Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
72s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 22:24
Static task
static1
Behavioral task
behavioral1
Sample
a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe
-
Size
17KB
-
MD5
a87579d691aad2f371bbae09006099b7
-
SHA1
b596e2494c0991f62ac9b5fd0a624dfdb60ce7e8
-
SHA256
b5241ab14857b6b8827ebe8bbc18308503863ec9c35e4c2f6b8dd0fec18ddfd5
-
SHA512
953f966b64ef45d37227f34206b94e1ab1aed58c970c400767b74b492c77a7503752eebd2edf7d1ccf1f54ef07cc8a075f1b0568fdf3945b4892c183da5be333
-
SSDEEP
384:FM8IYnjBPeBFQv9yOTqCjlGVqCtRq6spFC9+Vf:FM8IijMcv9yOT2hECu
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\drivers\Hdv32.sys Process not Found -
Deletes itself 1 IoCs
pid Process 2944 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 3004 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2856 MMDXYBQE1035.exe 2292 MMDXYBQE1035.exe 3044 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2148 MMDXYBQE1035.exe 1600 MMDXYBQE1035.exe 1908 MMDXYBQE1035.exe 1660 MMDXYBQE1035.exe 2020 MMDXYBQE1035.exe 2672 MMDXYBQE1035.exe 2172 MMDXYBQE1035.exe 2524 MMDXYBQE1035.exe 1544 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2748 MMDXYBQE1035.exe 592 MMDXYBQE1035.exe 2696 MMDXYBQE1035.exe 332 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2116 MMDXYBQE1035.exe 1868 MMDXYBQE1035.exe 628 MMDXYBQE1035.exe 2504 MMDXYBQE1035.exe 1408 MMDXYBQE1035.exe 2980 MMDXYBQE1035.exe 2260 MMDXYBQE1035.exe 332 MMDXYBQE1035.exe 2908 MMDXYBQE1035.exe 2896 MMDXYBQE1035.exe 1588 MMDXYBQE1035.exe 2504 MMDXYBQE1035.exe 2768 MMDXYBQE1035.exe 1564 MMDXYBQE1035.exe 928 MMDXYBQE1035.exe 1604 MMDXYBQE1035.exe 2412 MMDXYBQE1035.exe 3008 MMDXYBQE1035.exe 3012 MMDXYBQE1035.exe 2884 MMDXYBQE1035.exe 3032 MMDXYBQE1035.exe 104 MMDXYBQE1035.exe 1564 MMDXYBQE1035.exe 2488 MMDXYBQE1035.exe 3020 MMDXYBQE1035.exe 828 MMDXYBQE1035.exe 2032 MMDXYBQE1035.exe 2916 MMDXYBQE1035.exe 2212 MMDXYBQE1035.exe 1544 MMDXYBQE1035.exe 2988 MMDXYBQE1035.exe 2260 MMDXYBQE1035.exe 1128 MMDXYBQE1035.exe 3096 MMDXYBQE1035.exe 3240 MMDXYBQE1035.exe 3356 MMDXYBQE1035.exe 3556 MMDXYBQE1035.exe 3776 MMDXYBQE1035.exe 3956 MMDXYBQE1035.exe 1624 MMDXYBQE1035.exe 2788 MMDXYBQE1035.exe 3100 MMDXYBQE1035.exe 3480 MMDXYBQE1035.exe -
Loads dropped DLL 64 IoCs
pid Process 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 3004 MMDXYBQE1035.exe 3004 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2856 MMDXYBQE1035.exe 2856 MMDXYBQE1035.exe 2292 MMDXYBQE1035.exe 2292 MMDXYBQE1035.exe 3044 MMDXYBQE1035.exe 3044 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2148 MMDXYBQE1035.exe 2148 MMDXYBQE1035.exe 1600 MMDXYBQE1035.exe 1600 MMDXYBQE1035.exe 1908 MMDXYBQE1035.exe 1908 MMDXYBQE1035.exe 1660 MMDXYBQE1035.exe 1660 MMDXYBQE1035.exe 2020 MMDXYBQE1035.exe 2020 MMDXYBQE1035.exe 2672 MMDXYBQE1035.exe 2672 MMDXYBQE1035.exe 2172 MMDXYBQE1035.exe 2172 MMDXYBQE1035.exe 2524 MMDXYBQE1035.exe 2524 MMDXYBQE1035.exe 1544 MMDXYBQE1035.exe 1544 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2748 MMDXYBQE1035.exe 2748 MMDXYBQE1035.exe 592 MMDXYBQE1035.exe 592 MMDXYBQE1035.exe 2696 MMDXYBQE1035.exe 2696 MMDXYBQE1035.exe 332 MMDXYBQE1035.exe 332 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2116 MMDXYBQE1035.exe 2116 MMDXYBQE1035.exe 1868 MMDXYBQE1035.exe 1868 MMDXYBQE1035.exe 628 MMDXYBQE1035.exe 628 MMDXYBQE1035.exe 2504 MMDXYBQE1035.exe 2504 MMDXYBQE1035.exe 1408 MMDXYBQE1035.exe 1408 MMDXYBQE1035.exe 2980 MMDXYBQE1035.exe 2980 MMDXYBQE1035.exe 2260 MMDXYBQE1035.exe 2260 MMDXYBQE1035.exe 332 MMDXYBQE1035.exe 2908 MMDXYBQE1035.exe 2908 MMDXYBQE1035.exe 2896 MMDXYBQE1035.exe 2896 MMDXYBQE1035.exe 1588 MMDXYBQE1035.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe MMDXYBQE1035.exe File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found File opened for modification C:\Windows\SysWOW64\MMDXYBQE1035.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMDXYBQE1035.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 3004 MMDXYBQE1035.exe 3004 MMDXYBQE1035.exe 3004 MMDXYBQE1035.exe 3004 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2928 MMDXYBQE1035.exe 2856 MMDXYBQE1035.exe 2856 MMDXYBQE1035.exe 2856 MMDXYBQE1035.exe 2856 MMDXYBQE1035.exe 2292 MMDXYBQE1035.exe 2292 MMDXYBQE1035.exe 2292 MMDXYBQE1035.exe 2292 MMDXYBQE1035.exe 3044 MMDXYBQE1035.exe 3044 MMDXYBQE1035.exe 3044 MMDXYBQE1035.exe 3044 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2680 MMDXYBQE1035.exe 2148 MMDXYBQE1035.exe 2148 MMDXYBQE1035.exe 2148 MMDXYBQE1035.exe 2148 MMDXYBQE1035.exe 1600 MMDXYBQE1035.exe 1600 MMDXYBQE1035.exe 1600 MMDXYBQE1035.exe 1600 MMDXYBQE1035.exe 1908 MMDXYBQE1035.exe 1908 MMDXYBQE1035.exe 1908 MMDXYBQE1035.exe 1908 MMDXYBQE1035.exe 1660 MMDXYBQE1035.exe 1660 MMDXYBQE1035.exe 1660 MMDXYBQE1035.exe 1660 MMDXYBQE1035.exe 2020 MMDXYBQE1035.exe 2020 MMDXYBQE1035.exe 2020 MMDXYBQE1035.exe 2020 MMDXYBQE1035.exe 2672 MMDXYBQE1035.exe 2672 MMDXYBQE1035.exe 2672 MMDXYBQE1035.exe 2672 MMDXYBQE1035.exe 2172 MMDXYBQE1035.exe 2172 MMDXYBQE1035.exe 2172 MMDXYBQE1035.exe 2172 MMDXYBQE1035.exe 2524 MMDXYBQE1035.exe 2524 MMDXYBQE1035.exe 2524 MMDXYBQE1035.exe 2524 MMDXYBQE1035.exe 1544 MMDXYBQE1035.exe 1544 MMDXYBQE1035.exe 1544 MMDXYBQE1035.exe 1544 MMDXYBQE1035.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3004 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 30 PID 2376 wrote to memory of 3004 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 30 PID 2376 wrote to memory of 3004 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 30 PID 2376 wrote to memory of 3004 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 30 PID 2376 wrote to memory of 2944 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 31 PID 2376 wrote to memory of 2944 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 31 PID 2376 wrote to memory of 2944 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 31 PID 2376 wrote to memory of 2944 2376 a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe 31 PID 3004 wrote to memory of 2928 3004 MMDXYBQE1035.exe 33 PID 3004 wrote to memory of 2928 3004 MMDXYBQE1035.exe 33 PID 3004 wrote to memory of 2928 3004 MMDXYBQE1035.exe 33 PID 3004 wrote to memory of 2928 3004 MMDXYBQE1035.exe 33 PID 3004 wrote to memory of 2920 3004 MMDXYBQE1035.exe 34 PID 3004 wrote to memory of 2920 3004 MMDXYBQE1035.exe 34 PID 3004 wrote to memory of 2920 3004 MMDXYBQE1035.exe 34 PID 3004 wrote to memory of 2920 3004 MMDXYBQE1035.exe 34 PID 2928 wrote to memory of 2856 2928 MMDXYBQE1035.exe 36 PID 2928 wrote to memory of 2856 2928 MMDXYBQE1035.exe 36 PID 2928 wrote to memory of 2856 2928 MMDXYBQE1035.exe 36 PID 2928 wrote to memory of 2856 2928 MMDXYBQE1035.exe 36 PID 2928 wrote to memory of 2724 2928 MMDXYBQE1035.exe 37 PID 2928 wrote to memory of 2724 2928 MMDXYBQE1035.exe 37 PID 2928 wrote to memory of 2724 2928 MMDXYBQE1035.exe 37 PID 2928 wrote to memory of 2724 2928 MMDXYBQE1035.exe 37 PID 2856 wrote to memory of 2292 2856 MMDXYBQE1035.exe 39 PID 2856 wrote to memory of 2292 2856 MMDXYBQE1035.exe 39 PID 2856 wrote to memory of 2292 2856 MMDXYBQE1035.exe 39 PID 2856 wrote to memory of 2292 2856 MMDXYBQE1035.exe 39 PID 2856 wrote to memory of 2816 2856 MMDXYBQE1035.exe 40 PID 2856 wrote to memory of 2816 2856 MMDXYBQE1035.exe 40 PID 2856 wrote to memory of 2816 2856 MMDXYBQE1035.exe 40 PID 2856 wrote to memory of 2816 2856 MMDXYBQE1035.exe 40 PID 2920 wrote to memory of 2988 2920 cmd.exe 42 PID 2920 wrote to memory of 2988 2920 cmd.exe 42 PID 2920 wrote to memory of 2988 2920 cmd.exe 42 PID 2920 wrote to memory of 2988 2920 cmd.exe 42 PID 2944 wrote to memory of 2256 2944 cmd.exe 41 PID 2944 wrote to memory of 2256 2944 cmd.exe 41 PID 2944 wrote to memory of 2256 2944 cmd.exe 41 PID 2944 wrote to memory of 2256 2944 cmd.exe 41 PID 2724 wrote to memory of 2424 2724 cmd.exe 43 PID 2724 wrote to memory of 2424 2724 cmd.exe 43 PID 2724 wrote to memory of 2424 2724 cmd.exe 43 PID 2724 wrote to memory of 2424 2724 cmd.exe 43 PID 2724 wrote to memory of 2916 2724 cmd.exe 45 PID 2724 wrote to memory of 2916 2724 cmd.exe 45 PID 2724 wrote to memory of 2916 2724 cmd.exe 45 PID 2724 wrote to memory of 2916 2724 cmd.exe 45 PID 2292 wrote to memory of 3044 2292 MMDXYBQE1035.exe 46 PID 2292 wrote to memory of 3044 2292 MMDXYBQE1035.exe 46 PID 2292 wrote to memory of 3044 2292 MMDXYBQE1035.exe 46 PID 2292 wrote to memory of 3044 2292 MMDXYBQE1035.exe 46 PID 2292 wrote to memory of 1340 2292 MMDXYBQE1035.exe 48 PID 2292 wrote to memory of 1340 2292 MMDXYBQE1035.exe 48 PID 2292 wrote to memory of 1340 2292 MMDXYBQE1035.exe 48 PID 2292 wrote to memory of 1340 2292 MMDXYBQE1035.exe 48 PID 2920 wrote to memory of 1172 2920 cmd.exe 47 PID 2920 wrote to memory of 1172 2920 cmd.exe 47 PID 2920 wrote to memory of 1172 2920 cmd.exe 47 PID 2920 wrote to memory of 1172 2920 cmd.exe 47 PID 