074380e0eca6ab929c6cad3e0dfba8bce2b46e55026bb1f539b11eefc1fa0a80

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nomorebeasty.rar
Size 116KB
Sample260810-1fxwmstybs
SHA256 074380e0eca6ab929c6cad3e0dfba8bce2b46e55026bb1f539b11eefc1fa0a80
MD5 1bedde98c9bab77b36f1c79f820eaaae
SHA1 a1ffef65db5ff5c07a7770fdd0e2c995e0bfcf0c
SHA512 2316cdc5e8de9dad25b732dd4dfcebe5f1a1639779c3fe731c2213a89553307c9988135c086fcb3c774c30d237c112122c67e9ad09dd765eee4988e790232ad7
SSDEEP 3072:W9A9+C1XEQgtevc/YPKIHQxnJrSJVvGsT7ub7cnXFPNBw:W9aPKtegYPKIHQxnJSLvGsTeQXFVBw
TLSH
T165C3128D996F2FD370037A880591482F35A1E926B13504489FB1CACE7FFD8AD997E790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1156	netsh.exe
1616	netsh.exe
3688	netsh.exe
2212	netsh.exe

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4472	attrib.exe
4780	attrib.exe
4788	attrib.exe
4508	attrib.exe
4832	attrib.exe
4284	attrib.exe
4776	attrib.exe
456	attrib.exe
4440	attrib.exe
604	attrib.exe
2044	attrib.exe
4272	attrib.exe
3688	attrib.exe
3480	attrib.exe
548	attrib.exe
892	attrib.exe
4380	attrib.exe
1044	attrib.exe
4220	attrib.exe
1776	attrib.exe
412	attrib.exe
4780	attrib.exe
1204	attrib.exe
4348	attrib.exe
2380	attrib.exe
872	attrib.exe
3724	attrib.exe
4020	attrib.exe
4692	attrib.exe
4776	attrib.exe
2272	attrib.exe
3336	attrib.exe
4012	attrib.exe
3360	attrib.exe
2712	attrib.exe
3160	attrib.exe
4780	attrib.exe
2900	attrib.exe
3700	attrib.exe
552	attrib.exe
3708	attrib.exe
1812	attrib.exe
4432	attrib.exe
4588	attrib.exe
4928	attrib.exe
2528	attrib.exe
1204	attrib.exe
4928	attrib.exe
396	attrib.exe
3360	attrib.exe
1584	attrib.exe
3784	attrib.exe
1776	attrib.exe
1764	attrib.exe
3656	attrib.exe
1592	attrib.exe
4672	attrib.exe
1776	attrib.exe
4788	attrib.exe
1232	attrib.exe
4236	attrib.exe
3648	attrib.exe
3684	attrib.exe
4056	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	BRO Blocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1792	BRO Blocker.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WF.msc	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4408	cmd.exe
3264	cmd.exe
1776	cmd.exe
1548	cmd.exe
2400	cmd.exe
1404	cmd.exe
3608	cmd.exe
1232	cmd.exe
1588	cmd.exe
3312	cmd.exe
4312	cmd.exe
1812	cmd.exe
4652	cmd.exe
2228	cmd.exe
1904	cmd.exe
952	cmd.exe
3648	cmd.exe
4152	cmd.exe
4072	cmd.exe
4576	cmd.exe
4336	cmd.exe
1748	cmd.exe
1372	cmd.exe
4840	cmd.exe
4860	cmd.exe
3404	cmd.exe
752	cmd.exe
1872	cmd.exe
3304	cmd.exe
1952	cmd.exe
3468	cmd.exe
1748	cmd.exe
4552	cmd.exe
3484	cmd.exe
3896	cmd.exe
4936	cmd.exe
2144	cmd.exe
2824	cmd.exe
1444	cmd.exe
1116	cmd.exe
380	cmd.exe
936	cmd.exe
988	cmd.exe
4172	cmd.exe
4920	cmd.exe
1456	cmd.exe
364	cmd.exe
3480	cmd.exe
1392	cmd.exe
5020	cmd.exe
3472	cmd.exe
1904	cmd.exe
1212	cmd.exe
1112	cmd.exe
4836	cmd.exe
540	cmd.exe
4776	cmd.exe
4268	cmd.exe
416	cmd.exe
636	cmd.exe
4780	cmd.exe
4768	cmd.exe
4384	cmd.exe
1896	cmd.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
4284	taskkill.exe
4408	taskkill.exe
752	taskkill.exe
4872	taskkill.exe
2228	taskkill.exe
3944	taskkill.exe
4632	taskkill.exe
4612	taskkill.exe
364	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	BRO Blocker.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4616	7zFM.exe
4616	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4616	7zFM.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeRestorePrivilege	4616	7zFM.exe
Token: 35	4616	7zFM.exe
Token: SeSecurityPrivilege	4616	7zFM.exe
Token: SeSecurityPrivilege	4616	7zFM.exe
Token: SeSecurityPrivilege	4616	7zFM.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	4612	taskkill.exe
Token: SeDebugPrivilege	364	taskkill.exe
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	3944	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe
Token: 33	3784	mmc.exe
Token: SeIncBasePriorityPrivilege	3784	mmc.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4616	7zFM.exe
4616	7zFM.exe
4616	7zFM.exe
4616	7zFM.exe
4616	7zFM.exe
4616	7zFM.exe
4616	7zFM.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3784	mmc.exe
3784	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1792	4616	7zFM.exe	100
PID 1792 wrote to memory of 2672	1792	BRO Blocker.exe	103
PID 2672 wrote to memory of 2680	2672	cmd.exe	104
PID 1792 wrote to memory of 1712	1792	BRO Blocker.exe	105
PID 1792 wrote to memory of 4948	1792	BRO Blocker.exe	106
PID 4948 wrote to memory of 4012	4948	cmd.exe	107
PID 1792 wrote to memory of 3400	1792	BRO Blocker.exe	108
PID 1792 wrote to memory of 2804	1792	BRO Blocker.exe	109
PID 2804 wrote to memory of 3696	2804	cmd.exe	110
PID 1792 wrote to memory of 3140	1792	BRO Blocker.exe	111
PID 1792 wrote to memory of 2940	1792	BRO Blocker.exe	112
PID 2940 wrote to memory of 3380	2940	cmd.exe	113
PID 1792 wrote to memory of 1776	1792	BRO Blocker.exe	114
PID 1792 wrote to memory of 1056	1792	BRO Blocker.exe	115
PID 1056 wrote to memory of 1764	1056	cmd.exe	116
PID 1792 wrote to memory of 3440	1792	BRO Blocker.exe	117
PID 1792 wrote to memory of 2824	1792	BRO Blocker.exe	118
PID 2824 wrote to memory of 5080	2824	cmd.exe	119
PID 1792 wrote to memory of 3268	1792	BRO Blocker.exe	120
PID 1792 wrote to memory of 736	1792	BRO Blocker.exe	121
PID 736 wrote to memory of 2356	736	cmd.exe	122
PID 1792 wrote to memory of 3992	1792	BRO Blocker.exe	123
PID 1792 wrote to memory of 1156	1792	BRO Blocker.exe	124
PID 1792 wrote to memory of 1616	1792	BRO Blocker.exe	126
PID 1792 wrote to memory of 3688	1792	BRO Blocker.exe	128
PID 1792 wrote to memory of 2212	1792	BRO Blocker.exe	130
PID 1792 wrote to memory of 4992	1792	BRO Blocker.exe	132
PID 4992 wrote to memory of 752	4992	cmd.exe	133
PID 1792 wrote to memory of 4828	1792	BRO Blocker.exe	134
PID 4828 wrote to memory of 4612	4828	cmd.exe	135
PID 1792 wrote to memory of 4880	1792	BRO Blocker.exe	136
PID 4880 wrote to memory of 364	4880	cmd.exe	137
PID 1792 wrote to memory of 4268	1792	BRO Blocker.exe	138
PID 4268 wrote to memory of 4872	4268	cmd.exe	139
PID 1792 wrote to memory of 2404	1792	BRO Blocker.exe	140
PID 2404 wrote to memory of 2228	2404	cmd.exe	141
PID 1792 wrote to memory of 3196	1792	BRO Blocker.exe	142
PID 3196 wrote to memory of 4284	3196	cmd.exe	143
PID 1792 wrote to memory of 4620	1792	BRO Blocker.exe	144
PID 4620 wrote to memory of 3944	4620	cmd.exe	145
PID 1792 wrote to memory of 1160	1792	BRO Blocker.exe	146
PID 1160 wrote to memory of 4408	1160	cmd.exe	147
PID 1792 wrote to memory of 3372	1792	BRO Blocker.exe	148
PID 3372 wrote to memory of 4632	3372	cmd.exe	149
PID 1792 wrote to memory of 3432	1792	BRO Blocker.exe	150
PID 1792 wrote to memory of 1744	1792	BRO Blocker.exe	151
PID 1792 wrote to memory of 4688	1792	BRO Blocker.exe	152
PID 1792 wrote to memory of 3964	1792	BRO Blocker.exe	153
PID 1792 wrote to memory of 2900	1792	BRO Blocker.exe	154
PID 1792 wrote to memory of 3700	1792	BRO Blocker.exe	155
PID 1792 wrote to memory of 1516	1792	BRO Blocker.exe	156
PID 1792 wrote to memory of 4552	1792	BRO Blocker.exe	157
PID 1792 wrote to memory of 4044	1792	BRO Blocker.exe	158
PID 1792 wrote to memory of 412	1792	BRO Blocker.exe	159
PID 1792 wrote to memory of 4788	1792	BRO Blocker.exe	160
PID 1792 wrote to memory of 2312	1792	BRO Blocker.exe	161
PID 1792 wrote to memory of 2500	1792	BRO Blocker.exe	162
PID 1792 wrote to memory of 1852	1792	BRO Blocker.exe	163
PID 1792 wrote to memory of 4572	1792	BRO Blocker.exe	164
PID 1792 wrote to memory of 2680	1792	BRO Blocker.exe	165
