Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:40
Static task
static1
Behavioral task
behavioral1
Sample
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe
Resource
win10v2004-20240426-en
General
-
Target
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe
-
Size
183KB
-
MD5
c6c73ec11db876aa3c2b826196bc9524
-
SHA1
c5b616f173d5d3ff793714a805ff7a8270f7e2eb
-
SHA256
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a
-
SHA512
1e8894bfb62be706252612fda888461d96eb44613a6a39240e8a6dd3f36bd0a651bb139842223406f34847f2d68206e4f2076e892bc8180127753cd9325866b5
-
SSDEEP
3072:agxh1ZbwOFXe6i++++m0QH6HpLLKxZTql+OTx+VRSf6+mzNzVullbGiE:aUu6KQHm4T9hVwhWhuHai
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
EQoEQggg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation EQoEQggg.exe -
Executes dropped EXE 2 IoCs
Processes:
EQoEQggg.exeRYkAsQQM.exepid process 3940 EQoEQggg.exe 720 RYkAsQQM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeEQoEQggg.exeRYkAsQQM.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EQoEQggg.exe = "C:\\Users\\Admin\\IgcQgMYI\\EQoEQggg.exe" 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RYkAsQQM.exe = "C:\\ProgramData\\bQMwkYAU\\RYkAsQQM.exe" 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EQoEQggg.exe = "C:\\Users\\Admin\\IgcQgMYI\\EQoEQggg.exe" EQoEQggg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RYkAsQQM.exe = "C:\\ProgramData\\bQMwkYAU\\RYkAsQQM.exe" RYkAsQQM.exe -
Drops file in System32 directory 2 IoCs
Processes:
EQoEQggg.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe EQoEQggg.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe EQoEQggg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2972 reg.exe 4276 reg.exe 4940 reg.exe 4988 reg.exe 2368 1012 reg.exe 644 reg.exe 4472 reg.exe 3576 4960 1352 reg.exe 3488 reg.exe 3220 reg.exe 3620 reg.exe 1192 reg.exe 4588 reg.exe 4940 reg.exe 2728 reg.exe 3840 reg.exe 2368 reg.exe 1808 1948 2144 4940 reg.exe 616 reg.exe 2936 reg.exe 2340 reg.exe 2216 reg.exe 832 4272 reg.exe 1940 reg.exe 2212 reg.exe 3264 4988 4592 reg.exe 2344 reg.exe 4340 reg.exe 1808 reg.exe 4704 reg.exe 3196 reg.exe 984 reg.exe 4836 reg.exe 1264 reg.exe 2280 reg.exe 5028 reg.exe 680 reg.exe 4976 1188 2932 reg.exe 4996 reg.exe 364 2520 reg.exe 1124 reg.exe 2812 reg.exe 4616 reg.exe 4980 reg.exe 5100 reg.exe 1872 reg.exe 3408 reg.exe 2260 reg.exe 3152 reg.exe 432 reg.exe 4508 3580 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exepid process 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4880 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1928 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1928 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1928 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1928 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3896 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3896 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3896 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3896 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1552 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1552 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1552 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1552 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2520 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2520 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2520 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2520 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4344 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4344 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4344 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4344 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1640 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1640 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1640 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 1640 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 2016 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4424 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4424 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4424 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 4424 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 3988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5068 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5068 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5068 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5068 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5100 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5100 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5100 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe 5100 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
EQoEQggg.exepid process 3940 EQoEQggg.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
EQoEQggg.exepid process 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe 3940 EQoEQggg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.execmd.execmd.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.execmd.execmd.exe806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.execmd.exedescription pid process target process PID 3112 wrote to memory of 3940 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe EQoEQggg.exe PID 3112 wrote to memory of 3940 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe EQoEQggg.exe PID 3112 wrote to memory of 3940 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe EQoEQggg.exe PID 3112 wrote to memory of 720 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe RYkAsQQM.exe PID 3112 wrote to memory of 720 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe RYkAsQQM.exe PID 3112 wrote to memory of 720 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe RYkAsQQM.exe PID 3112 wrote to memory of 2820 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 3112 wrote to memory of 2820 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 3112 wrote to memory of 2820 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2820 wrote to memory of 4624 2820 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 2820 wrote to memory of 4624 2820 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 2820 wrote to memory of 4624 2820 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 3112 wrote to memory of 4340 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 3112 wrote to memory of 4340 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 3112 wrote to memory of 4340 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 3112 wrote to memory of 1124 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 3112 wrote to memory of 1124 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 3112 wrote to memory of 1124 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 3112 wrote to memory of 792 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 3112 wrote to memory of 792 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 3112 wrote to memory of 792 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 3112 wrote to memory of 3668 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 3112 wrote to memory of 3668 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 3112 wrote to memory of 3668 3112 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 3668 wrote to memory of 4356 3668 cmd.exe cscript.exe PID 3668 wrote to memory of 4356 3668 cmd.exe cscript.exe PID 3668 wrote to memory of 4356 3668 cmd.exe cscript.exe PID 4624 wrote to memory of 4984 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 4624 wrote to memory of 4984 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 4624 wrote to memory of 4984 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 4984 wrote to memory of 4988 4984 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 4984 wrote to memory of 4988 4984 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 4984 wrote to memory of 4988 4984 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 4624 wrote to memory of 3268 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4624 wrote to memory of 3268 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4624 wrote to memory of 3268 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4624 wrote to memory of 1940 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4624 wrote to