 2536 wrote to memory of 4376 2536 loader.exe cmd.exe PID 2536 wrote to memory of 4376 2536 loader.exe cmd.exe PID 2536 wrote to memory of 4060 2536 loader.exe cmd.exe PID 2536 wrote to memory of 4060 2536 loader.exe cmd.exe PID 2536 wrote to memory of 4060 2536 loader.exe cmd.exe PID 2536 wrote to memory of 4860 2536 loader.exe LOADER.EXE PID 2536 wrote to memory of 4860 2536 loader.exe LOADER.EXE PID 2536 wrote to memory of 4860 2536 loader.exe LOADER.EXE PID 4376 wrote to memory of 3916 4376 cmd.exe attrib.exe PID 4376 wrote to memory of 3916 4376 cmd.exe attrib.exe PID 4376 wrote to memory of 3916 4376 cmd.exe attrib.exe PID 4060 wrote to memory of 3864 4060 cmd.exe attrib.exe PID 4060 wrote to memory of 3864 4060 cmd.exe attrib.exe PID 4060 wrote to memory of 3864 4060 cmd.exe attrib.exe PID 4860 wrote to memory of 4428 4860 LOADER.EXE cmd.exe PID 4860 wrote to memory of 4428 4860 LOADER.EXE cmd.exe PID 4860 wrote to memory of 4428 4860 LOADER.EXE cmd.exe PID 4860 wrote to memory of 556 4860 LOADER.EXE cmd.exe PID 4860 wrote to memory of 556 4860 LOADER.EXE cmd.exe PID 4860 wrote to memory of 556 4860 LOADER.EXE cmd.exe PID 556 wrote to memory of 3424 556 cmd.exe OpenWith.exe PID 556 wrote to memory of 3424 556 cmd.exe OpenWith.exe PID 556 wrote to memory of 3424 556 cmd.exe OpenWith.exe PID 4428 wrote to memory of 4200 4428 cmd.exe attrib.exe PID 4428 wrote to memory of 4200 4428 cmd.exe attrib.exe PID 4428 wrote to memory of 4200 4428 cmd.exe attrib.exe PID 4860 wrote to memory of 1656 4860 LOADER.EXE Conhost.exe PID 4860 wrote to memory of 1656 4860 LOADER.EXE Conhost.exe PID 4860 wrote to memory of 1656 4860 LOADER.EXE Conhost.exe PID 2536 wrote to memory of 1304 2536 loader.exe iexplore.exe PID 2536 wrote to memory of 1304 2536 loader.exe iexplore.exe PID 2536 wrote to memory of 1304 2536 loader.exe iexplore.exe PID 2536 wrote to memory of 336 2536 loader.exe explorer.exe PID 2536 wrote to memory of 336 2536 loader.exe explorer.exe PID 1656 wrote to memory of 3380 1656 LOADER.EXE cmd.exe PID 1656 wrote to memory of 3380 1656 LOADER.EXE cmd.exe PID 1656 wrote to memory of 3380 1656 LOADER.EXE cmd.exe PID 1656 wrote to memory of 4420 1656 LOADER.EXE cmd.exe PID 1656 wrote to memory of 4420 1656 LOADER.EXE cmd.exe PID 1656 wrote to memory of 4420 1656 LOADER.EXE cmd.exe PID 3380 wrote to memory of 2824 3380 cmd.exe attrib.exe PID 3380 wrote to memory of 2824 3380 cmd.exe attrib.exe PID 3380 wrote to memory of 2824 3380 cmd.exe attrib.exe PID 4420 wrote to memory of 2432 4420 cmd.exe cmd.exe PID 4420 wrote to memory of 2432 4420 cmd.exe cmd.exe PID 4420 wrote to memory of 2432 4420 cmd.exe cmd.exe PID 1656 wrote to memory of 2224 1656 LOADER.EXE LOADER.EXE PID 1656 wrote to memory of 2224 1656 LOADER.EXE LOADER.EXE PID 1656 wrote to memory of 2224 1656 LOADER.EXE LOADER.EXE PID 2224 wrote to memory of 4364 2224 LOADER.EXE cmd.exe PID 2224 wrote to memory of 4364 2224 LOADER.EXE cmd.exe PID 2224 wrote to memory of 4364 2224 LOADER.EXE cmd.exe PID 2224 wrote to memory of 3624 2224 LOADER.EXE cmd.exe PID 2224 wrote to memory of 3624 2224 LOADER.EXE cmd.exe PID 2224 wrote to memory of 3624 2224 LOADER.EXE cmd.exe PID 4364 wrote to memory of 432 4364 cmd.exe Conhost.exe PID 4364 wrote to memory of 432 4364 cmd.exe Conhost.exe PID 4364 wrote to memory of 432 4364 cmd.exe Conhost.exe PID 2224 wrote to memory of 440 2224 LOADER.EXE LOADER.EXE PID 2224 wrote to memory of 440 2224 LOADER.EXE LOADER.EXE PID 2224 wrote to memory of 440 2224 LOADER.EXE LOADER.EXE PID 3624 wrote to memory of 3304 3624 cmd.exe attrib.exe PID 3624 wrote to memory of 3304 3624 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 64 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 3248 attrib.exe 5400 attrib.exe 10264 attrib.exe 7268 attrib.exe 7328 attrib.exe 8920 attrib.exe 8220 attrib.exe 2872 attrib.exe 396 attrib.exe 2716 attrib.exe 5332 attrib.exe 8164 attrib.exe 7952 attrib.exe 7508 attrib.exe 5796 attrib.exe 5228 attrib.exe 6800 attrib.exe 7640 attrib.exe 4448 attrib.exe 3900 attrib.exe 10228 attrib.exe 6060 attrib.exe 5736 attrib.exe 5776 attrib.exe 7520 attrib.exe 7776 attrib.exe 6036 attrib.exe 8332 attrib.exe 7244 attrib.exe 432 attrib.exe 3304 attrib.exe 3688 attrib.exe 6236 attrib.exe 776 attrib.exe 1916 attrib.exe 9504 attrib.exe 5576 attrib.exe 6400 attrib.exe 7668 attrib.exe 7776 attrib.exe 9212 attrib.exe 8296 attrib.exe 8936 attrib.exe 10280 attrib.exe 5400 attrib.exe 6388 attrib.exe 7696 attrib.exe 8496 attrib.exe 9560 attrib.exe 4696 attrib.exe 10564 attrib.exe 3364 attrib.exe 3616 attrib.exe 4708 attrib.exe 9160 attrib.exe 8004 attrib.exe 6644 attrib.exe 6412 attrib.exe 3916 attrib.exe 2204 attrib.exe 5352 attrib.exe 4072 attrib.exe 2712 attrib.exe 9960 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\loader.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\loader.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h5⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h6⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h6⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h6⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h7⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h7⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h7⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h8⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h8⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h9⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h8⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h9⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h9⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h10⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h9⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h10⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h10⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h10⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h11⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h11⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h11⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h12⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h12⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h12⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h13⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h13⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h14⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h13⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h14⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h14⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h15⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h14⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h15⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h16⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h15⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h16⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h16⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h17⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h16⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h17⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h17⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h18⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h17⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h18⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h19⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h18⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h19⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h19⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h20⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h19⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h20⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h20⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h21⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h20⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h21⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h21⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h22⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h21⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