2724 wrote to memory of 1420 2724 cmd.exe 49 PID 2724 wrote to memory of 1420 2724 cmd.exe 49 PID 2724 wrote to memory of 1420 2724 cmd.exe 49 PID 2724 wrote to memory of 1420 2724 cmd.exe 49 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 5420 Process not Found 5880 Process not Found 6352 Process not Found 5872 Process not Found 3532 Process not Found 3576 attrib.exe 4700 Process not Found 3488 attrib.exe 8108 Process not Found 8212 Process not Found 6352 Process not Found 9852 Process not Found 2456 attrib.exe 3544 Process not Found 4604 Process not Found 3364 attrib.exe 4748 Process not Found 3792 attrib.exe 6212 Process not Found 7044 Process not Found 1408 attrib.exe 9544 Process not Found 3884 Process not Found 9008 Process not Found 4708 Process not Found 6264 Process not Found 4724 Process not Found 1132 attrib.exe 7508 Process not Found 7752 Process not Found 8848 Process not Found 10032 Process not Found 1804 attrib.exe 4680 Process not Found 5112 Process not Found 3820 Process not Found 8920 Process not Found 9144 Process not Found 3948 attrib.exe 5548 Process not Found 8248 Process not Found 1520 Process not Found 6076 Process not Found 7592 Process not Found 10128 Process not Found 6420 Process not Found 5908 Process not Found 7200 Process not Found 7036 Process not Found 5608 Process not Found 8380 Process not Found 4644 Process not Found 6988 Process not Found 8004 Process not Found 6992 Process not Found 3984 attrib.exe 5484 Process not Found 6132 Process not Found 4588 Process not Found 3888 Process not Found 4512 Process not Found 6436 Process not Found 7352 Process not Found 5268 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3044 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2680 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2148 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1600 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1908 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1660 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2020 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2672 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe14⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2172 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe15⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1544 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe19⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe20⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe29⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe32⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe34⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe35⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe36⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe37⤵
- Executes dropped EXE
PID:928 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe38⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1604 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe39⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe40⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe41⤵
- Executes dropped EXE
PID:3012 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe42⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe43⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe44⤵
- Executes dropped EXE
PID:104 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe45⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe46⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe47⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:828 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe49⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe50⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe51⤵
- Executes dropped EXE
PID:2212 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe52⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1544 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe53⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2988 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe54⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe55⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe56⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe57⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe58⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:3356 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe59⤵
- Executes dropped EXE
PID:3556 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe60⤵
- Executes dropped EXE
PID:3776 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe61⤵
- Executes dropped EXE
PID:3956 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe62⤵
- Executes dropped EXE
PID:1624 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe63⤵
- Executes dropped EXE
PID:2788 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe64⤵
- Executes dropped EXE
PID:3100 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe65⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:3480 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe66⤵
- Drops file in Drivers directory
PID:3584 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe67⤵PID:3812
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe68⤵PID:868
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe69⤵PID:2768
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe70⤵PID:3160
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe71⤵PID:3220
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe72⤵PID:2036
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe73⤵
- Drops file in System32 directory
PID:4052 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe74⤵PID:2408
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe75⤵
- Drops file in Drivers directory
PID:3028 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe76⤵PID:3336
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe77⤵PID:4024
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe78⤵PID:3216
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe79⤵PID:2088
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe80⤵PID:4028
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe81⤵
- Drops file in Drivers directory
PID:3668 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe82⤵PID:1804
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe83⤵PID:3320
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe84⤵
- Drops file in Drivers directory
PID:3520 -
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe85⤵PID:3896
-
C:\Windows\SysWOW64\MMDXYBQE1035.exeC:\Windows\system32\MMDXYBQE1035.exe86⤵PID:3512
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259515369.bat84⤵PID:3244
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259515260.bat83⤵PID:3220
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h84⤵PID:3616
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259515026.bat82⤵PID:3028
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h83⤵PID:4024
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259514776.bat81⤵PID:4084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h82⤵PID:3208
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259514527.bat80⤵PID:3132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h81⤵PID:2432
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259514246.bat79⤵PID:2912
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h80⤵PID:3608
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259513950.bat78⤵PID:3284
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h79⤵PID:3932
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259513747.bat77⤵PID:3976
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h78⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h78⤵PID:2280
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259513528.bat76⤵PID:3424
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h77⤵PID:1408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h77⤵PID:3016
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259513294.bat75⤵PID:3328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h76⤵PID:2032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h76⤵PID:3436
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259513014.bat74⤵PID:3256
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h75⤵PID:3536
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h75⤵PID:3136
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259512826.bat73⤵PID:2840
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h74⤵PID:3772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h74⤵PID:3644
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259512608.bat72⤵PID:3740
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h73⤵PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h73⤵PID:3476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h73⤵PID:3624