memory of 1940 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4624 wrote to memory of 1940 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4624 wrote to memory of 3028 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4624 wrote to memory of 3028 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4624 wrote to memory of 3028 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4624 wrote to memory of 2296 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 4624 wrote to memory of 2296 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 4624 wrote to memory of 2296 4624 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 2296 wrote to memory of 2148 2296 cmd.exe cscript.exe PID 2296 wrote to memory of 2148 2296 cmd.exe cscript.exe PID 2296 wrote to memory of 2148 2296 cmd.exe cscript.exe PID 4988 wrote to memory of 224 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 4988 wrote to memory of 224 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 4988 wrote to memory of 224 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe PID 224 wrote to memory of 4880 224 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 224 wrote to memory of 4880 224 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 224 wrote to memory of 4880 224 cmd.exe 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe PID 4988 wrote to memory of 820 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4988 wrote to memory of 820 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4988 wrote to memory of 820 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4988 wrote to memory of 1352 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4988 wrote to memory of 1352 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4988 wrote to memory of 1352 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4988 wrote to memory of 932 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4988 wrote to memory of 932 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4988 wrote to memory of 932 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe reg.exe PID 4988 wrote to memory of 4100 4988 806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe"C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\IgcQgMYI\EQoEQggg.exe"C:\Users\Admin\IgcQgMYI\EQoEQggg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3940 -
C:\ProgramData\bQMwkYAU\RYkAsQQM.exe"C:\ProgramData\bQMwkYAU\RYkAsQQM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"2⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"4⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"6⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"8⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"10⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a11⤵
- Suspicious behavior: EnumeratesProcesses
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"12⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"14⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"16⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a17⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"18⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"20⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"22⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"24⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"26⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"28⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a29⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"30⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a31⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"32⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a33⤵PID:2880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"34⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a35⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"36⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a37⤵PID:3288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"38⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a39⤵PID:3488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"40⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a41⤵PID:5080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"42⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a43⤵PID:3840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"44⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a45⤵PID:4156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"46⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a47⤵PID:224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"48⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a49⤵PID:4332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"50⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a51⤵PID:2768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"52⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a53⤵PID:2408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"54⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a55⤵PID:4792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"56⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a57⤵PID:4540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"58⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a59⤵PID:3436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"60⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a61⤵PID:1536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"62⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a63⤵PID:868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"64⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a65⤵PID:4360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"66⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a67⤵PID:4048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"68⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a69⤵PID:1132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"70⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a71⤵PID:2528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"72⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a73⤵PID:3620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"74⤵PID:2184
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a75⤵PID:3152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"76⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a77⤵PID:2932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"78⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a79⤵PID:4940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"80⤵PID:3252
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a81⤵PID:2700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"82⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a83⤵PID:2072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"84⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a85⤵PID:4368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"86⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a87⤵PID:3600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"88⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a89⤵PID:3068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"90⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a91⤵PID:3836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"92⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a93⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"94⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a95⤵PID:1228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"96⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a97⤵PID:2576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"98⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a99⤵PID:4316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"100⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a101⤵PID:1128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"102⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a103⤵PID:2952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"104⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a105⤵PID:2960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"106⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a107⤵PID:1064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"108⤵PID:2696
