Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 20:28
Static task
static1
Behavioral task
behavioral1
Sample
363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe
Resource
win10v2004-20240426-en
General
-
Target
363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe
-
Size
203KB
-
MD5
534561d3d3a5b8ec6feb851d5b24a0d1
-
SHA1
95289845bdd011e69973548d05186c2312ee1f5a
-
SHA256
363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd
-
SHA512
4ae3d1fad309e1414506bc2b72b632742941c7470b80f7c65b30b4ee1846c71c7ac917cc739b382276ab587d16ff8932bd226c6004eb46086e36f60f536e2821
-
SSDEEP
3072:oQQXfc3edu86ewhiv32ggLXgk0DbLHmE2qv06xTsUnEFiJEGa773:oV2edRGgg7dqvlJEGG
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (78) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 1 IoCs
Processes:
flow pid process 32 4236 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LGQAcQkA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation LGQAcQkA.exe -
Executes dropped EXE 2 IoCs
Processes:
LGQAcQkA.exeZiMgokUQ.exepid process 2744 LGQAcQkA.exe 2152 ZiMgokUQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeLGQAcQkA.exeZiMgokUQ.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LGQAcQkA.exe = "C:\\Users\\Admin\\mkQgEMgw\\LGQAcQkA.exe" 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZiMgokUQ.exe = "C:\\ProgramData\\OqMssAMA\\ZiMgokUQ.exe" 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LGQAcQkA.exe = "C:\\Users\\Admin\\mkQgEMgw\\LGQAcQkA.exe" LGQAcQkA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZiMgokUQ.exe = "C:\\ProgramData\\OqMssAMA\\ZiMgokUQ.exe" ZiMgokUQ.exe -
Drops file in System32 directory 2 IoCs
Processes:
LGQAcQkA.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe LGQAcQkA.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe LGQAcQkA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2480 reg.exe 580 reg.exe 2104 reg.exe 4572 reg.exe 1208 reg.exe 1044 reg.exe 4212 reg.exe 2748 reg.exe 804 reg.exe 3080 4588 1680 reg.exe 2324 reg.exe 1444 reg.exe 2320 reg.exe 1844 reg.exe 4924 reg.exe 3776 reg.exe 4344 reg.exe 3948 reg.exe 3164 reg.exe 4320 reg.exe 1604 reg.exe 4244 reg.exe 4736 reg.exe 2772 1532 1976 3996 reg.exe 3440 reg.exe 1228 reg.exe 1692 reg.exe 2352 reg.exe 5064 4116 reg.exe 4064 reg.exe 4144 reg.exe 1500 reg.exe 4416 1636 reg.exe 436 reg.exe 1608 reg.exe 2488 reg.exe 2920 reg.exe 4948 reg.exe 224 reg.exe 3312 reg.exe 4736 reg.exe 3312 reg.exe 2948 reg.exe 996 660 reg.exe 1396 reg.exe 5064 4136 reg.exe 220 reg.exe 504 reg.exe 4360 reg.exe 1864 reg.exe 1680 reg.exe 1276 reg.exe 3240 reg.exe 2276 reg.exe 4876 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exepid process 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3088 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3088 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3088 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3088 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 676 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 676 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 676 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 676 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4176 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4176 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4176 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4176 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1524 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1524 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1524 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1524 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3512 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3512 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3512 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3512 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 504 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 504 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 504 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 504 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1860 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1860 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1860 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1860 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1124 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1124 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1124 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1124 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1284 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1284 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1284 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 1284 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3248 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3248 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3248 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 3248 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 5064 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 5064 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 5064 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 5064 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 2488 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 2488 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 2488 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe 2488 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
LGQAcQkA.exepid process 2744 LGQAcQkA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
LGQAcQkA.exepid process 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe 2744 LGQAcQkA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.execmd.execmd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.execmd.execmd.exe363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.execmd.exedescription pid process target process PID 5112 wrote to memory of 2744 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe LGQAcQkA.exe PID 5112 wrote to memory of 2744 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe LGQAcQkA.exe PID 5112 wrote to memory of 2744 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe LGQAcQkA.exe PID 5112 wrote to memory of 2152 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe ZiMgokUQ.exe PID 5112 wrote to memory of 2152 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe ZiMgokUQ.exe PID 5112 wrote to memory of 2152 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe ZiMgokUQ.exe PID 5112 wrote to memory of 4680 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 5112 wrote to memory of 4680 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 5112 wrote to memory of 4680 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 4680 wrote to memory of 4608 4680 cmd.exe 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe PID 4680 wrote to memory of 4608 4680 cmd.exe 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe PID 4680 wrote to memory of 4608 4680 cmd.exe 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe PID 5112 wrote to memory of 5036 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 5112 wrote to memory of 5036 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 5112 wrote to memory of 5036 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 5112 wrote to memory of 1636 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 5112 wrote to memory of 1636 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 5112 wrote to memory of 1636 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 5112 wrote to memory of 1512 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 5112 wrote to memory of 1512 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 5112 wrote to memory of 1512 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 5112 wrote to memory of 804 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 5112 wrote to memory of 804 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 5112 wrote to memory of 804 5112 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 804 wrote to memory of 224 804 cmd.exe cscript.exe PID 804 wrote to memory of 224 804 cmd.exe cscript.exe PID 804 wrote to memory of 224 804 cmd.exe cscript.exe PID 4608 wrote to memory of 2652 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 4608 wrote to memory of 2652 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 4608 wrote to memory of 2652 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 2652 wrote to memory of 4048 2652 cmd.exe 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe PID 2652 wrote to memory of 4048 2652 cmd.exe 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe PID 2652 wrote to memory of 4048 2652 cmd.exe 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe PID 4608 wrote to memory of 2292 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4608 wrote to memory of 2292 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4608 wrote to memory of 2292 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4608 wrote to memory of 3948 