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259512436.bat71⤵PID:3596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h72⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h72⤵PID:3788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h72⤵PID:3112
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259512218.bat70⤵PID:3380
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h71⤵PID:2328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h71⤵PID:1420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h71⤵PID:868
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259511937.bat69⤵PID:2732
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h70⤵PID:4060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h70⤵PID:3428
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h70⤵PID:3272
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259511734.bat68⤵PID:3008
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h69⤵PID:3484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h69⤵PID:2280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h69⤵PID:3600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h69⤵PID:3888
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259511547.bat67⤵PID:3880
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h68⤵PID:3456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h68⤵PID:3236
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h68⤵PID:3116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h68⤵PID:3868
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259511142.bat66⤵PID:3556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h67⤵PID:1708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h67⤵
- System Location Discovery: System Language Discovery
PID:3980
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h67⤵PID:2328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h67⤵PID:3852
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259510876.bat65⤵PID:3432
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h66⤵PID:3624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h66⤵PID:3244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h66⤵PID:2988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h66⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h66⤵PID:3288
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259510642.bat64⤵PID:3228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h65⤵PID:4020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h65⤵PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h65⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h65⤵PID:3944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h65⤵PID:1048
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259510439.bat63⤵PID:2412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h64⤵PID:3588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h64⤵PID:3080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h64⤵PID:3208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h64⤵PID:4008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h64⤵PID:3812
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259510252.bat62⤵PID:944
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h63⤵PID:3348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h63⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h63⤵PID:2032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h63⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h63⤵PID:3264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h63⤵PID:3612
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259509909.bat61⤵PID:4040
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h62⤵PID:1128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h62⤵PID:528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h62⤵PID:4016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h62⤵PID:3112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h62⤵PID:3592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h62⤵PID:3764
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259509815.bat60⤵PID:3916
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h61⤵PID:3272
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h61⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h61⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h61⤵PID:4084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h61⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h61⤵PID:3992
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259509535.bat59⤵PID:3712
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h60⤵PID:2148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h60⤵PID:3992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h60⤵PID:3888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h60⤵PID:3332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h60⤵PID:3772
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259509269.bat58⤵PID:3468
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h59⤵PID:3676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h59⤵PID:3400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h59⤵PID:2032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h59⤵PID:3700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h59⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h59⤵PID:3220
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h59⤵PID:3360
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259508989.bat57⤵PID:3292
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h58⤵PID:3720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h58⤵PID:3380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h58⤵PID:1564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h58⤵PID:3956
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h58⤵PID:3764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h58⤵PID:3872
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259508879.bat56⤵PID:3200
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h57⤵PID:3540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h57⤵PID:3988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h57⤵PID:3132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h57⤵PID:3848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h57⤵PID:3940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h57⤵PID:3348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h57⤵PID:3696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h57⤵PID:3336
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259508614.bat55⤵PID:2488
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h56⤵PID:3332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h56⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h56⤵PID:4012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h56⤵PID:3320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h56⤵PID:3768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h56⤵PID:3268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h56⤵PID:3724
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259508474.bat54⤵PID:2876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h55⤵PID:3208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h55⤵PID:3872
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h55⤵PID:3412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h55⤵PID:3188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h55⤵PID:1592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h55⤵PID:3804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h55⤵PID:3232
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259508255.bat53⤵PID:2020
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h54⤵PID:1564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h54⤵PID:3516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h54⤵PID:2280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h54⤵PID:3824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h54⤵PID:3936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h54⤵PID:3540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h54⤵PID:3388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h54⤵PID:4016
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259508021.bat52⤵PID:2468
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h53⤵
- System Location Discovery: System Language Discovery
PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h53⤵PID:3380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h53⤵PID:2328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h53⤵PID:3972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h53⤵PID:3560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h53⤵PID:3836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h53⤵PID:3376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h53⤵PID:3768
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259507803.bat51⤵PID:1528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h52⤵PID:2504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h52⤵PID:3388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h52⤵PID:3996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h52⤵PID:3220
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h52⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h52⤵PID:3724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h52⤵PID:1804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h52⤵PID:2768
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259507741.bat50⤵PID:628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h51⤵PID:2432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h51⤵PID:3216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h51⤵PID:3972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h51⤵PID:3444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h51⤵PID:3552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h51⤵PID:3800
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h51⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h51⤵PID:3884
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259507585.bat49⤵PID:2512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h50⤵PID:896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h50⤵PID:1552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h50⤵
- Views/modifies file attributes
PID:3792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h50⤵PID:2432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h50⤵PID:3964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h50⤵PID:3648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h50⤵PID:3388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h50⤵
- Views/modifies file attributes
PID:3488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h50⤵PID:2088
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259507351.bat48⤵PID:904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h49⤵PID:1804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h49⤵PID:528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h49⤵PID:3612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h49⤵PID:3304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h49⤵PID:3816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h49⤵PID:4032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h49⤵PID:3632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h49⤵PID:3028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h49⤵PID:3924
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259507148.bat47⤵PID:2696
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h48⤵PID:2896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h48⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h48⤵PID:3284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h48⤵PID:1964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h48⤵PID:3748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h48⤵PID:4012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h48⤵PID:3668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h48⤵PID:3332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h48⤵PID:2036
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259507039.bat46⤵PID:1680
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:2620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:3248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:3784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:3452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:2896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:3976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:3344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:3896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h47⤵PID:3448
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259506836.bat45⤵PID:2452
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵PID:716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵PID:944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵
- Views/modifies file attributes
PID:1804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵PID:3668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵PID:716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵PID:3804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵PID:3536
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵PID:2432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h46⤵PID:3452
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259506617.bat44⤵PID:2376
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:2068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:3028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:3432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:3964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:3080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:3676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:3616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:3252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:3340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h45⤵PID:3152
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259506508.bat43⤵PID:924
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h44⤵PID:2896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h44⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h44⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h44⤵PID:3572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h44⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h44⤵PID:3996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h44⤵PID:3676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h44⤵PID:3608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h44⤵PID:1624
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259506368.bat42⤵PID:2704
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:1396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:3008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:2032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:3108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:3924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:3540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:2160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:3692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h43⤵PID:3536
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259506165.bat41⤵PID:2244
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:3164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:1396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:3520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:3476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:3576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:1552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h42⤵PID:3696
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259506040.bat40⤵PID:1132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:3020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:3032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:3580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:3172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:3736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:3288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵
- Drops file in System32 directory
PID:3544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:3372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h41⤵PID:3068
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259505900.bat39⤵PID:1448
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:2068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:2912
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:2916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:3148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:3596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵
- System Location Discovery: System Language Discovery
PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:3276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:3784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h40⤵PID:3736
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259505759.bat38⤵PID:592
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:1600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵
- System Location Discovery: System Language Discovery
PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:1708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:2348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:2432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:3932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:1552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:3796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:4020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:3560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h39⤵PID:3720
