Overview
overview
10Static
static
1029d7ce5a27...53.exe
windows7-x64
729d7ce5a27...53.exe
windows10-1703-x64
729d7ce5a27...53.exe
windows10-2004-x64
729d7ce5a27...53.exe
windows11-21h2-x64
75826edef54...09.rar
windows7-x64
35826edef54...09.rar
windows10-1703-x64
35826edef54...09.rar
windows10-2004-x64
75826edef54...09.rar
windows11-21h2-x64
3AWB2024042...6A.vbs
windows7-x64
10AWB2024042...6A.vbs
windows10-1703-x64
8AWB2024042...6A.vbs
windows10-2004-x64
8AWB2024042...6A.vbs
windows11-21h2-x64
87cd4bfb3b0...0dc238
windows7-x64
17cd4bfb3b0...0dc238
windows10-1703-x64
17cd4bfb3b0...0dc238
windows10-2004-x64
17cd4bfb3b0...0dc238
windows11-21h2-x64
1bec046135e...be.exe
windows7-x64
7bec046135e...be.exe
windows10-1703-x64
7bec046135e...be.exe
windows10-2004-x64
7bec046135e...be.exe
windows11-21h2-x64
7bf71b1cf35...bc.exe
windows7-x64
10bf71b1cf35...bc.exe
windows10-1703-x64
10bf71b1cf35...bc.exe
windows10-2004-x64
10bf71b1cf35...bc.exe
windows11-21h2-x64
10e270915d93...fa.exe
windows7-x64
10e270915d93...fa.exe
windows10-1703-x64
10e270915d93...fa.exe
windows10-2004-x64
10e270915d93...fa.exe
windows11-21h2-x64
10Analysis
-
max time kernel
1800s -
max time network
1751s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-04-2024 14:40
Behavioral task
behavioral1
Sample
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
5826edef54998a8812124bbddc1942c9ff42992bdd1d5dd3395df71b7bb4c709.rar
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
5826edef54998a8812124bbddc1942c9ff42992bdd1d5dd3395df71b7bb4c709.rar
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
5826edef54998a8812124bbddc1942c9ff42992bdd1d5dd3395df71b7bb4c709.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
5826edef54998a8812124bbddc1942c9ff42992bdd1d5dd3395df71b7bb4c709.rar
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
AWB20240425-GW036A.vbs
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
AWB20240425-GW036A.vbs
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
AWB20240425-GW036A.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral12
Sample
AWB20240425-GW036A.vbs
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
7cd4bfb3b0e27989012024605cc453dbc8a226b413d84e2560ae4af70d0dc238
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
7cd4bfb3b0e27989012024605cc453dbc8a226b413d84e2560ae4af70d0dc238
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
7cd4bfb3b0e27989012024605cc453dbc8a226b413d84e2560ae4af70d0dc238
Resource
win10v2004-20240412-en
Behavioral task
behavioral16
Sample
7cd4bfb3b0e27989012024605cc453dbc8a226b413d84e2560ae4af70d0dc238
Resource
win11-20240412-en
Behavioral task
behavioral17
Sample
bec046135e9d128cf6021e387a8d8b7aab1f703b44564b53c54e422da2cf5bbe.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
bec046135e9d128cf6021e387a8d8b7aab1f703b44564b53c54e422da2cf5bbe.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
bec046135e9d128cf6021e387a8d8b7aab1f703b44564b53c54e422da2cf5bbe.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral20
Sample
bec046135e9d128cf6021e387a8d8b7aab1f703b44564b53c54e422da2cf5bbe.exe
Resource
win11-20240412-en
Behavioral task
behavioral21
Sample
bf71b1cf3516a2ad02efdda83c6f902e7139db69c1035a7e653ed09f5d27cbbc.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
bf71b1cf3516a2ad02efdda83c6f902e7139db69c1035a7e653ed09f5d27cbbc.exe
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
bf71b1cf3516a2ad02efdda83c6f902e7139db69c1035a7e653ed09f5d27cbbc.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
bf71b1cf3516a2ad02efdda83c6f902e7139db69c1035a7e653ed09f5d27cbbc.exe
Resource
win11-20240412-en
Behavioral task
behavioral25
Sample
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral28
Sample
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe
Resource
win11-20240412-en
General
-
Target
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe
-
Size
131KB
-
MD5
c055414e00cb301e35740f3591df4ea4
-
SHA1
e221f5b1ac929c2c04a1fb9e27c6e43d030a0fbb
-
SHA256
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa
-
SHA512
b7be9688a8d6ffa02b67948d4b5b2749396e26a2893ff736ea707c10ad15d8a0314b9d3dfcb1383e50e33c3d82f2e4f72afba2d6e1a3f4ec6e087ac02241ac12
-
SSDEEP
3072:1uxMFsg7SYqAnWAu95iwtLVymzq1MOggzR557/PTShlllllllYPA7Ra3Z:5lSYup9nLomzq1MOggzNPT7PKa3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (85) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
Processes:
JIkEQwQQ.exeLWIMogsY.exepid process 3068 JIkEQwQQ.exe 4172 LWIMogsY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeJIkEQwQQ.exeLWIMogsY.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LWIMogsY.exe = "C:\\ProgramData\\WsQYcsws\\LWIMogsY.exe" e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\JIkEQwQQ.exe = "C:\\Users\\Admin\\TcwcwEMA\\JIkEQwQQ.exe" JIkEQwQQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LWIMogsY.exe = "C:\\ProgramData\\WsQYcsws\\LWIMogsY.exe" LWIMogsY.exe Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\JIkEQwQQ.exe = "C:\\Users\\Admin\\TcwcwEMA\\JIkEQwQQ.exe" e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe -
Drops file in System32 directory 2 IoCs
Processes:
JIkEQwQQ.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe JIkEQwQQ.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe JIkEQwQQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
pid pid_target process target process 2264 3068 JIkEQwQQ.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1556 reg.exe 4700 reg.exe 3796 reg.exe 2092 reg.exe 3796 reg.exe 2012 reg.exe 5676 reg.exe 4220 reg.exe 3556 reg.exe 4724 reg.exe 2912 reg.exe 3924 reg.exe 1796 reg.exe 4092 reg.exe 5268 reg.exe 5732 reg.exe 5448 reg.exe 4896 reg.exe 5848 reg.exe 5016 reg.exe 324 reg.exe 2792 reg.exe 4960 reg.exe 5796 reg.exe 2472 reg.exe 4644 reg.exe 1100 reg.exe 1316 reg.exe 4340 reg.exe 2416 reg.exe 800 reg.exe 4984 reg.exe 2616 reg.exe 1816 reg.exe 1172 reg.exe 5784 reg.exe 5232 reg.exe 3440 reg.exe 3468 3780 reg.exe 1836 reg.exe 2152 reg.exe 5344 reg.exe 2248 reg.exe 4424 reg.exe 1196 3172 reg.exe 224 reg.exe 3428 reg.exe 2244 reg.exe 4712 reg.exe 5488 reg.exe 5072 reg.exe 5520 reg.exe 1812 reg.exe 4992 reg.exe 5476 reg.exe 2220 reg.exe 2904 reg.exe 648 reg.exe 5828 reg.exe 1880 reg.exe 5888 reg.exe 6012 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exepid process 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5652 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5652 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5652 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5652 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5544 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5544 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5544 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5544 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 4264 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 4264 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 4264 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 4264 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3400 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3400 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3400 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3400 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3348 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3348 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3348 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 3348 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2384 