PID 1792 wrote to memory of 540	1792	BRO Blocker.exe	166
PID 1792 wrote to memory of 1712	1792	BRO Blocker.exe	167
PID 1792 wrote to memory of 4012	1792	BRO Blocker.exe	168
PID 1792 wrote to memory of 1928	1792	BRO Blocker.exe	169

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
552	attrib.exe
1044	attrib.exe
3380	attrib.exe
2588	attrib.exe
4472	attrib.exe
4780	attrib.exe
456	attrib.exe
4676	attrib.exe
2380	attrib.exe
2044	attrib.exe
4744	attrib.exe
3472	attrib.exe
1020	attrib.exe
2044	attrib.exe
1232	attrib.exe
2988	attrib.exe
1516	attrib.exe
1744	attrib.exe
4080	attrib.exe
4640	attrib.exe
1212	attrib.exe
4220	attrib.exe
3708	attrib.exe
1640	attrib.exe
4624	attrib.exe
4832	attrib.exe
1392	attrib.exe
2528	attrib.exe
4552	attrib.exe
4988	attrib.exe
1204	attrib.exe
3336	attrib.exe
4388	attrib.exe
4052	attrib.exe
4180	attrib.exe
3656	attrib.exe
4776	attrib.exe
4840	attrib.exe
4780	attrib.exe
4432	attrib.exe
4588	attrib.exe
2272	attrib.exe
720	attrib.exe
4280	attrib.exe
4380	attrib.exe
4672	attrib.exe
3688	attrib.exe
1776	attrib.exe
4692	attrib.exe
1764	attrib.exe
4680	attrib.exe
4748	attrib.exe
4640	attrib.exe
3724	attrib.exe
1204	attrib.exe
2380	attrib.exe
2284	attrib.exe
3292	attrib.exe
2588	attrib.exe
1812	attrib.exe
4236	attrib.exe
4012	attrib.exe
3160	attrib.exe
4172	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\nomorebeasty.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\7zO8028B4E8\BRO Blocker.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8028B4E8\BRO Blocker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\system32\findstr.exe
      findstr /c:"vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.0.0.0 vcc-library.uk >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"www.vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\findstr.exe
      findstr /c:"www.vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.0.0.0 www.vcc-library.uk >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"api.vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\findstr.exe
      findstr /c:"api.vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.0.0.0 api.vcc-library.uk >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"cdn.vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\system32\findstr.exe
      findstr /c:"cdn.vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.0.0.0 cdn.vcc-library.uk >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"bk.vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\system32\findstr.exe
      findstr /c:"bk.vcc-library.uk" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.0.0.0 bk.vcc-library.uk >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"vcc-library.com" "C:\Windows\system32\drivers\etc\hosts" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\system32\findstr.exe
      findstr /c:"vcc-library.com" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.0.0.0 vcc-library.com >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"vcc-library.ru" "C:\Windows\system32\drivers\etc\hosts" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\system32\findstr.exe
      findstr /c:"vcc-library.ru" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.0.0.0 vcc-library.ru >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    PID:3992
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="BRO_BLOCK_PS" dir=out program="%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" action=block enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1156
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="BRO_BLOCK_PS32" dir=out program="%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" action=block enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1616
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="BRO_BLOCK_CMD" dir=out program="%SystemRoot%\System32\cmd.exe" action=block enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3688
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="BRO_BLOCK_DOMAIN" dir=out remoteip=185.230.63.107,185.230.63.171,185.230.63.186 action=block enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im BK* 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im BK*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im BX* 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im BX*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im BY* 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im BY*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ox_* 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ox_*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im tx* 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im tx*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im thinkin* 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im thinkin*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im thinking.exe 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im thinking.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Retev.php 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Retev.php
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Retev[1].htm 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Retev[1].htm
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\BK*" 2>nul
    3⤵
    PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\BX*" 2>nul
    3⤵
    PID:1744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\BY*" 2>nul
    3⤵
    PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\ox_*" 2>nul
    3⤵
    PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\tx*" 2>nul
    3⤵
    PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\thinkin*" 2>nul
    3⤵
    PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\thinking.exe" 2>nul
    3⤵
    PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\Retev.php" 2>nul
    3⤵
    PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\Retev[1].htm" 2>nul
    3⤵
    PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\Retev.htm" 2>nul
    3⤵
    PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\BY9B5.exe" 2>nul
    3⤵
    PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\????????-????-????-????-????????????.exe" 2>nul
    3⤵
    PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\[Bb][Kk]*" 2>nul
    3⤵
    PID:2500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\[Bb][Xx]*" 2>nul
    3⤵
    PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\[Bb][Yy]*" 2>nul
    3⤵
    PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%TEMP%\[Oo][Xx]_*" 2>nul
    3⤵
    PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\BK*" 2>nul
    3⤵
    PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\BX*" 2>nul
    3⤵
    PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\BY*" 2>nul
    3⤵
    PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\ox_*" 2>nul
    3⤵
    PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\tx*" 2>nul
    3⤵
    PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\thinkin*" 2>nul
    3⤵
    PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\thinking.exe" 2>nul
    3⤵
    PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\Retev.php" 2>nul
    3⤵
    PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\Retev[1].htm" 2>nul
    3⤵
    PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\Retev.htm" 2>nul
    3⤵
    PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\BY9B5.exe" 2>nul
    3⤵
    PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\????????-????-????-????-????????????.exe" 2>nul
    3⤵
    PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\[Bb][Kk]*" 2>nul
    3⤵
    PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\[Bb][Xx]*" 2>nul
    3⤵
    PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\[Bb][Yy]*" 2>nul
    3⤵
    PID:892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%APPDATA%\[Oo][Xx]_*" 2>nul
    3⤵
    PID:604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\BK*" 2>nul
    3⤵
    PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\BX*" 2>nul
    3⤵
    PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\BY*" 2>nul
    3⤵
    PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\ox_*" 2>nul
    3⤵
    PID:872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\tx*" 2>nul
    3⤵
    PID:744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\thinkin*" 2>nul
    3⤵
    PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\thinking.exe" 2>nul
    3⤵
    PID:4008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\Retev.php" 2>nul
    3⤵
    PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\Retev[1].htm" 2>nul
    3⤵
    PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\Retev.htm" 2>nul
    3⤵
    PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\BY9B5.exe" 2>nul
    3⤵
    PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\????????-????-????-????-????????????.exe" 2>nul
    3⤵
    PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\[Bb][Kk]*" 2>nul
    3⤵
    PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\[Bb][Xx]*" 2>nul
    3⤵
    PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\[Bb][Yy]*" 2>nul
    3⤵
    PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%LOCALAPPDATA%\[Oo][Xx]_*" 2>nul
    3⤵
    PID:4692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\BK*" 2>nul
    3⤵
    PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\BX*" 2>nul
    3⤵
    PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\BY*" 2>nul
    3⤵
    PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\ox_*" 2>nul
    3⤵
    PID:3332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\tx*" 2>nul
    3⤵
    PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\thinkin*" 2>nul
    3⤵
    PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\thinking.exe" 2>nul
    3⤵
    PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\Retev.php" 2>nul
    3⤵
    PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\Retev[1].htm" 2>nul
    3⤵
    PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\Retev.htm" 2>nul
    3⤵
    PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\BY9B5.exe" 2>nul
    3⤵
    PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\????????-????-????-????-????????????.exe" 2>nul
    3⤵
    PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\[Bb][Kk]*" 2>nul
    3⤵
    PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\[Bb][Xx]*" 2>nul
    3⤵
    PID:456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\[Bb][Yy]*" 2>nul
    3⤵
    PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q "%ProgramData%\[Oo][Xx]_*" 2>nul
    3⤵
    PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK101562" 2>nul >nul
    3⤵
    PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK101562" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4384
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK101562"
      4⤵
      PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK998736" 2>nul >nul
    3⤵
    PID:4052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK998736" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4312
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK998736"
      4⤵
      Views/modifies file attributes
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK107811" 2>nul >nul
    3⤵
    PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK107811" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3404
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK107811"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK674644" 2>nul >nul
    3⤵
    PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK674644" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1548
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK674644"
      4⤵
      Views/modifies file attributes
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK288475" 2>nul >nul
    3⤵
    PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK288475" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1456
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK288475"
      4⤵
      Sets file to hidden
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK620622" 2>nul >nul
    3⤵
    PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK620622" 2>nul
    3⤵
    PID:4400
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK620622"
      4⤵
      Views/modifies file attributes
      PID:1020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK837664" 2>nul >nul
    3⤵
    PID:1744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK837664" 2>nul
    3⤵
    PID:4688
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK837664"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK529808" 2>nul >nul
    3⤵
    PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK529808" 2>nul
    3⤵
    PID:3328
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK529808"
      4⤵
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK984756" 2>nul >nul
    3⤵
    PID:1168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK984756" 2>nul
    3⤵
    PID:4292
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK984756"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK220308" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK220308" 2>nul
    3⤵
    PID:4812
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK220308"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK416202" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK416202" 2>nul
    3⤵
    PID:4736
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK416202"
      4⤵
      Sets file to hidden
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK574164" 2>nul >nul
    3⤵
    PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK574164" 2>nul
    3⤵
    PID:3340
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK574164"
      4⤵
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK597209" 2>nul >nul
    3⤵
    PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK597209" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4652
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK597209"
      4⤵
      PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK990651" 2>nul >nul
    3⤵
    PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK990651" 2>nul
    3⤵
    PID:2664
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK990651"
      4⤵
      Sets file to hidden
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK806030" 2>nul >nul
    3⤵
    PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK806030" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:380
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK806030"
      4⤵
      Sets file to hidden
      PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK525291" 2>nul >nul
    3⤵
    PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK525291" 2>nul
    3⤵
    PID:3348
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK525291"
      4⤵
      PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK574164" 2>nul >nul
    3⤵
    PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK574164" 2>nul
    3⤵
    PID:5080
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK574164"
      4⤵
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK773108" 2>nul >nul
    3⤵
    PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK773108" 2>nul
    3⤵
    PID:1980
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK773108"
      4⤵
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK126935" 2>nul >nul
    3⤵
    PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK126935" 2>nul
    3⤵
    PID:3516
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK126935"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK815134" 2>nul >nul
    3⤵
    PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK815134" 2>nul
    3⤵
    PID:3200
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK815134"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK596111" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK596111" 2>nul
    3⤵
    PID:4824
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK596111"
      4⤵
      PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK589793" 2>nul >nul
    3⤵
    PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK589793" 2>nul
    3⤵
    PID:4256
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK589793"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK185441" 2>nul >nul
    3⤵
    PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK185441" 2>nul
    3⤵
    PID:4228
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK185441"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK491528" 2>nul >nul
    3⤵
    PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK491528" 2>nul
    3⤵
    PID:2212
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK491528"
      4⤵
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK270615" 2>nul >nul
    3⤵
    PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK270615" 2>nul
    3⤵
    PID:5032
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK270615"
      4⤵
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK815910" 2>nul >nul
    3⤵
    PID:4676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK815910" 2>nul
    3⤵
    PID:1332
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK815910"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK107811" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK107811" 2>nul
    3⤵
    PID:1496
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK107811"
      4⤵
      PID:3756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK126935" 2>nul >nul
    3⤵
    PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK126935" 2>nul
    3⤵
    PID:4404
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK126935"
      4⤵
      PID:1884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK328874" 2>nul >nul
    3⤵
    PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK328874" 2>nul
    3⤵
    PID:1816
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK328874"
      4⤵
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK713166" 2>nul >nul
    3⤵
    PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK713166" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:936
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK713166"
      4⤵
      PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK291787" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK291787" 2>nul
    3⤵
    PID:4324
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK291787"
      4⤵
      PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK815134" 2>nul >nul
    3⤵
    PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK815134" 2>nul
    3⤵
    PID:4980
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK815134"
      4⤵
      Views/modifies file attributes
      PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK504603" 2>nul >nul
    3⤵
    PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK504603" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1112
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK504603"
      4⤵
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK407735" 2>nul >nul
    3⤵
    PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK407735" 2>nul
    3⤵
    PID:4664
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK407735"
      4⤵
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK231713" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK231713" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:416
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK231713"
      4⤵
      Sets file to hidden
      PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK241630" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK241630" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4072
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK241630"
      4⤵
      Sets file to hidden
      PID:3648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK416338" 2>nul >nul
    3⤵
    PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK416338" 2>nul
    3⤵
    PID:4156
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK416338"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK964563" 2>nul >nul
    3⤵
    PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK964563" 2>nul
    3⤵
    PID:648
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK964563"
      4⤵
      PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK793081" 2>nul >nul
    3⤵
    PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK793081" 2>nul
    3⤵
    PID:1604
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK793081"
      4⤵
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BK829873" 2>nul >nul
    3⤵
    PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BK829873" 2>nul
    3⤵
    PID:4868
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BK829873"
      4⤵
      PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\BY9B5" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\BY9B5" 2>nul
    3⤵
    PID:2316
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\BY9B5"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\thinking" 2>nul >nul
    3⤵
    PID:1644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\thinking" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4860
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\thinking"
      4⤵
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\Retev" 2>nul >nul
    3⤵
    PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\Retev" 2>nul
    3⤵
    PID:684
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\Retev"
      4⤵
      Sets file to hidden
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\????????-????-????-????-????????????" 2>nul >nul
    3⤵
    PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%TEMP%\????????-????-????-????-????????????" 2>nul
    3⤵
    PID:744
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\????????-????-????-????-????????????"
