Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 18:23
Static task
static1
Behavioral task
behavioral1
Sample
082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe
Resource
win10v2004-20240426-en
General
-
Target
082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe
-
Size
273KB
-
MD5
455a7fabe1641afa6940f7537d7cee54
-
SHA1
dd544da1945c8ea26acd229eb8712378d0225227
-
SHA256
082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113
-
SHA512
8e7547c8d2e73f5e3b9ca65a0d80436d5e83dba239c03801e56a708c31952f857364d4a486de507c6e589072b01b38f28939401634e0728a7659bdd339b48238
-
SSDEEP
6144:jV0X5Gl3WlRYgwERjDuV7hOWC1ECIg6dY1c+V+th:je5xkyRjD2cWWHtaYy+0
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
VqYQoQwg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation VqYQoQwg.exe -
Executes dropped EXE 2 IoCs
Processes:
VqYQoQwg.exeNYEAQwck.exepid process 2788 VqYQoQwg.exe 2816 NYEAQwck.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeVqYQoQwg.exeNYEAQwck.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VqYQoQwg.exe = "C:\\Users\\Admin\\GGoMsMEg\\VqYQoQwg.exe" 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NYEAQwck.exe = "C:\\ProgramData\\KYYUQsQQ\\NYEAQwck.exe" 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VqYQoQwg.exe = "C:\\Users\\Admin\\GGoMsMEg\\VqYQoQwg.exe" VqYQoQwg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NYEAQwck.exe = "C:\\ProgramData\\KYYUQsQQ\\NYEAQwck.exe" NYEAQwck.exe -
Drops file in System32 directory 2 IoCs
Processes:
VqYQoQwg.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe VqYQoQwg.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe VqYQoQwg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1988 reg.exe 452 reg.exe 1604 reg.exe 3940 reg.exe 4464 reg.exe 3188 reg.exe 4964 reg.exe 316 reg.exe 3288 reg.exe 1564 reg.exe 4204 reg.exe 3712 reg.exe 1012 reg.exe 1492 reg.exe 3452 reg.exe 1352 reg.exe 4952 reg.exe 1188 reg.exe 1808 reg.exe 3212 reg.exe 444 reg.exe 720 reg.exe 4740 reg.exe 820 reg.exe 1720 reg.exe 3956 reg.exe 2876 reg.exe 4612 reg.exe 2196 reg.exe 1540 reg.exe 1132 reg.exe 2572 reg.exe 4612 reg.exe 4272 reg.exe 2528 reg.exe 704 reg.exe 704 reg.exe 1476 reg.exe 4780 reg.exe 1564 reg.exe 3772 reg.exe 1376 reg.exe 1564 reg.exe 4220 reg.exe 748 reg.exe 2196 reg.exe 3188 reg.exe 4220 reg.exe 704 reg.exe 2696 reg.exe 1488 reg.exe 2972 reg.exe 2316 reg.exe 2984 reg.exe 3240 reg.exe 4396 reg.exe 2892 reg.exe 2072 reg.exe 4468 reg.exe 1872 reg.exe 1824 reg.exe 3028 reg.exe 792 reg.exe 4716 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exepid process 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2592 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2592 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2592 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2592 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3352 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3352 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3352 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3352 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 4072 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 4072 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 4072 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 4072 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 452 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 452 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 452 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 452 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3220 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3220 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3220 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3220 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3272 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3272 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3272 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3272 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3308 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3308 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3308 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 3308 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1720 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1720 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1720 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1720 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 5020 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 5020 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 5020 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 5020 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2280 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2280 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2280 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2280 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2848 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2848 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2848 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 2848 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1124 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1124 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1124 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 1124 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 452 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 452 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 452 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe 452 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
VqYQoQwg.exepid process 2788 VqYQoQwg.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
VqYQoQwg.exepid process 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe 2788 VqYQoQwg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.execmd.execmd.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.execmd.execmd.exe082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.execmd.exedescription pid process target process PID 1568 wrote to memory of 2788 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe VqYQoQwg.exe PID 1568 wrote to memory of 2788 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe VqYQoQwg.exe PID 1568 wrote to memory of 2788 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe VqYQoQwg.exe PID 1568 wrote to memory of 2816 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe NYEAQwck.exe PID 1568 wrote to memory of 2816 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe NYEAQwck.exe PID 1568 wrote to memory of 2816 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe NYEAQwck.exe PID 1568 wrote to memory of 4824 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 1568 wrote to memory of 4824 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 1568 wrote to memory of 4824 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 4824 wrote to memory of 792 4824 cmd.exe 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe PID 4824 wrote to memory of 792 4824 cmd.exe 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe PID 4824 wrote to memory of 792 4824 cmd.exe 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe PID 1568 wrote to memory of 2192 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 1568 wrote to memory of 2192 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 1568 wrote to memory of 2192 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 1568 wrote to memory of 3288 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 1568 wrote to memory of 3288 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 1568 wrote to memory of 3288 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 1568 wrote to memory of 1540 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 1568 wrote to memory of 1540 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 1568 wrote to memory of 1540 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 1568 wrote to memory of 1508 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 1568 wrote to memory of 1508 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 1568 wrote to memory of 1508 1568 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 1508 wrote to memory of 2540 1508 cmd.exe cscript.exe PID 1508 wrote to memory of 2540 1508 cmd.exe cscript.exe PID 1508 wrote to memory of 2540 1508 cmd.exe cscript.exe PID 792 wrote to memory of 4988 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 792 wrote to memory of 4988 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 792 wrote to memory of 4988 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 792 wrote to memory of 2448 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 792 wrote to memory of 2448 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 792 wrote to memory of 2448 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 792 wrote to memory of 3952 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 792 wrote to memory of 3952 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 792 wrote to memory