Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:34
Static task
static1
Behavioral task
behavioral1
Sample
21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe
Resource
win10v2004-20240426-en
General
-
Target
21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe
-
Size
201KB
-
MD5
2fa2b4a6ba4e35f024e2d3bcefc03fca
-
SHA1
6af965283bf78a17b989a755527754535b4791d9
-
SHA256
21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023
-
SHA512
31e1d63a674ec792ad8dd2287dccb51e22d10773be472b439b32dd28c76b2231deeb85dcc6605f4ed3a1fdfa177f97a0b598265568d02ec0172dbd908d36c266
-
SSDEEP
6144:QBF/hTDrEqoWUSyfdBZ5m6Mi/adudGCDMCJQ:iF/lDYpnSylJm4DMD
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (77) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rWEQcEQk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation rWEQcEQk.exe -
Executes dropped EXE 6 IoCs
Processes:
rWEQcEQk.exegOIsYcYk.exepid process 872 rWEQcEQk.exe 704 gOIsYcYk.exe 1656 4868 4364 1348 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exegOIsYcYk.exerWEQcEQk.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gOIsYcYk.exe = "C:\\ProgramData\\wEgEMkIQ\\gOIsYcYk.exe" 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gOIsYcYk.exe = "C:\\ProgramData\\wEgEMkIQ\\gOIsYcYk.exe" gOIsYcYk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JIUwMcog.exe = "C:\\ProgramData\\ioYYEkoI\\JIUwMcog.exe" Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CmIUIwwM.exe = "C:\\Users\\Admin\\EYUoQsEs\\CmIUIwwM.exe" Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rWEQcEQk.exe = "C:\\Users\\Admin\\iuIgEogU\\rWEQcEQk.exe" 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rWEQcEQk.exe = "C:\\Users\\Admin\\iuIgEogU\\rWEQcEQk.exe" rWEQcEQk.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CmIUIwwM.exe = "C:\\Users\\Admin\\EYUoQsEs\\CmIUIwwM.exe" 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JIUwMcog.exe = "C:\\ProgramData\\ioYYEkoI\\JIUwMcog.exe" 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CmIUIwwM.exe = "C:\\Users\\Admin\\EYUoQsEs\\CmIUIwwM.exe" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JIUwMcog.exe = "C:\\ProgramData\\ioYYEkoI\\JIUwMcog.exe" -
Drops file in System32 directory 2 IoCs
Processes:
rWEQcEQk.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe rWEQcEQk.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe rWEQcEQk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1860 1176 WerFault.exe JIUwMcog.exe 4276 2392 WerFault.exe CmIUIwwM.exe 5044 1656 3632 4868 4940 4364 1992 1348 -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 776 4004 776 reg.exe 4996 reg.exe 3524 reg.exe 4436 reg.exe 4416 reg.exe 4296 reg.exe 1648 reg.exe 4416 reg.exe 3848 reg.exe 2792 reg.exe 4704 reg.exe 392 1864 544 reg.exe 5048 reg.exe 2100 reg.exe 1656 reg.exe 2464 reg.exe 2172 reg.exe 392 reg.exe 3604 reg.exe 2624 reg.exe 1348 reg.exe 5068 reg.exe 2276 reg.exe 1772 reg.exe 1000 reg.exe 764 reg.exe 3784 reg.exe 1948 reg.exe 3860 4924 4332 reg.exe 3796 reg.exe 228 3720 reg.exe 4712 reg.exe 2500 reg.exe 3336 5092 reg.exe 2032 reg.exe 4328 reg.exe 3288 3716 1660 reg.exe 3716 reg.exe 1648 4444 4912 4864 reg.exe 4512 reg.exe 3996 reg.exe 4276 reg.exe 4808 reg.exe 4040 reg.exe 3528 3784 2336 reg.exe 4876 reg.exe 2612 4452 336 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exepid process 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4940 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4940 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4940 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4940 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4744 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4744 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4744 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4744 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1912 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1912 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1912 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1912 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 2124 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 2124 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 2124 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 2124 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1408 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1408 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1408 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1408 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4152 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4152 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4152 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4152 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 3964 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 3964 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 3964 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 3964 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4376 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4376 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4376 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4376 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4332 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4332 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4332 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4332 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1992 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1992 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1992 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 1992 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4880 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4880 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4880 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 4880 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 884 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 884 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 884 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe 884 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rWEQcEQk.exepid process 872 rWEQcEQk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
rWEQcEQk.exepid process 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe 872 rWEQcEQk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.execmd.execmd.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.execmd.execmd.exe21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.execmd.exedescription pid process target process PID 64 wrote to memory of 872 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe rWEQcEQk.exe PID 64 wrote to memory of 872 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe rWEQcEQk.exe PID 64 wrote to memory of 872 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe rWEQcEQk.exe PID 64 wrote to memory of 704 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe gOIsYcYk.exe PID 64 wrote to memory of 704 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe gOIsYcYk.exe PID 64 wrote to memory of 704 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe gOIsYcYk.exe PID 64 wrote to memory of 768 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 64 wrote to memory of 768 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 64 wrote to memory of 768 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 768 wrote to memory of 4700 768 cmd.exe 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe PID 768 wrote to memory of 4700 768 cmd.exe 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe PID 768 wrote to memory of 4700 768 cmd.exe 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe PID 64 wrote to memory of 2176 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 64 wrote to memory of 2176 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 64 wrote to memory of 2176 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 64 wrote to memory of 3240 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 64 wrote to memory of 3240 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 64 wrote to memory of 3240 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 64 wrote to memory of 3160 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 64 wrote to memory of 3160 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 64 wrote to memory of 3160 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 64 wrote to memory of 1348 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 64 wrote to memory of 1348 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 64 wrote to memory of 1348 64 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 1348 wrote to memory of 2864 1348 cmd.exe cscript.exe PID 1348 wrote to memory of 2864 1348 cmd.exe cscript.exe PID 1348 wrote to memory of 2864 1348 cmd.exe cscript.exe PID 4700 wrote to memory of 1124 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 4700 wrote to memory of 1124 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 4700 wrote to memory of 1124 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 1124 wrote to memory of 1676 1124 cmd.exe 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe PID 1124 wrote to memory of 1676 1124 cmd.exe 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe PID 1124 wrote to memory of 1676 1124 cmd.exe 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe PID 4700 wrote to memory of 3920 