      4⤵
      PID:4008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK101562" 2>nul >nul
    3⤵
    PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK101562" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3484
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK101562"
      4⤵
      PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK998736" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK998736" 2>nul
    3⤵
    PID:2400
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK998736"
      4⤵
      Sets file to hidden
      PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK107811" 2>nul >nul
    3⤵
    PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK107811" 2>nul
    3⤵
    PID:2624
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK107811"
      4⤵
      Views/modifies file attributes
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK674644" 2>nul >nul
    3⤵
    PID:2328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK674644" 2>nul
    3⤵
    PID:4764
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK674644"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK288475" 2>nul >nul
    3⤵
    PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK288475" 2>nul
    3⤵
    PID:3660
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK288475"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK620622" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK620622" 2>nul
    3⤵
    PID:2168
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK620622"
      4⤵
      Views/modifies file attributes
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK837664" 2>nul >nul
    3⤵
    PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK837664" 2>nul
    3⤵
    PID:3544
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK837664"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK529808" 2>nul >nul
    3⤵
    PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK529808" 2>nul
    3⤵
    PID:816
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK529808"
      4⤵
      PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK984756" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:2228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK984756" 2>nul
    3⤵
    PID:2496
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK984756"
      4⤵
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK220308" 2>nul >nul
    3⤵
    PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK220308" 2>nul
    3⤵
    PID:4916
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK220308"
      4⤵
      PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK416202" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK416202" 2>nul
    3⤵
    PID:2280
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK416202"
      4⤵
      PID:60
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK574164" 2>nul >nul
    3⤵
    PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK574164" 2>nul
    3⤵
    PID:4348
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK574164"
      4⤵
      Sets file to hidden
      PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK597209" 2>nul >nul
    3⤵
    PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK597209" 2>nul
    3⤵
    PID:4504
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK597209"
      4⤵
      Sets file to hidden
      PID:1592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK990651" 2>nul >nul
    3⤵
    PID:1372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK990651" 2>nul
    3⤵
    PID:4844
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK990651"
      4⤵
      PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK806030" 2>nul >nul
    3⤵
    PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK806030" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1232
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK806030"
      4⤵
      Sets file to hidden
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK525291" 2>nul >nul
    3⤵
    PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK525291" 2>nul
    3⤵
    PID:2252
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK525291"
      4⤵
      PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK574164" 2>nul >nul
    3⤵
    PID:968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK574164" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:988
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK574164"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK773108" 2>nul >nul
    3⤵
    PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK773108" 2>nul
    3⤵
    PID:4884
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK773108"
      4⤵
      Views/modifies file attributes
      PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK126935" 2>nul >nul
    3⤵
    PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK126935" 2>nul
    3⤵
    PID:3644
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK126935"
      4⤵
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK815134" 2>nul >nul
    3⤵
    PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK815134" 2>nul
    3⤵
    PID:768
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK815134"
      4⤵
      Sets file to hidden
      PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK596111" 2>nul >nul
    3⤵
    PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK596111" 2>nul
    3⤵
    PID:1644
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK596111"
      4⤵
      Sets file to hidden
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK589793" 2>nul >nul
    3⤵
    PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK589793" 2>nul
    3⤵
    PID:4564
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK589793"
      4⤵
      Views/modifies file attributes
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK185441" 2>nul >nul
    3⤵
    PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK185441" 2>nul
    3⤵
    PID:3804
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK185441"
      4⤵
      Sets file to hidden
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK491528" 2>nul >nul
    3⤵
    PID:4684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK491528" 2>nul
    3⤵
    PID:3592
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK491528"
      4⤵
      Views/modifies file attributes
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK270615" 2>nul >nul
    3⤵
    PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK270615" 2>nul
    3⤵
    PID:1616
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK270615"
      4⤵
      Views/modifies file attributes
      PID:2988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK815910" 2>nul >nul
    3⤵
    PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK815910" 2>nul
    3⤵
    PID:4680
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK815910"
      4⤵
      PID:4008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK107811" 2>nul >nul
    3⤵
    PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK107811" 2>nul
    3⤵
    PID:4592
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK107811"
      4⤵
      PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK126935" 2>nul >nul
    3⤵
    PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK126935" 2>nul
    3⤵
    PID:392
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK126935"
      4⤵
      Views/modifies file attributes
      PID:4676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK328874" 2>nul >nul
    3⤵
    PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK328874" 2>nul
    3⤵
    PID:4820
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK328874"
      4⤵
      PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK713166" 2>nul >nul
    3⤵
    PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK713166" 2>nul
    3⤵
    PID:1844
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK713166"
      4⤵
      PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK291787" 2>nul >nul
    3⤵
    PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK291787" 2>nul
    3⤵
    PID:2228
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK291787"
      4⤵
      Views/modifies file attributes
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK815134" 2>nul >nul
    3⤵
    PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK815134" 2>nul
    3⤵
    PID:4244
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK815134"
      4⤵
      PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK504603" 2>nul >nul
    3⤵
    PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK504603" 2>nul
    3⤵
    PID:3792
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK504603"
      4⤵
      Views/modifies file attributes
      PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK407735" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK407735" 2>nul
    3⤵
    PID:1996
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK407735"
      4⤵
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK231713" 2>nul >nul
    3⤵
    PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK231713" 2>nul
    3⤵
    PID:1592
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK231713"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK241630" 2>nul >nul
    3⤵
    PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK241630" 2>nul
    3⤵
    PID:3588
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK241630"
      4⤵
      Views/modifies file attributes
      PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK416338" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK416338" 2>nul
    3⤵
    PID:1896
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK416338"
      4⤵
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK964563" 2>nul >nul
    3⤵
    PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK964563" 2>nul
    3⤵
    PID:2680
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK964563"
      4⤵
      Views/modifies file attributes
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK793081" 2>nul >nul
    3⤵
    PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK793081" 2>nul
    3⤵
    PID:4808
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK793081"
      4⤵
      PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BK829873" 2>nul >nul
    3⤵
    PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BK829873" 2>nul
    3⤵
    PID:1696
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BK829873"
      4⤵
      Sets file to hidden
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\BY9B5" 2>nul >nul
    3⤵
    PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\BY9B5" 2>nul
    3⤵
    PID:824
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\BY9B5"
      4⤵
      PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\thinking" 2>nul >nul
    3⤵
    PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\thinking" 2>nul
    3⤵
    PID:1724
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\thinking"
      4⤵
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\Retev" 2>nul >nul
    3⤵
    PID:604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\Retev" 2>nul
    3⤵
    PID:3268
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\Retev"
      4⤵
      Sets file to hidden
      PID:872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%APPDATA%\????????-????-????-????-????????????" 2>nul >nul
    3⤵
    PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%APPDATA%\????????-????-????-????-????????????" 2>nul
    3⤵
    PID:3992
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Roaming\????????-????-????-????-????????????"