h22⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h22⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h23⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h23⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"22⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h23⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h24⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h23⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h24⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"23⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h24⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h25⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h24⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h25⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"24⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h25⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h26⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h25⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV126⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h26⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"25⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h26⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h27⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h26⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h27⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"26⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h27⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h28⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h27⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h28⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"27⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h28⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h29⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h28⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h29⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"28⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h29⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h30⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h29⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV130⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h30⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"29⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h30⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h31⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h30⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h31⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"30⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h31⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h32⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h31⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h32⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"31⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h32⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h33⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h32⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h33⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"32⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h33⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h34⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h33⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h34⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"33⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h34⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h35⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h34⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h35⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"34⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h35⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h36⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h35⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h36⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"35⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h36⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h37⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h36⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h37⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"36⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h37⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h38⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h37⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h38⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"37⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h38⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h39⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h38⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h39⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"38⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h39⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h40⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h39⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h40⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"39⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h40⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h41⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h40⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h41⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"40⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h41⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h42⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h41⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h42⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"41⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h42⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h43⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h42⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h43⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"42⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h43⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h44⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h43⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h44⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"43⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h44⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h45⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h44⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h45⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"44⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h45⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h46⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h45⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h46⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"45⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h46⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h47⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h46⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h47⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"46⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h47⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h48⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h47⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h48⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"47⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h48⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h49⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h48⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h49⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"48⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h49⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h50⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h49⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h50⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"49⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h50⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