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a109⤵PID:2520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"110⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a111⤵PID:224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"112⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a113⤵PID:3660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"114⤵PID:4372
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a115⤵PID:2496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"116⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a117⤵PID:548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"118⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a119⤵PID:4996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"120⤵PID:4720
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a121⤵PID:3660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"122⤵PID:1020
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a123⤵PID:4748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"124⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a125⤵PID:4740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"126⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a127⤵PID:4332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"128⤵PID:4236
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a129⤵PID:2196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"130⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a131⤵PID:3600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"132⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a133⤵PID:3112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"134⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a135⤵PID:4336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"136⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a137⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"138⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a139⤵PID:5028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"140⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a141⤵PID:668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"142⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a143⤵PID:2972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"144⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a145⤵PID:4552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"146⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a147⤵PID:1824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"148⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a149⤵PID:4792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"150⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a151⤵PID:3896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"152⤵PID:616
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a153⤵PID:5056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"154⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a155⤵PID:3384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"156⤵PID:2340
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a157⤵PID:400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"158⤵PID:3840
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a159⤵PID:1640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"160⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a161⤵PID:408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"162⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a163⤵PID:4156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"164⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a165⤵PID:4740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"166⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a167⤵PID:4884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"168⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a169⤵PID:4324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"170⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a171⤵PID:4836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"172⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a173⤵PID:3496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"174⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a175⤵PID:5028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"176⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a177⤵PID:4236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"178⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a179⤵PID:3896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"180⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a181⤵PID:2976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"182⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a183⤵PID:4820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"184⤵PID:4340
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a185⤵PID:4388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"186⤵PID:4520
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a187⤵PID:3896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"188⤵PID:3196
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a189⤵PID:820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"190⤵PID:1540
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a191⤵PID:4760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"192⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a193⤵PID:4464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"194⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a195⤵PID:3384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"196⤵PID:2388
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a197⤵PID:804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"198⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a199⤵PID:2308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"200⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a201⤵PID:3116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"202⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a203⤵PID:3112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"204⤵PID:3396
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a205⤵PID:2428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"206⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a207⤵PID:4340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"208⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a209⤵PID:2688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"210⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a211⤵PID:1192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"212⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a213⤵PID:4524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"214⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a215⤵PID:4324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"216⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a217⤵PID:3708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"218⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a219⤵PID:2280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"220⤵PID:548
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a221⤵PID:4640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"222⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a223⤵PID:3628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"224⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a225⤵PID:400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"226⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a227⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"228⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a229⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"230⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a231⤵PID:372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"232⤵PID:2768
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a233⤵PID:1584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"234⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a235⤵PID:4344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"236⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a237⤵PID:2892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"238⤵PID:1020
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a239⤵PID:2148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a"240⤵PID:3504
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a.exeC:\Users\Admin\AppData\Local\Temp\806d9dd57f18d94706bb21dfcabf3c168994696b4853da2955b73b4f00cd406a241⤵PID:5048
-