      4⤵
      Sets file to hidden
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK101562" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK101562" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1872
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK101562"
      4⤵
      PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK998736" 2>nul >nul
    3⤵
    PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK998736" 2>nul
    3⤵
    PID:2988
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK998736"
      4⤵
      Sets file to hidden
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK107811" 2>nul >nul
    3⤵
    PID:2144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK107811" 2>nul
    3⤵
    PID:4972
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK107811"
      4⤵
      PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK674644" 2>nul >nul
    3⤵
    PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK674644" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4576
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK674644"
      4⤵
      Views/modifies file attributes
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK288475" 2>nul >nul
    3⤵
    PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK288475" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4336
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK288475"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK620622" 2>nul >nul
    3⤵
    PID:952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK620622" 2>nul
    3⤵
    PID:4104
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK620622"
      4⤵
      Sets file to hidden
      PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK837664" 2>nul >nul
    3⤵
    PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK837664" 2>nul
    3⤵
    PID:3064
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK837664"
      4⤵
      Views/modifies file attributes
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK529808" 2>nul >nul
    3⤵
    PID:312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK529808" 2>nul
    3⤵
    PID:2208
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK529808"
      4⤵
      Views/modifies file attributes
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK984756" 2>nul >nul
    3⤵
    PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK984756" 2>nul
    3⤵
    PID:3944
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK984756"
      4⤵
      Sets file to hidden
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK220308" 2>nul >nul
    3⤵
    PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK220308" 2>nul
    3⤵
    PID:1444
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK220308"
      4⤵
      Sets file to hidden
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK416202" 2>nul >nul
    3⤵
    PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK416202" 2>nul
    3⤵
    PID:1164
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK416202"
      4⤵
      Views/modifies file attributes
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK574164" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK574164" 2>nul
    3⤵
    PID:2108
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK574164"
      4⤵
      Views/modifies file attributes
      PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK597209" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK597209" 2>nul
    3⤵
    PID:4472
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK597209"
      4⤵
      Sets file to hidden
      PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK990651" 2>nul >nul
    3⤵
    PID:632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK990651" 2>nul
    3⤵
    PID:4572
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK990651"
      4⤵
      Views/modifies file attributes
      PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK806030" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK806030" 2>nul
    3⤵
    PID:2476
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK806030"
      4⤵
      Views/modifies file attributes
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK525291" 2>nul >nul
    3⤵
    PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK525291" 2>nul
    3⤵
    PID:3400
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK525291"
      4⤵
      Sets file to hidden
      PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK574164" 2>nul >nul
    3⤵
    PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK574164" 2>nul
    3⤵
    PID:3832
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK574164"
      4⤵
      Views/modifies file attributes
      PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK773108" 2>nul >nul
    3⤵
    PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK773108" 2>nul
    3⤵
    PID:1328
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK773108"
      4⤵
      Views/modifies file attributes
      PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK126935" 2>nul >nul
    3⤵
    PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK126935" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3312
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK126935"
      4⤵
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK815134" 2>nul >nul
    3⤵
    PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK815134" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4936
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK815134"
      4⤵
      Sets file to hidden
      PID:4020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK596111" 2>nul >nul
    3⤵
    PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK596111" 2>nul
    3⤵
    PID:2592
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK596111"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK589793" 2>nul >nul
    3⤵
    PID:888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK589793" 2>nul
    3⤵
    PID:4144
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK589793"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK185441" 2>nul >nul
    3⤵
    PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK185441" 2>nul
    3⤵
    PID:4988
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK185441"
      4⤵
      Views/modifies file attributes
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK491528" 2>nul >nul
    3⤵
    PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK491528" 2>nul
    3⤵
    PID:4204
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK491528"
      4⤵
      Views/modifies file attributes
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK270615" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK270615" 2>nul
    3⤵
    PID:4440
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK270615"
      4⤵
      Views/modifies file attributes
      PID:4052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK815910" 2>nul >nul
    3⤵
    PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK815910" 2>nul
    3⤵
    PID:3940
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK815910"
      4⤵
      Sets file to hidden
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK107811" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK107811" 2>nul
    3⤵
    PID:1248
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK107811"
      4⤵
      Views/modifies file attributes
      PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK126935" 2>nul >nul
    3⤵
    PID:60
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK126935" 2>nul
    3⤵
    PID:1992
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK126935"
      4⤵
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK328874" 2>nul >nul
    3⤵
    PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK328874" 2>nul
    3⤵
    PID:3164
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK328874"
      4⤵
      Sets file to hidden
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK713166" 2>nul >nul
    3⤵
    PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK713166" 2>nul
    3⤵
    PID:4044
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK713166"
      4⤵
      Sets file to hidden
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK291787" 2>nul >nul
    3⤵
    PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK291787" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3648
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK291787"
      4⤵
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK815134" 2>nul >nul
    3⤵
    PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK815134" 2>nul
    3⤵
    PID:536
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK815134"
      4⤵
      PID:632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK504603" 2>nul >nul
    3⤵
    PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK504603" 2>nul
    3⤵
    PID:1928
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK504603"
      4⤵
      Views/modifies file attributes
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK407735" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK407735" 2>nul
    3⤵
    PID:3140
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK407735"
      4⤵
      Sets file to hidden
      PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK231713" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK231713" 2>nul
    3⤵
    PID:4836
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK231713"
      4⤵
      Views/modifies file attributes
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK241630" 2>nul >nul
    3⤵
    PID:1300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK241630" 2>nul
    3⤵
    PID:720
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK241630"
      4⤵
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK416338" 2>nul >nul
    3⤵
    PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK416338" 2>nul
    3⤵
    PID:1648
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK416338"
      4⤵
      Sets file to hidden
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK964563" 2>nul >nul
    3⤵
    PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK964563" 2>nul
    3⤵
    PID:3492
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK964563"
      4⤵
      Sets file to hidden
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK793081" 2>nul >nul
    3⤵
    PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK793081" 2>nul
    3⤵
    PID:2268
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK793081"
      4⤵
      PID:4008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BK829873" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BK829873" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2144
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BK829873"
      4⤵
      Views/modifies file attributes
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\BY9B5" 2>nul >nul
    3⤵
    PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\BY9B5" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1952
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\BY9B5"
      4⤵
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\thinking" 2>nul >nul
    3⤵
    PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\thinking" 2>nul
    3⤵
    PID:3452
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\thinking"
      4⤵
      PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\Retev" 2>nul >nul
    3⤵
    PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\Retev" 2>nul
    3⤵
    PID:4640
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\Retev"
      4⤵
      PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%LOCALAPPDATA%\????????-????-????-????-????????????" 2>nul >nul
    3⤵
    PID:1884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%LOCALAPPDATA%\????????-????-????-????-????????????" 2>nul
    3⤵
    PID:3796
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\Users\Admin\AppData\Local\????????-????-????-????-????????????"