h51⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h50⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h51⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"50⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h51⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h52⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h51⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h52⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"51⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h52⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h53⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h52⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h53⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"52⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h53⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h54⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h53⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h54⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"53⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h54⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h55⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h54⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h55⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"54⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h55⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h56⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h55⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h56⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"55⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h56⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h57⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h56⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h57⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"56⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h57⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h58⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h57⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h58⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"57⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h58⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h59⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h58⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h59⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"58⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h59⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h60⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h59⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h60⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"59⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h60⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h61⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h60⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h61⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"60⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h61⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h62⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h61⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h62⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"61⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h62⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h63⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h62⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h63⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"62⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h63⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h64⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h63⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h64⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"63⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h64⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h65⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h64⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h65⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"64⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h65⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h66⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h65⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h66⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"65⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h66⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h67⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h66⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h67⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"66⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h67⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h68⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h67⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h68⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"67⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h68⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h69⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h68⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h69⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"68⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h69⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h70⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h69⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h70⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"69⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h70⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h71⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h70⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h71⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"70⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h71⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h72⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h71⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h72⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"71⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h72⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h73⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h72⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h73⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"72⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h73⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h74⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h73⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h74⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"73⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h74⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h75⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h74⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h75⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"74⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h75⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h76⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h75⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h76⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"75⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h76⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h77⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h76⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h77⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"76⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h77⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h78⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h77⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h78⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"77⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h78⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h79⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h78⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h79⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