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259505525.bat37⤵PID:1868
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:1904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:2012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:1708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:3636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:2988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:3124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:4072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:3120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h38⤵PID:4068
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259505432.bat36⤵PID:1516
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:2512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:1908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:1076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:3008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:3532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:4048
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:3532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:3836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:3944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:3724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h37⤵PID:3248
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259505213.bat35⤵PID:2268
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:2912
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:1420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:1224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:1592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:3800
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:3244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:3164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵PID:3876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h36⤵
- Views/modifies file attributes
PID:3948
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259505073.bat34⤵PID:2264
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵
- Views/modifies file attributes
PID:1132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:2212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:3504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:3276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:3784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:3528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:3144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:3868
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h35⤵PID:3932
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504917.bat33⤵PID:1632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:2212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:2412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:2732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵
- Views/modifies file attributes
PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:1088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:3628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:1572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:3776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:3284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:1708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:1592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h34⤵PID:2328
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504792.bat32⤵PID:1772
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:2468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:2120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:2280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:1572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:3644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:3780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:3112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:4068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:3168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h33⤵PID:3636
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504730.bat31⤵PID:2904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:2328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:2488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵
- System Location Discovery: System Language Discovery
PID:964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:1700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:3132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:3848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:3340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:868
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h32⤵PID:1420
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504667.bat30⤵PID:2228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:1908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:2148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:1804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:2592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:2504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:3620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:3128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:4004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:3948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:3932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h31⤵PID:3508
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504527.bat29⤵PID:2092
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:1048
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:2144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:1224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:2896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:2732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:3728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:3692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:1572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:3272
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵PID:3828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h30⤵
- Views/modifies file attributes
PID:1408
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504418.bat28⤵PID:2748
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:1148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:2368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:2160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:3124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:3856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:3384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:3208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:3988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h29⤵PID:3784
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504355.bat27⤵PID:2400
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:2732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:868
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:1680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:1424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:2912
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:3604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:2732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:4052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:3508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:3452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:3544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h28⤵PID:1592
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504262.bat26⤵PID:2672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:1964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:2108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:2756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:2172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:2116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:1728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:3736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:3700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:1908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:3924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h27⤵PID:1088
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504075.bat25⤵PID:2140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:2988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:1456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:3316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:3880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:3424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:3252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:3268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:1076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h26⤵PID:3692
