Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 03:56
Static task
static1
Behavioral task
behavioral1
Sample
e7a477c9b60dd8b7850b976ca2f0200c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
e7a477c9b60dd8b7850b976ca2f0200c.exe
Resource
win10v2004-20240508-en
General
-
Target
e7a477c9b60dd8b7850b976ca2f0200c.exe
-
Size
116KB
-
MD5
e7a477c9b60dd8b7850b976ca2f0200c
-
SHA1
9879fe656eef2c5b777ce19616e7b4da1d340350
-
SHA256
972b67c855ae25a2f4641d06a3a348e8312711c9014b6c26d1a93e434bdeb0c1
-
SHA512
644e1368ce4eed8b45ac56d1c008861ee6c99461a79164aeb645259bf151232f7911a9a95a464eae16688a46b4350e9ca87e4b8cb7854094bbaf462612d82ad7
-
SSDEEP
3072:YhZWl1vcA5a57LGAbpZDQvsDleElOvyM0wLyaHaH:YWl1vcZ7LplDoEovPhH
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (81) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lcYcswUk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation lcYcswUk.exe -
Executes dropped EXE 2 IoCs
Processes:
lcYcswUk.exeXUUggsUw.exepid process 4156 lcYcswUk.exe 2616 XUUggsUw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
e7a477c9b60dd8b7850b976ca2f0200c.exelcYcswUk.exeXUUggsUw.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcYcswUk.exe = "C:\\Users\\Admin\\PaosAQgM\\lcYcswUk.exe" e7a477c9b60dd8b7850b976ca2f0200c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XUUggsUw.exe = "C:\\ProgramData\\vAUgscUM\\XUUggsUw.exe" e7a477c9b60dd8b7850b976ca2f0200c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcYcswUk.exe = "C:\\Users\\Admin\\PaosAQgM\\lcYcswUk.exe" lcYcswUk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XUUggsUw.exe = "C:\\ProgramData\\vAUgscUM\\XUUggsUw.exe" XUUggsUw.exe -
Drops file in System32 directory 2 IoCs
Processes:
lcYcswUk.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe lcYcswUk.exe File created C:\Windows\SysWOW64\shell32.dll.exe lcYcswUk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1856 reg.exe 3576 reg.exe 1776 reg.exe 3748 reg.exe 3436 reg.exe 1396 reg.exe 2504 reg.exe 2096 reg.exe 3636 reg.exe 3148 reg.exe 512 reg.exe 1728 reg.exe 364 reg.exe 4708 reg.exe 2404 reg.exe 992 reg.exe 4512 reg.exe 3652 reg.exe 4892 reg.exe 3988 reg.exe 4260 reg.exe 4560 reg.exe 4940 reg.exe 632 reg.exe 4892 reg.exe 4088 reg.exe 2372 reg.exe 376 reg.exe 816 reg.exe 3224 reg.exe 4144 reg.exe 4536 reg.exe 2856 reg.exe 1188 reg.exe 1920 reg.exe 5020 reg.exe 3012 reg.exe 3592 reg.exe 1972 reg.exe 1344 reg.exe 4940 reg.exe 1616 reg.exe 1344 reg.exe 1760 reg.exe 3740 reg.exe 4988 reg.exe 2712 reg.exe 376 reg.exe 3908 reg.exe 4944 reg.exe 3324 reg.exe 5100 reg.exe 4168 reg.exe 2016 reg.exe 2252 reg.exe 3884 reg.exe 4508 reg.exe 1096 reg.exe 2416 reg.exe 2396 reg.exe 3604 reg.exe 1820 reg.exe 216 reg.exe 1192 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exee7a477c9b60dd8b7850b976ca2f0200c.exepid process 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe 1812 e7a477c9b60dd8b7850b976ca2f0200c.exe 1812 e7a477c9b60dd8b7850b976ca2f0200c.exe 1812 e7a477c9b60dd8b7850b976ca2f0200c.exe 1812 e7a477c9b60dd8b7850b976ca2f0200c.exe 5116 e7a477c9b60dd8b7850b976ca2f0200c.exe 5116 e7a477c9b60dd8b7850b976ca2f0200c.exe 5116 e7a477c9b60dd8b7850b976ca2f0200c.exe 5116 e7a477c9b60dd8b7850b976ca2f0200c.exe 3096 e7a477c9b60dd8b7850b976ca2f0200c.exe 3096 e7a477c9b60dd8b7850b976ca2f0200c.exe 3096 e7a477c9b60dd8b7850b976ca2f0200c.exe 3096 e7a477c9b60dd8b7850b976ca2f0200c.exe 5048 e7a477c9b60dd8b7850b976ca2f0200c.exe 5048 e7a477c9b60dd8b7850b976ca2f0200c.exe 5048 e7a477c9b60dd8b7850b976ca2f0200c.exe 5048 e7a477c9b60dd8b7850b976ca2f0200c.exe 2332 e7a477c9b60dd8b7850b976ca2f0200c.exe 2332 e7a477c9b60dd8b7850b976ca2f0200c.exe 2332 e7a477c9b60dd8b7850b976ca2f0200c.exe 2332 e7a477c9b60dd8b7850b976ca2f0200c.exe 3112 e7a477c9b60dd8b7850b976ca2f0200c.exe 3112 e7a477c9b60dd8b7850b976ca2f0200c.exe 3112 e7a477c9b60dd8b7850b976ca2f0200c.exe 3112 e7a477c9b60dd8b7850b976ca2f0200c.exe 2500 e7a477c9b60dd8b7850b976ca2f0200c.exe 2500 e7a477c9b60dd8b7850b976ca2f0200c.exe 2500 e7a477c9b60dd8b7850b976ca2f0200c.exe 2500 e7a477c9b60dd8b7850b976ca2f0200c.exe 2292 e7a477c9b60dd8b7850b976ca2f0200c.exe 2292 e7a477c9b60dd8b7850b976ca2f0200c.exe 2292 e7a477c9b60dd8b7850b976ca2f0200c.exe 2292 e7a477c9b60dd8b7850b976ca2f0200c.exe 4412 e7a477c9b60dd8b7850b976ca2f0200c.exe 4412 e7a477c9b60dd8b7850b976ca2f0200c.exe 4412 e7a477c9b60dd8b7850b976ca2f0200c.exe 4412 e7a477c9b60dd8b7850b976ca2f0200c.exe 3216 e7a477c9b60dd8b7850b976ca2f0200c.exe 3216 e7a477c9b60dd8b7850b976ca2f0200c.exe 3216 e7a477c9b60dd8b7850b976ca2f0200c.exe 3216 e7a477c9b60dd8b7850b976ca2f0200c.exe 2404 e7a477c9b60dd8b7850b976ca2f0200c.exe 2404 e7a477c9b60dd8b7850b976ca2f0200c.exe 2404 e7a477c9b60dd8b7850b976ca2f0200c.exe 2404 e7a477c9b60dd8b7850b976ca2f0200c.exe 4028 e7a477c9b60dd8b7850b976ca2f0200c.exe 4028 e7a477c9b60dd8b7850b976ca2f0200c.exe 4028 e7a477c9b60dd8b7850b976ca2f0200c.exe 4028 e7a477c9b60dd8b7850b976ca2f0200c.exe 3652 e7a477c9b60dd8b7850b976ca2f0200c.exe 3652 e7a477c9b60dd8b7850b976ca2f0200c.exe 3652 e7a477c9b60dd8b7850b976ca2f0200c.exe 3652 e7a477c9b60dd8b7850b976ca2f0200c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
lcYcswUk.exepid process 4156 lcYcswUk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
lcYcswUk.exepid process 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe 4156 lcYcswUk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e7a477c9b60dd8b7850b976ca2f0200c.execmd.execmd.exee7a477c9b60dd8b7850b976ca2f0200c.execmd.execmd.exee7a477c9b60dd8b7850b976ca2f0200c.execmd.exedescription pid process target process PID 4328 wrote to memory of 4156 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe lcYcswUk.exe PID 4328 wrote to memory of 4156 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe lcYcswUk.exe PID 4328 wrote to memory of 4156 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe lcYcswUk.exe PID 4328 wrote to memory of 2616 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe XUUggsUw.exe PID 4328 wrote to memory of 2616 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe XUUggsUw.exe PID 4328 wrote to memory of 2616 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe XUUggsUw.exe PID 4328 wrote to memory of 816 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 4328 wrote to memory of 816 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 4328 wrote to memory of 816 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 816 wrote to memory of 3592 816 cmd.exe e7a477c9b60dd8b7850b976ca2f0200c.exe PID 816 wrote to memory of 3592 816 cmd.exe e7a477c9b60dd8b7850b976ca2f0200c.exe PID 816 wrote to memory of 3592 816 cmd.exe e7a477c9b60dd8b7850b976ca2f0200c.exe PID 4328 wrote to memory of 780 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4328 wrote to memory of 780 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4328 wrote to memory of 780 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4328 wrote to memory of 448 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4328 wrote to memory of 448 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4328 wrote to memory of 448 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4328 wrote to memory of 8 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4328 wrote to memory of 8 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4328 wrote to memory of 8 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4328 wrote to memory of 1752 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 4328 wrote to memory of 1752 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 4328 wrote to memory of 1752 4328 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 1752 wrote to memory of 2396 1752 cmd.exe cmd.exe PID 1752 wrote to memory of 2396 1752 cmd.exe cmd.exe PID 1752 wrote to memory of 2396 1752 cmd.exe cmd.exe PID 3592 wrote to memory of 3296 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 3592 wrote to memory of 3296 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 3592 wrote to memory of 3296 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 3296 wrote to memory of 3612 3296 cmd.exe e7a477c9b60dd8b7850b976ca2f0200c.exe PID 3296 wrote to memory of 3612 3296 cmd.exe e7a477c9b60dd8b7850b976ca2f0200c.exe PID 3296 wrote to memory of 3612 3296 cmd.exe e7a477c9b60dd8b7850b976ca2f0200c.exe PID 3592 wrote to memory of 1888 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3592 wrote to memory of 1888 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3592 wrote to memory of 1888 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3592 wrote to memory of 2252 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3592 wrote to memory of 2252 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3592 wrote to memory of 2252 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3592 wrote to memory of 4260 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3592 wrote to memory of 4260 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3592 wrote to memory of 4260 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3592 wrote to memory of 4648 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 3592 wrote to memory of 4648 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 3592 wrote to memory of 4648 3592 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe PID 4648 wrote to memory of 4548 4648 cmd.exe cscript.exe PID 4648 wrote to memory of 4548 4648 cmd.exe cscript.exe PID 4648 wrote to memory of 4548 4648 cmd.exe cscript.exe PID 3612 wrote to memory of 4060 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 4060 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 4060 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 4060 wrote to memory of 1812 4060 cmd.exe e7a477c9b60dd8b7850b976ca2f0200c.exe PID 4060 wrote to memory of 1812 4060 cmd.exe e7a477c9b60dd8b7850b976ca2f0200c.exe PID 4060 wrote to memory of 1812 4060 cmd.exe e7a477c9b60dd8b7850b976ca2f0200c.exe PID 3612 wrote to memory of 3204 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 3204 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 3204 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 4220 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 4220 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 4220 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 4712 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 4712 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 4712 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe reg.exe PID 3612 wrote to memory of 4728 3612 e7a477c9b60dd8b7850b976ca2f0200c.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exe"C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\PaosAQgM\lcYcswUk.exe"C:\Users\Admin\PaosAQgM\lcYcswUk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\vAUgscUM\XUUggsUw.exe"C:\ProgramData\vAUgscUM\XUUggsUw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"12⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"14⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV115⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"16⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"20⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"22⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"24⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"26⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"28⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"32⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"34⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"36⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"38⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"42⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"44⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"48⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"50⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"52⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"54⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"56⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"58⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"62⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"66⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"68⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"70⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"72⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"74⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"76⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"78⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"80⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"84⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"86⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"90⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"92⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"94⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"96⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"98⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"100⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"102⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"104⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"106⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"108⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"110⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"112⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"114⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"116⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"118⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"120⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"122⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"124⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"126⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"128⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"130⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"132⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"134⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"136⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"138⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"140⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"142⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"144⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"148⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"150⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"152⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"154⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"156⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"158⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"160⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"162⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"164⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"166⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"168⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"170⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"172⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"174⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"176⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"178⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"180⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"182⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"184⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"186⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"188⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"190⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"192⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"194⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"196⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"198⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"200⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"202⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"204⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"206⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"208⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"210⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"212⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"214⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"216⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"218⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"220⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"222⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"224⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"226⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"228⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"230⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"232⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"234⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"236⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"238⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c"240⤵
-
C:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c.exeC:\Users\Admin\AppData\Local\Temp\e7a477c9b60dd8b7850b976ca2f0200c241⤵