"78⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h79⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h80⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h79⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h80⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"79⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h80⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h81⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h80⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h81⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"80⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h81⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h82⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h81⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h82⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"81⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h82⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h83⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h82⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h83⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"82⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h83⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h84⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h83⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h84⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"83⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h84⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h85⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h84⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h85⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"84⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h85⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h86⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h85⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h86⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"85⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h86⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h87⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h86⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h87⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"86⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h87⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h88⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h87⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h88⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"87⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h88⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h89⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h88⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h89⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"88⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h89⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h90⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h89⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h90⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"89⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h90⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h91⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h90⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h91⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"90⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h91⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h92⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h91⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h92⤵
- Sets file to hidden
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"91⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h92⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h93⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h92⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h93⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"92⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h93⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h94⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h93⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV194⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h94⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"93⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h94⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h95⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h94⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h95⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"94⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h95⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h96⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h95⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h96⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"95⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h96⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h97⤵
- Sets file to hidden
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h96⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h97⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"96⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h97⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\LOADER.EXE" +s +h98⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h97⤵
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"97⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\System32\ThumbnailExtractionHost.exeC:\Windows\System32\ThumbnailExtractionHost.exe -Embedding1⤵
-
C:\Windows\System32\ThumbnailExtractionHost.exeC:\Windows\System32\ThumbnailExtractionHost.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\System32\ThumbnailExtractionHost.exeC:\Windows\System32\ThumbnailExtractionHost.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BUNIFU.CORE.DLLFilesize
2.5MB
MD5d9f830dffedbb2bc371fa60784c01221
SHA1d6a778249e05ee04c2e5e386c31f88598338ab84
SHA2565f72650f6d3a4a9b77bcdd74159282fcf724bd34afb989df6b6e075ea1dd6bc3
SHA512e8e7c712638e0aace109e0587cc4421697e1c6cacb64ff5d56efbe570615d72e72b5dd3afadd468e59116b1ed1326b25c459d5f2110b9d643bfca750825efd61
-
C:\Users\Admin\AppData\Local\Temp\BUNIFU_UI_V1.5.3.DLLFilesize
323KB
MD5e0ef2817ee5a7c8cd1eb837195768bd2
SHA1426ea1e201c7d3dc3fadce976536edce4cd51bce
SHA25676e1d3ec95fdef74abaf90392dd6f4aa5e344922abf11e572707287d467f2930
SHA5125ad95dd7f0e712d543acfe7fd4539695f7e894988c0a2c44231c43e5ee29e743cb1ffe6bdf1fbdbdcfd3aa374f036113bcc6a1befd0114954093520bac47234c
-
C:\Users\Admin\AppData\Local\Temp\DISCORDRPC.DLLFilesize
84KB
MD5696eb4e3427fb28b1b19465ee9609037
SHA1d35b5c6d4bf4dd15efe73bf5684642170ba64e88
SHA256db2e9346343257ba243adf620630f223dda14117cef4159228660395065e17a5
SHA512a8ee6a772e56642a6f0710c02abf20db024cd9c0c380f776cc1eeb8c16cb685814c2b4a58a8dfc29211b26c54666c415285ac2944ceb9f584964b7d3758cec78
-
C:\Users\Admin\AppData\Local\Temp\LOADER.EXE.CONFIGFilesize
1KB
MD5c0911d7b16e774d79b85d170e367dfee
SHA136761b772e82f4f7cef9f92c8290e7bb5ae05695
SHA2560f5b7f517b6f7858b412996be3777073e46059c40d5334ce9e3b5e5c2c62dbe0
SHA512e1078d5688969ee4b54e00994e6f84a1ed1153ea2749028000ed0403c3303fb00f7291e220991a61b44673fab1189e088008345c458fdca0e0b4c642b19d6007
-
C:\Users\Admin\AppData\Local\Temp\LOADER.PDBFilesize
125KB
MD5a3a7e44468e399351cbb03ddfb49cbcd
SHA12939d8ec534b5d3f4af9d04bbbea44e5e981661a
SHA256449aed2cf09d677eb8d1b72a15cc8059d633e83b2bf3d11ea7ff7e3d79b08eb2
SHA5123a86d2362a452284eab1e3e670dbd37fa6a17b38d8554234d90aec38fbabf483ae9872d062535ae37333dd12bdfabec824bc0bd7d69eaa5ed6968633fe378c73
-
C:\Users\Admin\AppData\Local\Temp\SITICONE.UI.DLLFilesize
1.3MB
MD5750c58af2e56b6addecffcf152520ab8
SHA114995e7f1d12498606d9d209d78d55fe6fd87802
SHA25627c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26
SHA5122179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5
-
C:\Users\Admin\AppData\Local\Temp\loader.exeFilesize
6.6MB
MD57ccb67211d3217bf81a5cba6646aa71e
SHA141ae6435dc0872ebffb2377175eac043c75aa47b
SHA2564a6d7294cd902595eddc8888ef313abf4839b766e5aa3a7e1f7932396862ddc7