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4608 wrote to memory of 3948 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4608 wrote to memory of 3948 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4608 wrote to memory of 1604 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4608 wrote to memory of 1604 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4608 wrote to memory of 1604 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4608 wrote to memory of 1544 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 4608 wrote to memory of 1544 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 4608 wrote to memory of 1544 4608 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 1544 wrote to memory of 5016 1544 cmd.exe cscript.exe PID 1544 wrote to memory of 5016 1544 cmd.exe cscript.exe PID 1544 wrote to memory of 5016 1544 cmd.exe cscript.exe PID 4048 wrote to memory of 3900 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 4048 wrote to memory of 3900 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 4048 wrote to memory of 3900 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe PID 3900 wrote to memory of 3088 3900 cmd.exe 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe PID 3900 wrote to memory of 3088 3900 cmd.exe 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe PID 3900 wrote to memory of 3088 3900 cmd.exe 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe PID 4048 wrote to memory of 4644 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4048 wrote to memory of 4644 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4048 wrote to memory of 4644 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4048 wrote to memory of 4252 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4048 wrote to memory of 4252 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4048 wrote to memory of 4252 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4048 wrote to memory of 3684 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4048 wrote to memory of 3684 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4048 wrote to memory of 3684 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe reg.exe PID 4048 wrote to memory of 3404 4048 363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe"C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\mkQgEMgw\LGQAcQkA.exe"C:\Users\Admin\mkQgEMgw\LGQAcQkA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\OqMssAMA\ZiMgokUQ.exe"C:\ProgramData\OqMssAMA\ZiMgokUQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"8⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"10⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"12⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"14⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"16⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"18⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"20⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"24⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"26⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"28⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"30⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"32⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"34⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"36⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"38⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"40⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"42⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"44⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"46⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"48⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"50⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"52⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"54⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"56⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"58⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"60⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"62⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"66⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"68⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"70⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"72⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"74⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"76⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"78⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"80⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"82⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"84⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"86⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"88⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"90⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"92⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"94⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"96⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"98⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"100⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"102⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"106⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"110⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"114⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"116⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"118⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"120⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"122⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"124⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"126⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"128⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"130⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"132⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1133⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"134⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"136⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1137⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"138⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"140⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"142⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"144⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"146⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"148⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"150⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"152⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"154⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"156⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"158⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"160⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"162⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"164⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"166⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"168⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"170⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"172⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"174⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"176⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"178⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"180⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"182⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1183⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"184⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"186⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"188⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"190⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"192⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"194⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"196⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"198⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"200⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"202⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"204⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"206⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"208⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"210⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"212⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"214⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"216⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"218⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"220⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"224⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"228⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"230⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"232⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"236⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"238⤵
-
C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd.exeC:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\363c7d80912d56db2f9fa37adace43beae80707cb31536a5d8437b0d6c711efd"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