      4⤵
      PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK101562" 2>nul >nul
    3⤵
    PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK101562" 2>nul
    3⤵
    PID:60
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK101562"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK998736" 2>nul >nul
    3⤵
    PID:1020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK998736" 2>nul
    3⤵
    PID:3960
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK998736"
      4⤵
      Views/modifies file attributes
      PID:1744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK107811" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK107811" 2>nul
    3⤵
    PID:1404
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK107811"
      4⤵
      PID:2840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK674644" 2>nul >nul
    3⤵
    PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK674644" 2>nul
    3⤵
    PID:2412
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK674644"
      4⤵
      Sets file to hidden
      PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK288475" 2>nul >nul
    3⤵
    PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK288475" 2>nul
    3⤵
    PID:968
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK288475"
      4⤵
      Sets file to hidden
      PID:396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK620622" 2>nul >nul
    3⤵
    PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK620622" 2>nul
    3⤵
    PID:3808
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK620622"
      4⤵
      Views/modifies file attributes
      PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK837664" 2>nul >nul
    3⤵
    PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK837664" 2>nul
    3⤵
    PID:1640
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK837664"
      4⤵
      Views/modifies file attributes
      PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK529808" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK529808" 2>nul
    3⤵
    PID:1756
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK529808"
      4⤵
      Sets file to hidden
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK984756" 2>nul >nul
    3⤵
    PID:892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK984756" 2>nul
    3⤵
    PID:4356
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK984756"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK220308" 2>nul >nul
    3⤵
    PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK220308" 2>nul
    3⤵
    PID:4020
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK220308"
      4⤵
      PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK416202" 2>nul >nul
    3⤵
    PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK416202" 2>nul
    3⤵
    PID:3956
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK416202"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK574164" 2>nul >nul
    3⤵
    PID:724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK574164" 2>nul
    3⤵
    PID:4508
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK574164"
      4⤵
      Views/modifies file attributes
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK597209" 2>nul >nul
    3⤵
    PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK597209" 2>nul
    3⤵
    PID:456
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK597209"
      4⤵
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK990651" 2>nul >nul
    3⤵
    PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK990651" 2>nul
    3⤵
    PID:2004
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK990651"
      4⤵
      PID:888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK806030" 2>nul >nul
    3⤵
    PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK806030" 2>nul
    3⤵
    PID:2880
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK806030"
      4⤵
      PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK525291" 2>nul >nul
    3⤵
    PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK525291" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4408
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK525291"
      4⤵
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK574164" 2>nul >nul
    3⤵
    PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK574164" 2>nul
    3⤵
    PID:4032
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK574164"
      4⤵
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK773108" 2>nul >nul
    3⤵
    PID:1744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK773108" 2>nul
    3⤵
    PID:760
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK773108"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK126935" 2>nul >nul
    3⤵
    PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK126935" 2>nul
    3⤵
    PID:1852
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK126935"
      4⤵
      Views/modifies file attributes
      PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK815134" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK815134" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4152
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK815134"
      4⤵
      Views/modifies file attributes
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK596111" 2>nul >nul
    3⤵
    PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK596111" 2>nul
    3⤵
    PID:3696
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK596111"
      4⤵
      Sets file to hidden
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK589793" 2>nul >nul
    3⤵
    PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK589793" 2>nul
    3⤵
    PID:3304
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK589793"
      4⤵
      Sets file to hidden
      PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK185441" 2>nul >nul
    3⤵
    PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK185441" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3468
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK185441"
      4⤵
      Sets file to hidden
      PID:604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK491528" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK491528" 2>nul
    3⤵
    PID:4500
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK491528"
      4⤵
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK270615" 2>nul >nul
    3⤵
    PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK270615" 2>nul
    3⤵
    PID:4120
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK270615"
      4⤵
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK815910" 2>nul >nul
    3⤵
    PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK815910" 2>nul
    3⤵
    PID:3656
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK815910"
      4⤵
      Views/modifies file attributes
      PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK107811" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK107811" 2>nul
    3⤵
    PID:4236
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK107811"
      4⤵
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK126935" 2>nul >nul
    3⤵
    PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK126935" 2>nul
    3⤵
    PID:3884
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK126935"
      4⤵
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK328874" 2>nul >nul
    3⤵
    PID:3192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK328874" 2>nul
    3⤵
    PID:312
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK328874"
      4⤵
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK713166" 2>nul >nul
    3⤵
    PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK713166" 2>nul
    3⤵
    PID:3472
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK713166"
      4⤵
      Sets file to hidden
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK291787" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK291787" 2>nul
    3⤵
    PID:4852
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK291787"
      4⤵
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK815134" 2>nul >nul
    3⤵
    PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK815134" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4172
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK815134"
      4⤵
      PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK504603" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK504603" 2>nul
    3⤵
    PID:2312
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK504603"
      4⤵
      Sets file to hidden
      PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK407735" 2>nul >nul
    3⤵
    PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK407735" 2>nul
    3⤵
    PID:2500
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK407735"
      4⤵
      Views/modifies file attributes
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK231713" 2>nul >nul
    3⤵
    PID:1020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK231713" 2>nul
    3⤵
    PID:828
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK231713"
      4⤵
      Views/modifies file attributes
      PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK241630" 2>nul >nul
    3⤵
    PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK241630" 2>nul
    3⤵
    PID:3360
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK241630"
      4⤵
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK416338" 2>nul >nul
    3⤵
    PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK416338" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4776
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK416338"
      4⤵
      Sets file to hidden
      PID:892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK964563" 2>nul >nul
    3⤵
    PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK964563" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4780
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK964563"
      4⤵
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK793081" 2>nul >nul
    3⤵
    PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK793081" 2>nul
    3⤵
    PID:2528
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK793081"
      4⤵
      PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BK829873" 2>nul >nul
    3⤵
    PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BK829873" 2>nul
    3⤵
    PID:752
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BK829873"
      4⤵
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\BY9B5" 2>nul >nul
    3⤵
    PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\BY9B5" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1116
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\BY9B5"
      4⤵
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\thinking" 2>nul >nul
    3⤵
    PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\thinking" 2>nul
    3⤵
    PID:2284
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\thinking"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\Retev" 2>nul >nul
    3⤵
    - Executes a command shell one-liner
    PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\Retev" 2>nul
    3⤵
    PID:4672
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\Retev"
      4⤵
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%ProgramData%\????????-????-????-????-????????????" 2>nul >nul
    3⤵
    PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +r +s +h "%ProgramData%\????????-????-????-????-????????????" 2>nul
    3⤵
    PID:5104
  - - C:\Windows\system32\attrib.exe
      attrib +r +s +h "C:\ProgramData\????????-????-????-????-????????????"