SHA51291e1e343ef88167847f636cf90aa2aac9cd9c82520f4c4d3cffca072703f8067ec964f62b08a76a6f8350330a21ac8c7306b5cb603d0a8fef0353c47c1b5f43d
-
memory/396-127-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/396-84-0x0000000000D70000-0x0000000000D71000-memory.dmpFilesize
4KB
-
memory/440-99-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/440-45-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/776-237-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/776-214-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/1068-235-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/1068-257-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/1500-274-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/1500-308-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/1632-408-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/1632-386-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/1656-20-0x0000000002D00000-0x0000000002D01000-memory.dmpFilesize
4KB
-
memory/1656-83-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/2120-139-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/2120-174-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/2224-85-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/2224-31-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB
-
memory/2536-0-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/2536-121-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/2892-695-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/3840-456-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/3840-489-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/3852-164-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/3852-122-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/3884-535-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/3884-557-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/3932-326-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/3932-294-0x0000000002680000-0x0000000002681000-memory.dmpFilesize
4KB
-
memory/4384-140-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/4384-104-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/4588-182-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/4588-154-0x0000000000DD0000-0x0000000000DD1000-memory.dmpFilesize
4KB
-
memory/4764-105-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/4764-61-0x00000000029B0000-0x00000000029B1000-memory.dmpFilesize
4KB
-
memory/4860-62-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/4860-6-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/5132-185-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/5132-215-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5140-315-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5140-285-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/5240-606-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/5240-627-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5300-654-0x0000000002D00000-0x0000000002D01000-memory.dmpFilesize
4KB
-
memory/5304-735-0x0000000002730000-0x0000000002731000-memory.dmpFilesize
4KB
-
memory/5356-395-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/5356-426-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5392-406-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5428-163-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/5428-187-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5464-366-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/5464-390-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5576-325-0x0000000002680000-0x0000000002681000-memory.dmpFilesize
4KB
-
memory/5576-350-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5604-245-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/5604-275-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5628-298-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5628-265-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/5672-666-0x0000000000DD0000-0x0000000000DD1000-memory.dmpFilesize
4KB
-
memory/5744-195-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/5744-219-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5800-197-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5800-255-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/5800-173-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/5800-282-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5824-225-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/5824-256-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/5924-203-0x0000000002700000-0x0000000002701000-memory.dmpFilesize
4KB
-
memory/5924-236-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/6216-356-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/6216-385-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/6316-431-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/6316-405-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/6412-510-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/6436-336-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/6436-304-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/6448-369-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/6448-335-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/6488-545-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/6820-371-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/6820-347-0x0000000002780000-0x0000000002781000-memory.dmpFilesize
4KB
-
memory/6832-343-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/6832-314-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/6896-544-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/6896-572-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7004-450-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7004-415-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/7064-647-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/7212-451-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7212-424-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/7232-615-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/7232-644-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7280-525-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7280-495-0x0000000002700000-0x0000000002701000-memory.dmpFilesize
4KB
-
memory/7464-434-0x0000000002D00000-0x0000000002D01000-memory.dmpFilesize
4KB
-
memory/7464-467-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7476-526-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7476-505-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/7484-556-0x00000000027A0000-0x00000000027A1000-memory.dmpFilesize
4KB
-
memory/7484-583-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7620-490-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7620-465-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/7772-476-0x0000000002640000-0x0000000002641000-memory.dmpFilesize
4KB
-
memory/7772-506-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7844-590-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7844-566-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/7912-471-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/7912-445-0x0000000002650000-0x0000000002651000-memory.dmpFilesize
4KB
-
memory/8160-553-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/8160-524-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/8264-602-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/8264-575-0x0000000002D00000-0x0000000002D01000-memory.dmpFilesize
4KB
-
memory/8568-636-0x00000000029A0000-0x00000000029A1000-memory.dmpFilesize
4KB
-
memory/8568-667-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/8616-608-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/8616-586-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/8892-623-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/8892-595-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB
-
memory/8896-725-0x0000000002640000-0x0000000002641000-memory.dmpFilesize
4KB
-
memory/8928-626-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/8928-648-0x0000000000400000-0x0000000000AA5000-memory.dmpFilesize
6.6MB
-
memory/8948-686-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/9200-706-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB