Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:40
Static task
static1
Behavioral task
behavioral1
Sample
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe
Resource
win10v2004-20240426-en
General
-
Target
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe
-
Size
183KB
-
MD5
c6c73ec11db876aa3c2b826196bc9524
-
SHA1
c5b616f173d5d3ff793714a805ff7a8270f7e2eb
-
SHA256
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a
-
SHA512
1e8894bfb62be706252612fda888461d96eb44613a6a39240e8a6dd3f36bd0a651bb139842223406f34847f2d68206e4f2076e892bc8180127753cd9325866b5
-
SSDEEP
3072:agxh1ZbwOFXe6i++++m0QH6HpLLKxZTql+OTx+VRSf6+mzNzVullbGiE:aUu6KQHm4T9hVwhWhuHai
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (54) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MWMQkoMQ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation MWMQkoMQ.exe -
Executes dropped EXE 2 IoCs
Processes:
MWMQkoMQ.exeVCQMkIMY.exepid process 2176 MWMQkoMQ.exe 2576 VCQMkIMY.exe -
Loads dropped DLL 20 IoCs
Processes:
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeMWMQkoMQ.exepid process 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
VCQMkIMY.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeMWMQkoMQ.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VCQMkIMY.exe = "C:\\ProgramData\\qEgYUwYw\\VCQMkIMY.exe" VCQMkIMY.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MWMQkoMQ.exe = "C:\\Users\\Admin\\oQMMkIwc\\MWMQkoMQ.exe" 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VCQMkIMY.exe = "C:\\ProgramData\\qEgYUwYw\\VCQMkIMY.exe" 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MWMQkoMQ.exe = "C:\\Users\\Admin\\oQMMkIwc\\MWMQkoMQ.exe" MWMQkoMQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2272 reg.exe 1212 reg.exe 1724 reg.exe 1720 reg.exe 2816 reg.exe 744 reg.exe 2208 reg.exe 2016 reg.exe 2684 reg.exe 2200 reg.exe 2704 reg.exe 2856 reg.exe 344 reg.exe 2812 reg.exe 2220 reg.exe 1468 reg.exe 1524 reg.exe 2684 reg.exe 2912 reg.exe 2644 reg.exe 2920 reg.exe 1948 reg.exe 2752 reg.exe 464 reg.exe 340 reg.exe 2360 reg.exe 2616 reg.exe 1912 reg.exe 2372 reg.exe 792 reg.exe 316 reg.exe 2980 reg.exe 848 reg.exe 1708 reg.exe 2044 reg.exe 2748 reg.exe 1608 reg.exe 2164 reg.exe 2016 reg.exe 1240 reg.exe 1556 reg.exe 1636 reg.exe 288 reg.exe 2964 reg.exe 1964 reg.exe 2472 reg.exe 816 reg.exe 1212 reg.exe 2584 reg.exe 1620 reg.exe 2396 reg.exe 2808 reg.exe 2500 reg.exe 2812 reg.exe 2028 reg.exe 1372 reg.exe 2920 reg.exe 2132 reg.exe 632 reg.exe 2676 reg.exe 1592 reg.exe 684 reg.exe 2912 reg.exe 1376 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exepid process 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2764 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2764 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2820 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2820 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2856 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2856 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2448 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2448 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1752 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1752 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2656 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2656 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2724 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2724 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2904 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2904 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1028 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1028 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1736 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1736 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2732 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2732 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 556 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 556 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2220 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2220 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 580 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 580 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1796 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1796 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2616 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2616 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2024 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2024 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2980 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2980 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1728 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1728 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2464 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2464 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 348 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 348 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2008 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2008 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1128 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1128 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1604 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1604 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 948 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 948 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2844 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2844 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MWMQkoMQ.exepid process 2176 MWMQkoMQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
MWMQkoMQ.exepid process 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe 2176 MWMQkoMQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.execmd.execmd.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.execmd.execmd.exedescription pid process target process PID 2212 wrote to memory of 2176 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe MWMQkoMQ.exe PID 2212 wrote to memory of 2176 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe MWMQkoMQ.exe PID 2212 wrote to memory of 2176 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe MWMQkoMQ.exe PID 2212 wrote to memory of 2176 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe MWMQkoMQ.exe PID 2212 wrote to memory of 2576 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe VCQMkIMY.exe PID 2212 wrote to memory of 2576 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe VCQMkIMY.exe PID 2212 wrote to memory of 2576 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe VCQMkIMY.exe PID 2212 wrote to memory of 2576 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe VCQMkIMY.exe PID 2212 wrote to memory of 2648 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2212 wrote to memory of 2648 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2212 wrote to memory of 2648 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2212 wrote to memory of 2648 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2648 wrote to memory of 2692 2648 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 2648 wrote to memory of 2692 2648 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 2648 wrote to memory of 2692 2648 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 2648 wrote to memory of 2692 2648 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 2212 wrote to memory of 2896 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2896 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2896 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2896 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2644 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2644 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2644 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2644 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2884 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2884 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2884 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2884 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2212 wrote to memory of 2528 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2212 wrote to memory of 2528 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2212 wrote to memory of 2528 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2212 wrote to memory of 2528 2212 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2528 wrote to memory of 2720 2528 cmd.exe cscript.exe PID 2528 wrote to memory of 2720 2528 cmd.exe cscript.exe PID 2528 wrote to memory of 2720 2528 cmd.exe cscript.exe PID 2528 wrote to memory of 2720 2528 cmd.exe cscript.exe PID 2692 wrote to memory of 1944 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2692 wrote to memory of 1944 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2692 wrote to memory of 1944 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2692 wrote to memory of 1944 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 1944 wrote to memory of 2764 1944 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 1944 wrote to memory of 2764 1944 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 1944 wrote to memory of 2764 1944 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 1944 wrote to memory of 2764 1944 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 2692 wrote to memory of 2940 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2940 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2940 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2940 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2980 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2980 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2980 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2980 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2984 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2984 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2984 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2984 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 2692 wrote to memory of 2256 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2692 wrote to memory of 2256 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2692 wrote to memory of 2256 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2692 wrote to memory of 2256 2692 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2256 wrote to memory of 1628 2256 cmd.exe cscript.exe PID 2256 wrote to memory of 1628 2256 cmd.exe cscript.exe PID 2256 wrote to memory of 1628 2256 cmd.exe cscript.exe PID 2256 wrote to memory of 1628 2256 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe"C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\oQMMkIwc\MWMQkoMQ.exe"C:\Users\Admin\oQMMkIwc\MWMQkoMQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\qEgYUwYw\VCQMkIMY.exe"C:\ProgramData\qEgYUwYw\VCQMkIMY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"6⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"8⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"10⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"12⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"14⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"16⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"18⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"20⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"22⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"24⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"26⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"28⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"30⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"32⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"34⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"36⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"38⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"40⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"42⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"44⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"46⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"48⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"50⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"52⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"54⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"56⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"58⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"60⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"62⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"64⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"66⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"68⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"70⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"72⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"74⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"76⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"78⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"80⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"82⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"84⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"86⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"88⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"90⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"92⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"94⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"96⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"98⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"100⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"102⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"104⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"106⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"108⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"110⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"112⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"114⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"116⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"118⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"120⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"122⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"124⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"126⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"128⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"130⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"132⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"134⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"136⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"138⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"140⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"142⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"144⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"146⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"148⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"150⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"152⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"154⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"156⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"158⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"160⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"162⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"164⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"166⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"168⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"170⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"172⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"174⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"176⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"178⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"180⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"182⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"184⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"186⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"188⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"190⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"192⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"194⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"196⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"198⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"200⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"202⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"204⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"206⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"208⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"210⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"212⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"214⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"216⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"218⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"220⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"222⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"224⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"226⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"228⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"230⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"232⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"234⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"236⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"238⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"240⤵
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a241⤵