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259504012.bat24⤵PID:2104
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:2072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:2260
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:1564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:1728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:1528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:3140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:3940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:3504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:3356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:1128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵
- Views/modifies file attributes
PID:3984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h25⤵PID:3268
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503997.bat23⤵PID:2084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:1928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:1420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:2336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:1804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:2256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:1680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:2772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:1420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:1728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:3476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:2520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:3576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:3236
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:4008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:3736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h24⤵PID:4008
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503981.bat22⤵PID:2448
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:2516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:2848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:2012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:2424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:2012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:2480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:3028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:3816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:3288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:4068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:3216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:4056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h23⤵PID:3676
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503950.bat21⤵PID:2528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:2924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:1932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:2232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:2336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:2260
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:1604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:2772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵
- Views/modifies file attributes
PID:3364
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:3180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:3764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:3348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:3504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h22⤵PID:3076
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503934.bat20⤵PID:564
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:2428
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:2856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:2096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:2012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:3028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:2012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:1908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:3984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:3416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵
- System Location Discovery: System Language Discovery
PID:3448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:3400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h21⤵PID:2680
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503903.bat19⤵PID:2836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:2964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:1600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:2856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:2916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:1460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:2412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:1048
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:3492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:4056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:3388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:3828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h20⤵PID:3804
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503903.bat18⤵PID:2948
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:2096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵
- Drops file in System32 directory
PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:2884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:2960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:2788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:2488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:2096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:1908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:2788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:3652
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:3464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:3156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:3764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:3948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h19⤵PID:3512
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503872.bat17⤵PID:2992
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:1400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:2844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:2280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:2708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:3752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:3684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:3256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:3788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h18⤵PID:3824
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503856.bat16⤵PID:1944
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:2960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:1908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:1572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:2896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:2620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:2512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:1708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:3412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:1588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:4028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:2988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:1408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h17⤵PID:3820
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503825.bat15⤵PID:2800
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:2468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:1128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:2696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:1420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵
- Drops file in System32 directory
PID:1012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:2260
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:2032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:3596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:3980
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:3144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:3872
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:3608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:3720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h16⤵PID:3452
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503809.bat14⤵PID:1916