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2384 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2384 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2384 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2116 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2116 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2116 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2116 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 1960 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 1960 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 1960 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 1960 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5796 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5796 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5796 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5796 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5780 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5780 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5780 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5780 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5668 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5668 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5668 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 5668 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2480 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2480 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2480 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 2480 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 1820 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 1820 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 1820 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe 1820 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
JIkEQwQQ.exeLWIMogsY.exepid process 3068 JIkEQwQQ.exe 4172 LWIMogsY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
JIkEQwQQ.exepid process 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe 3068 JIkEQwQQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.execmd.execmd.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.execmd.execmd.exee270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.execmd.exedescription pid process target process PID 5404 wrote to memory of 3068 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe JIkEQwQQ.exe PID 5404 wrote to memory of 3068 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe JIkEQwQQ.exe PID 5404 wrote to memory of 3068 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe JIkEQwQQ.exe PID 5404 wrote to memory of 4172 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe LWIMogsY.exe PID 5404 wrote to memory of 4172 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe LWIMogsY.exe PID 5404 wrote to memory of 4172 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe LWIMogsY.exe PID 5404 wrote to memory of 5396 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 5404 wrote to memory of 5396 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 5404 wrote to memory of 5396 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 5404 wrote to memory of 2344 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 5404 wrote to memory of 2344 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 5404 wrote to memory of 2344 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 5404 wrote to memory of 1664 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 5404 wrote to memory of 1664 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 5404 wrote to memory of 1664 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 5404 wrote to memory of 1816 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 5404 wrote to memory of 1816 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 5404 wrote to memory of 1816 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 5404 wrote to memory of 2324 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 5404 wrote to memory of 2324 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 5404 wrote to memory of 2324 5404 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 5396 wrote to memory of 4712 5396 cmd.exe e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe PID 5396 wrote to memory of 4712 5396 cmd.exe e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe PID 5396 wrote to memory of 4712 5396 cmd.exe e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe PID 2324 wrote to memory of 2264 2324 cmd.exe cscript.exe PID 2324 wrote to memory of 2264 2324 cmd.exe cscript.exe PID 2324 wrote to memory of 2264 2324 cmd.exe cscript.exe PID 4712 wrote to memory of 1316 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 4712 wrote to memory of 1316 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 4712 wrote to memory of 1316 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 1316 wrote to memory of 3508 1316 cmd.exe e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe PID 1316 wrote to memory of 3508 1316 cmd.exe e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe PID 1316 wrote to memory of 3508 1316 cmd.exe e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe PID 4712 wrote to memory of 428 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 4712 wrote to memory of 428 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 4712 wrote to memory of 428 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 4712 wrote to memory of 3740 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 4712 wrote to memory of 3740 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 4712 wrote to memory of 3740 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 4712 wrote to memory of 5520 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 4712 wrote to memory of 5520 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 4712 wrote to memory of 5520 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 4712 wrote to memory of 2348 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 4712 wrote to memory of 2348 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 4712 wrote to memory of 2348 4712 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 2348 wrote to memory of 6076 2348 cmd.exe cscript.exe PID 2348 wrote to memory of 6076 2348 cmd.exe cscript.exe PID 2348 wrote to memory of 6076 2348 cmd.exe cscript.exe PID 3508 wrote to memory of 2004 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 3508 wrote to memory of 2004 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 3508 wrote to memory of 2004 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe PID 2004 wrote to memory of 5652 2004 cmd.exe e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe PID 2004 wrote to memory of 5652 2004 cmd.exe e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe PID 2004 wrote to memory of 5652 2004 cmd.exe e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe PID 3508 wrote to memory of 3732 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 3508 wrote to memory of 3732 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 3508 wrote to memory of 3732 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 3508 wrote to memory of 5508 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 3508 wrote to memory of 5508 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 3508 wrote to memory of 5508 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 