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 4700 wrote to memory of 3920 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 4700 wrote to memory of 3920 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 4700 wrote to memory of 2704 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 4700 wrote to memory of 2704 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 4700 wrote to memory of 2704 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 4700 wrote to memory of 1168 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 4700 wrote to memory of 1168 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 4700 wrote to memory of 1168 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 4700 wrote to memory of 4128 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 4700 wrote to memory of 4128 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 4700 wrote to memory of 4128 4700 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 4128 wrote to memory of 4056 4128 cmd.exe cscript.exe PID 4128 wrote to memory of 4056 4128 cmd.exe cscript.exe PID 4128 wrote to memory of 4056 4128 cmd.exe cscript.exe PID 1676 wrote to memory of 2168 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 1676 wrote to memory of 2168 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 1676 wrote to memory of 2168 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe PID 2168 wrote to memory of 4940 2168 cmd.exe 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe PID 2168 wrote to memory of 4940 2168 cmd.exe 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe PID 2168 wrote to memory of 4940 2168 cmd.exe 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe PID 1676 wrote to memory of 2460 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 1676 wrote to memory of 2460 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 1676 wrote to memory of 2460 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 1676 wrote to memory of 1172 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 1676 wrote to memory of 1172 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 1676 wrote to memory of 1172 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 1676 wrote to memory of 3188 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 1676 wrote to memory of 3188 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 1676 wrote to memory of 3188 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe reg.exe PID 1676 wrote to memory of 4664 1676 21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe"C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\iuIgEogU\rWEQcEQk.exe"C:\Users\Admin\iuIgEogU\rWEQcEQk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:872 -
C:\ProgramData\wEgEMkIQ\gOIsYcYk.exe"C:\ProgramData\wEgEMkIQ\gOIsYcYk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"2⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c783340233⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"4⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c783340235⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"6⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c783340237⤵
- Suspicious behavior: EnumeratesProcesses
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"8⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c783340239⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"10⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402311⤵
- Suspicious behavior: EnumeratesProcesses
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"12⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402313⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"14⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402315⤵
- Suspicious behavior: EnumeratesProcesses
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"16⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402317⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"18⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402319⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"20⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402321⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"22⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402323⤵
- Suspicious behavior: EnumeratesProcesses
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"24⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402325⤵
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"26⤵PID:4940
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402327⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"28⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402329⤵
- Suspicious behavior: EnumeratesProcesses
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"30⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402331⤵
- Suspicious behavior: EnumeratesProcesses
PID:884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"32⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402333⤵PID:3640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"34⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402335⤵PID:708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"36⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402337⤵PID:1256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"38⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402339⤵PID:4364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"40⤵PID:2876
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402341⤵PID:5080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"42⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402343⤵PID:3784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"44⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402345⤵PID:1268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"46⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402347⤵PID:2652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"48⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402349⤵PID:1860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"50⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402351⤵PID:228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"52⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402353⤵PID:4276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"54⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402355⤵PID:4340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"56⤵PID:4004
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402357⤵PID:3948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"58⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402359⤵PID:3044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"60⤵PID:2648
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402361⤵PID:544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"62⤵PID:1016
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402363⤵PID:1700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"64⤵PID:1204
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402365⤵PID:1276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"66⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402367⤵PID:3804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"68⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402369⤵PID:2028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"70⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402371⤵PID:1164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"72⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402373⤵PID:4060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"74⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402375⤵PID:4876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"76⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402377⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"78⤵PID:2652
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402379⤵PID:4656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"80⤵PID:5088
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402381⤵PID:4056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"82⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402383⤵
- Adds Run key to start application
PID:3936 -
C:\Users\Admin\EYUoQsEs\CmIUIwwM.exe"C:\Users\Admin\EYUoQsEs\CmIUIwwM.exe"84⤵PID:2392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 22485⤵
- Program crash
PID:4276 -
C:\ProgramData\ioYYEkoI\JIUwMcog.exe"C:\ProgramData\ioYYEkoI\JIUwMcog.exe"84⤵PID:1176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 22485⤵
- Program crash
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"84⤵PID:2620
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402385⤵PID:1444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"86⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402387⤵PID:876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"88⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402389⤵PID:2808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"90⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402391⤵PID:2664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"92⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402393⤵PID:1520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"94⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402395⤵PID:4660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"96⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402397⤵PID:4892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"98⤵PID:4876