      4⤵
      Sets file to hidden
      PID:1584
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\System32\WF.msc"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BRO Blocker.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO8028B4E8\BRO Blocker.exe
Size 266KB
SHA256 0ecf8f5bd96d8a3dad5c466f692e76c7583ba85ce2718cc53f487c4a152a2401
MD5 c4108d8c9291dfec32c3c890b792bf27
SHA1 cc6a0fb645ff8b2f97d132b9b7da46721ef1b51e
SHA512 a8a1d5cf33ca56e092db4cf862f7a8426f4ec4d30286f56ab5a2695afaaaa60f3ccb6c3f8cfefd297b2f542deea6041bce84780d1d236734d2a24ec38e25374c
SSDEEP 3072:0de7C0YBdwEAUMryyNabTkxjiXs77M1xbo+JZ4MYTSylqAzt4C3gvMHZKTV5mCx8:ae3Qy0bTkxjiXs0Jo+Yrfzp3it7l
TLSH
T141446C55B7A51CFAED77817DC9524905EB72BC124760E6CF43A00AA61F23AE08E3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 92b51ababe0640899e1ba45bc4baa3d30d325bf51e89fb850c4d3cb7968000a4
MD5 7c6139c9ccad03345ccd5c5e84921b03
SHA1 01aa6810494c96a5927be0c2f0d8f7ca45d363e6
SHA512 ec2eab7f5f778ffe334f760d9559d3327ad9a70bac017cbdc2eeb4b67fc48368d4568549768666fe04ca38ddacca2b3ac131b5bf7ee031a658a0319503575dde
TLSH
T1AA21BE260689915D26B341E5091CB42EA31FC1EB0A2B8D8D3E8D450F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b4228a0fac3341b445cdf6df92b9512c4e88217b5edf39576b56dfea3daced27
MD5 722968999ac0add16345f3a58649f220
SHA1 c66c3aef55088024a1e97454031d34db1ba2fba3
SHA512 7a3816e422f83c913449c7a6c38d806212b00fdf1ca0b3ee61e76ad25c6f057aa6a615968431196c943119714bfad323dbdda174bf7a4608b329477a1ee039d6
TLSH
T19921EE260689925D36F341E5081CF82EA31FC1EB0A2B8D8D3E8D054F7BA2A1C532774A
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 e6b49340b85f934d20c69a5a92ac3b817b58b717965e5f6ef04176082f5db200
MD5 c38d84a6b5703e8cb1cfe463aabfc6a7
SHA1 9c397ddc0c6659e7d53ce155c2cbed6fbafa3638
SHA512 2e9eb255eec40ba25dd3b85be7023fe6b7f6775d4a480c5c7b22ca996e3ae3fcc4abe79825d976e35b0002a12514a89fc7b87f7c2e72bad505ddc493f52259cc
TLSH
T1F821FE260689929D36F341A5081CF82EA31FC1EB0A2B8D8D3E8D014F7B92A1C1323709
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 eb4921f74bdc143d2c05a2dc5b54696b9d5b48d7635626b0d733b4885f3e65b1
MD5 47bec3b5eddf460e98ec83ef04b72778
SHA1 2ae6a82a4e18a907efd0995296bbc73dff3c55ef
SHA512 28fd5d3ba772360f7619dfb0ee76fcf1977ea91a8518da1d4dc8bfce26277b3535913681861ae23ce37d9cc596311b818070ce5cf46dbf87729a44383ef70f12
TLSH
T1DB21F12607C9969D36F341A5081DF81EE35FC1EB092B8D8D7E8D014F7B92A1D1323709
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 02f0601dcb37e86841233e85fe46ac9999cd224c7f9b9e52de3c5ad91448c607
MD5 bdd0d24487c2ec31e0311c8ce2a89adb
SHA1 13ab833ba8c442bf3349d951ff147e64d412fd0e
SHA512 77e14ef97f17ef100d7ce0061e2cccb693ad32db303017b7cea8152b5b532c4f08d9984df6f2f71bf78eed5d102b9088db677234b87b4aeea54387cc7f8e0c21
TLSH
T1CD21DF2607C9969E36F341A5081DF81EE35FC2EB092B8D8D7E8D014F7B92A1D2327709
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b86152cb17e32e7cfa0b3c5603f764ef5cf3645052871b3515137b662eef0b87
MD5 01deddc0c64da0f1a48f2eaf251fadac
SHA1 4a2ad27ecf74254c95ef40bf2dd0e04131e85355
SHA512 8299143549953be1e44628a4a9b86dd71aaadb8b46f2fcf644807851dd174ee483b90bc2257dc00087c5d806bd4519f202e26cd1d089f2882d0dd348f2ce87e2
TLSH
T1A721C02607C9979D36F341A5081DF85EE35F82EB096B8D8D7E8D014F7B92A1D2327709
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3784-22-0x000000001E140000-0x000000001E626000-memory.dmp

Download