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:2176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵
- Drops file in System32 directory
PID:3008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:2280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:2108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:2812
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:3116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:3808
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:3240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:3960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵
- System Location Discovery: System Language Discovery
PID:3884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:2620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h15⤵PID:3560
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503778.bat13⤵PID:2168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:3020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:2116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:2204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:3588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:4004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:3492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:2280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:3552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:3980
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h14⤵PID:3848
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503747.bat12⤵PID:2284
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵
- Drops file in System32 directory
PID:1100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:2832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:1408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:2356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:2844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:1528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:2148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:2208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:3224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵
- System Location Discovery: System Language Discovery
PID:3824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:3484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:3784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:3676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h13⤵PID:3760
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503731.bat11⤵PID:1644
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:3660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:2120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:3932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:3656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:3356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:3480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h12⤵PID:4072
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503669.bat10⤵PID:1612
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:2896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:2112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:2880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:1396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:2148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:3424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:3256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:3196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:3952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:3644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h11⤵PID:3632
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503638.bat9⤵PID:1144
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:2772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:2788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:1968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:1128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:2244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:2376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:3008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:2912
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:2732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:3156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:4072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:3636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:3120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:3756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:3148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h10⤵PID:4032
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503607.bat8⤵PID:2872
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:2404
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:1812
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:1592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:1852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:1592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:2480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:2916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:2428
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:3484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:4064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:3608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:3028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:3852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:3368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h9⤵PID:3928
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503575.bat7⤵PID:2136
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵
- System Location Discovery: System Language Discovery
PID:2468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:1528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:2232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:1668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:2848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:2844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:1564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:3348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:3188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:2204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:3132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:2160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵PID:3280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h8⤵
- Views/modifies file attributes
PID:3576
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503560.bat6⤵PID:1340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:1728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:1088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:2268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:2428
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:2760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:2520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:3340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:3100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:3384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:3180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h7⤵PID:3944
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503513.bat5⤵PID:2816
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:2068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:2248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:2376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:1632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:3000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:1012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:2232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:1604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:868
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:3760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:3152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:3368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:3996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:3988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h6⤵PID:2988
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503482.bat4⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:2424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:2916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:1420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:3012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:2228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:3060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:1012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:2696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵
- Drops file in System32 directory
PID:332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:1076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:1852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:2848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:3372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:2144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:3668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:3500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:3140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h5⤵PID:2348
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503466.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:272
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:1708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:1396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:3744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:3316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:4072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:4048
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MMDXYBQE1035.exe" -r -a -s -h4⤵PID:2144
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\dbd6d2d8314b259503419.bat2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\a87579d691aad2f371bbae09006099b7_JaffaCakes118.exe" -r -a -s -h3⤵PID:2256
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1211741669-1211732552-399360012-102696358219632477262064380742-2089328009527998711"1⤵PID:2176
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-131357092-459724282-1393272949-2147368078458547380-2093095062748469940843605237"1⤵PID:1928
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "11134761411551893237-66369789194435304010713743591633770559-1964539913-1460433825"1⤵PID:2392
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-8905982202055108894502000099-1150547153-212921136415620647691124555676495884682"1⤵PID:1952
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-16759611031489536815-7760928745558368151721089597-1133492981538253650-94471740"1⤵PID:1968
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-421246597408742061-876856100-1671641909542115366-1191050783-604955002-215191956"1⤵PID:1400
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1314252876-247873013-808971467-1072952967-30066367619007816491758155642-1921879400"1⤵PID:2368
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "4816859591514966473-1165273637-637874429-16917418098286336301778124262-1393649848"1⤵PID:2336
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1966337489-1390649183926375237482574154911372529-1343637714-14772763561298085091"1⤵PID:2812
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "21273125383407603031742772432-4819906691494958811542210633-1584015898719196000"1⤵PID:2760
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "16024734732102120645464711287524920140686552788-1950958670-342241637-366705537"1⤵PID:2884
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1622589465-19579309341830920642156125896-611555520846434353-1478184344481098137"1⤵PID:1460
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-762041360-1454862972-318821106-2129324477-1185985586-1695177354-1331363854968971065"1⤵PID:1424
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-739309223-888881276222647266-497873950-19772757161567742471-880085525110519671"1⤵PID:2880
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-10144209231234083538-1107516154-1748162162-975234983-357098663-18696389411870984079"1⤵PID:964
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1735270382-663295187-568361224-20091879595426953711672122402-203605604780513754"1⤵PID:776
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "77950140-2063398791-510580282369952332-16532916711186930635-18576786361393275664"1⤵PID:2232
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "533615592879404224527166999-17396351671578836840-20261820061195052246-610229302"1⤵PID:2428
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-731079442-1726998122-2120586651863548473-1763244871-15446369111506497088-547091375"1⤵PID:2864
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-136433574012730037245269508181938824167678956668780526242-1849334698667618338"1⤵PID:2540
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-51808367-1047070616-204422819-257595954-2027756389-2347427641667524900-1226335970"1⤵PID:2260
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "184443766491460142-1702760674-1118678842406460023-1677727451-1604896423-425038654"1⤵PID:864
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "38493140821110218462009688638-1253590064-17753909571905757087409281910609986"1⤵PID:2772
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-6638504871541135213-1418905578119536852548213832113149865861459067050767250454"1⤵PID:3660
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "8746359611693784393-20082830911677635496247304324-16454832461731832023-1328257227"1⤵PID:3728
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-19303984581517768342-820676133-626364290700299378-1939846134-15595447-1419855439"1⤵PID:2928
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-105006945514093667906850268311138973142-1080677626-1672773251339791204-1931582410"1⤵PID:2148
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-929126308-20770698772133381104-375319448-89208210560218144511915760951728608963"1⤵PID:3240
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1550912973-314717026-7233729901328549707-64143011320541571331314446927376998700"1⤵PID:3684
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1530666390-59951046-1026541541-716936825-787296814-1744208628200237863-1427208336"1⤵PID:3620
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1812362452485579833-180250402314922228011084730702-16437185516758331841847315754"1⤵PID:3744
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "16303117161893164990-1775502494-1413850421859591264-1197079880-857462135-910079887"1⤵PID:3164
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1454418941412445343-1002144111125990535518708216151950522543449230023-501824577"1⤵PID:3080
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-7731440684500961952144134130379759663-879000175-112753884114729978511305503178"1⤵PID:2520
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "113430607365857236010357222341448786637832261660-16406589091795659656-709900429"1⤵PID:3492
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1471815412-1680620604-145292078617709721821299423991321634246649349641-1275492661"1⤵PID:3800
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1177959907-1982966328-976888531-1043410754891413123792615712-14620084331976693"1⤵PID:1728
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1939803011-79447836112610488551785890444-587239234-696134119-787982578-1050532011"1⤵PID:3936
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "720568160-1691767208-28164744993924419105566806-1591840877659102903-1997507167"1⤵PID:3700
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-790178359-13395958493252989-1186691771649338468510321850-210186437142463945"1⤵PID:528
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "552402935-400552757948908697-12549364218633464171971831035-516440978-1810713744"1⤵PID:3120
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1427108913404611506212115253-18578791251684609951817997467-1965314645159443377"1⤵PID:3796
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1871865407959870629435102540100756521-62762007992409015887887191515432318"1⤵PID:1396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5a87579d691aad2f371bbae09006099b7
SHA1b596e2494c0991f62ac9b5fd0a624dfdb60ce7e8
SHA256b5241ab14857b6b8827ebe8bbc18308503863ec9c35e4c2f6b8dd0fec18ddfd5
SHA512953f966b64ef45d37227f34206b94e1ab1aed58c970c400767b74b492c77a7503752eebd2edf7d1ccf1f54ef07cc8a075f1b0568fdf3945b4892c183da5be333
-
Filesize
2KB
MD546a7cb9571100bfbec848e6d289f9174
SHA1fffef2d698043d8dd6138afd36a796dbb2e2dfbf
SHA256272512764728b84ae86bba6046cefeba3cfe250639a4159fb3ab520b988c1b50
SHA5121d9b45b83c6e25f448b53c8a6dbcd4468f9685508f4f4209c3de53891ca656aebc394707fc99309d22ebc181c36351f4a9ffca48191960f92d6ca4820862eee5
-
Filesize
333B
MD531dfb2f74a00958698e42ddbf423b5d5
SHA15529657ea117e7ff5f3d5b8769fe704bb40a2826
SHA256de164546ddc393c1e9024c9a7f2ca01dfbe7aab77c38f206d1f12bcd9d446015
SHA51236d820ce89694c47f51989e72e54afddd69613744b09da88840b4deb5edb9470ebea1e847c41616b07c9e03ab10f8b51ff563325612af0eafb68745366315ee3
-
Filesize
189B
MD5f9509238235dcfc6dee3916688497482
SHA14f62516c7288b3d25d407b668d06e2089e93deaf
SHA256970e9d17907ca86ef10b1508cee23728f03ab1ae7efecd895e29ed91502830f8
SHA5127c6c9239a6466fbe954b65a541d5985ede975f50e05e647f8487e5728c14559eada951afeed3b97b97c24fef25236a1e2a2ae94e7e83df022b45e631bc301f59