3508 wrote to memory of 2380 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 3508 wrote to memory of 2380 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 3508 wrote to memory of 2380 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe reg.exe PID 3508 wrote to memory of 5488 3508 e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe"C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\TcwcwEMA\JIkEQwQQ.exe"C:\Users\Admin\TcwcwEMA\JIkEQwQQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\WsQYcsws\LWIMogsY.exe"C:\ProgramData\WsQYcsws\LWIMogsY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"8⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"10⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"12⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"14⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"16⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"18⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"20⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"22⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"24⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"26⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"28⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"30⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"32⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"34⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"36⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"38⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"40⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"42⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"44⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"46⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"48⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"50⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"52⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"54⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"56⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"58⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"60⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"62⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"64⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"66⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"68⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"70⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"72⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"74⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"76⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"78⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"80⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"82⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"84⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"86⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"88⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"90⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"92⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"94⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"96⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"98⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"100⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"102⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"104⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"106⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"108⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"110⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"112⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"114⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"116⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"118⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"120⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"122⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"124⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"126⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"128⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"130⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"132⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"134⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"136⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"138⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"140⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"142⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"144⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"146⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"148⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"150⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"152⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"154⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"156⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"158⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"160⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"162⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"164⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"166⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"168⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"170⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"172⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"174⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"176⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"178⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"180⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"182⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"184⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"186⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"188⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"190⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"192⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"194⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"196⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"198⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"200⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"202⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"204⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"206⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"208⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"210⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"212⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"214⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"216⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"218⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"220⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"222⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"224⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"226⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"228⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"230⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"232⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"234⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"236⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"238⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa"240⤵
-
C:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exeC:\Users\Admin\AppData\Local\Temp\e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa241⤵