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c7833402399⤵PID:4920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"100⤵PID:1496
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023101⤵PID:884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"102⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023103⤵PID:5024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"104⤵PID:3760
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023105⤵PID:4300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"106⤵PID:4940
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023107⤵PID:4876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"108⤵PID:4052
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023109⤵PID:1544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"110⤵PID:1348
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023111⤵PID:3768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"112⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023113⤵PID:4116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"114⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023115⤵PID:4452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"116⤵PID:428
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023117⤵PID:3924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"118⤵PID:4668
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023119⤵PID:4752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"120⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023121⤵PID:1124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"122⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023123⤵PID:468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"124⤵PID:1648
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023125⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"126⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023127⤵PID:2780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"128⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023129⤵PID:4064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"130⤵PID:2920
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023131⤵PID:1936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"132⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023133⤵PID:3240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"134⤵PID:3560
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023135⤵PID:1228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"136⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023137⤵PID:1544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"138⤵PID:3112
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023139⤵PID:4032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"140⤵PID:4376
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023141⤵PID:4968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"142⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023143⤵PID:2400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"144⤵PID:2504
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023145⤵PID:3864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"146⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023147⤵PID:2080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"148⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023149⤵PID:3660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"150⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023151⤵PID:2612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"152⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023153⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"154⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023155⤵PID:5092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"156⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023157⤵PID:4296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"158⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023159⤵PID:4252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"160⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023161⤵PID:4752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"162⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023163⤵PID:4572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"164⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023165⤵PID:3720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"166⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023167⤵PID:2052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"168⤵PID:2276
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023169⤵PID:4072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"170⤵PID:440
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023171⤵PID:1172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"172⤵PID:4992
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1173⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023173⤵PID:3884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"174⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023175⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"176⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023177⤵PID:4924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"178⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023179⤵PID:3240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"180⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023181⤵PID:2500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"182⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023183⤵PID:4496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"184⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023185⤵PID:3380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"186⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023187⤵PID:4876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"188⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023189⤵PID:64
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"190⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023191⤵PID:4128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"192⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023193⤵PID:1900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"194⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023195⤵PID:4620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"196⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023197⤵PID:4892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"198⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023199⤵PID:4752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"200⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023201⤵PID:2092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"202⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023203⤵PID:1500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"204⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023205⤵PID:3380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"206⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023207⤵PID:1444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"208⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023209⤵PID:4684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"210⤵PID:3216
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1211⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023211⤵PID:1000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"212⤵PID:4104
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023213⤵PID:4004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"214⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023215⤵PID:3848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"216⤵PID:4400
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023217⤵PID:3348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"218⤵PID:4164
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023219⤵PID:2460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"220⤵PID:2392
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023221⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"222⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023223⤵PID:876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"224⤵PID:4668
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1225⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023225⤵PID:1936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"226⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023227⤵PID:428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"228⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023229⤵PID:1372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"230⤵PID:3568
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023231⤵PID:4104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"232⤵PID:1544
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023233⤵PID:1424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"234⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023235⤵PID:4876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"236⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023237⤵PID:5104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"238⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023239⤵PID:4400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023"240⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023.exeC:\Users\Admin\AppData\Local\Temp\21f37b25a0441c8f25df4351393ee50ee4e9b70466c8f8cd3dda886c78334023241⤵PID:4092
-