of 3952 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 792 wrote to memory of 2660 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 792 wrote to memory of 2660 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 792 wrote to memory of 2660 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 792 wrote to memory of 1360 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 792 wrote to memory of 1360 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 792 wrote to memory of 1360 792 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 4988 wrote to memory of 2148 4988 cmd.exe 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe PID 4988 wrote to memory of 2148 4988 cmd.exe 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe PID 4988 wrote to memory of 2148 4988 cmd.exe 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe PID 1360 wrote to memory of 2220 1360 cmd.exe cscript.exe PID 1360 wrote to memory of 2220 1360 cmd.exe cscript.exe PID 1360 wrote to memory of 2220 1360 cmd.exe cscript.exe PID 2148 wrote to memory of 932 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 2148 wrote to memory of 932 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 2148 wrote to memory of 932 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe PID 932 wrote to memory of 2592 932 cmd.exe cmd.exe PID 932 wrote to memory of 2592 932 cmd.exe cmd.exe PID 932 wrote to memory of 2592 932 cmd.exe cmd.exe PID 2148 wrote to memory of 1220 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 2148 wrote to memory of 1220 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 2148 wrote to memory of 1220 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 2148 wrote to memory of 1744 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 2148 wrote to memory of 1744 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 2148 wrote to memory of 1744 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 2148 wrote to memory of 4164 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 2148 wrote to memory of 4164 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 2148 wrote to memory of 4164 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe reg.exe PID 2148 wrote to memory of 4760 2148 082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe"C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\GGoMsMEg\VqYQoQwg.exe"C:\Users\Admin\GGoMsMEg\VqYQoQwg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2788 -
C:\ProgramData\KYYUQsQQ\NYEAQwck.exe"C:\ProgramData\KYYUQsQQ\NYEAQwck.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"2⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f1133⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"4⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f1135⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"6⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f1137⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"8⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f1139⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"10⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11311⤵
- Suspicious behavior: EnumeratesProcesses
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"12⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11313⤵
- Suspicious behavior: EnumeratesProcesses
PID:452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"14⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11315⤵
- Suspicious behavior: EnumeratesProcesses
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"16⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11317⤵
- Suspicious behavior: EnumeratesProcesses
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"18⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11319⤵
- Suspicious behavior: EnumeratesProcesses
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"20⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11321⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"22⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11323⤵
- Suspicious behavior: EnumeratesProcesses
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"24⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11325⤵
- Suspicious behavior: EnumeratesProcesses
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"26⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11327⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"28⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11329⤵
- Suspicious behavior: EnumeratesProcesses
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"30⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11331⤵
- Suspicious behavior: EnumeratesProcesses
PID:452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"32⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11333⤵PID:2404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"34⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11335⤵PID:3352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"36⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11337⤵PID:4360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"38⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11339⤵PID:3308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"40⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11341⤵PID:2220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"42⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11343⤵PID:1180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"44⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11345⤵PID:4332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"46⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11347⤵PID:4248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"48⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11349⤵PID:3912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"50⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11351⤵PID:3668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"52⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11353⤵PID:2748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"54⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11355⤵PID:1108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"56⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11357⤵PID:216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"58⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11359⤵PID:2324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"60⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11361⤵PID:4892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"62⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11363⤵PID:1420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"64⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11365⤵PID:4216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"66⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11367⤵PID:3624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"68⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11369⤵PID:4448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"70⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11371⤵PID:2892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"72⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11373⤵PID:2404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"74⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11375⤵PID:2952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"76⤵PID:3500
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11377⤵PID:3028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"78⤵PID:2748
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11379⤵PID:2960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"80⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11381⤵PID:1228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"82⤵PID:4080
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11383⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"84⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11385⤵PID:2328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"86⤵PID:3356
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11387⤵PID:2864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"88⤵PID:60
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11389⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"90⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11391⤵PID:820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"92⤵PID:4552
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11393⤵PID:880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"94⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11395⤵PID:3888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"96⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11397⤵PID:1768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"98⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f11399⤵PID:2496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"100⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113101⤵PID:628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"102⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113103⤵PID:3924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"104⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113105⤵PID:224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"106⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113107⤵PID:4980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"108⤵PID:1476
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113109⤵PID:2584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"110⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113111⤵PID:1828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"112⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113113⤵PID:224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"114⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113115⤵PID:4080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"116⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113117⤵PID:2972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"118⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113119⤵PID:1116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"120⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113121⤵PID:1580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"122⤵PID:1720
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113123⤵PID:412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"124⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113125⤵PID:3640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"126⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113127⤵PID:4744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"128⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113129⤵PID:2292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"130⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113131⤵PID:2728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"132⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113133⤵PID:4392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"134⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113135⤵PID:4980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"136⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113137⤵PID:1108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"138⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113139⤵PID:3316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"140⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113141⤵PID:4700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"142⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113143⤵PID:2700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"144⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113145⤵PID:1828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"146⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113147⤵PID:1508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"148⤵PID:5004
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113149⤵PID:1928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"150⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113151⤵PID:4336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"152⤵PID:1584
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113153⤵PID:1228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"154⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113155⤵PID:1188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"156⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113157⤵PID:2340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"158⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113159⤵PID:5040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"160⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113161⤵PID:2728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"162⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113163⤵PID:2388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"164⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113165⤵PID:4368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"166⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113167⤵PID:1420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"168⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113169⤵PID:3500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"170⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113171⤵PID:5072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"172⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113173⤵PID:1276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"174⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113175⤵PID:2176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"176⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113177⤵PID:1988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"178⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113179⤵PID:1124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"180⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113181⤵PID:1132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"182⤵PID:1580
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1183⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113183⤵PID:2320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"184⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113185⤵PID:4572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"186⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113187⤵PID:3836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"188⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113189⤵PID:728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"190⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113191⤵PID:4396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"192⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113193⤵PID:3912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"194⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113195⤵PID:628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"196⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113197⤵PID:1132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"198⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113199⤵PID:3080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"200⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113201⤵PID:984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"202⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113203⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"204⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113205⤵PID:4760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"206⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113207⤵PID:3460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"208⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113209⤵PID:2764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"210⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113211⤵PID:1988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"212⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113213⤵PID:3352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"214⤵PID:3948
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1215⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113215⤵PID:4996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"216⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113217⤵PID:2316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"218⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113219⤵PID:2144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"220⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113221⤵PID:1808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"222⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113223⤵PID:4720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"224⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113225⤵PID:3240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"226⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113227⤵PID:1544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"228⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113229⤵PID:4612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"230⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113231⤵PID:3708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"232⤵PID:4312
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113233⤵PID:2308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"234⤵PID:3620
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113235⤵PID:4708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"236⤵PID:4456
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113237⤵PID:3220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"238⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113239⤵PID:444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113"240⤵PID:116
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113.exeC:\Users\Admin\AppData\Local\Temp\082973bf90e1f66fa1b2eb4593333b1c41e705b6261eecb869fe1b7af222f113241⤵PID:1960
-