b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

Analysis

max time kernel
299s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20220414-es
submitted
10-05-2022 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ssms.exe
Size

155KB
MD5

14a09a48ad23fe0ea5a180bee8cb750a
SHA1

ac3cdd673f5126bc49faa72fb52284f513929db4
SHA256

b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d
SHA512

3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 42 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 20 IoCs

pid	Process
2860	ssms.exe
4172	ssms.exe
3480	ssms.exe
1980	ssms.exe
1664	ssms.exe
3056	ssms.exe
1276	ssms.exe
3980	ssms.exe
2496	ssms.exe
1072	ssms.exe
4772	ssms.exe
4436	ssms.exe
3804	ssms.exe
2620	ssms.exe
3156	ssms.exe
3780	ssms.exe
1516	ssms.exe
380	ssms.exe
2460	ssms.exe
856	ssms.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File opened for modification	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe
File created	C:\Windows\SysWOW64\ssms.exe	ssms.exe

Runs .reg file with regedit 21 IoCs

pid	Process
4112	regedit.exe
1352	regedit.exe
2036	regedit.exe
1588	regedit.exe
2944	regedit.exe
2968	regedit.exe
2272	regedit.exe
4356	regedit.exe
1240	regedit.exe
1560	regedit.exe
560	regedit.exe
2116	regedit.exe
2196	regedit.exe
2792	regedit.exe
4736	regedit.exe
2680	regedit.exe
3552	regedit.exe
1712	regedit.exe
4876	regedit.exe
4556	regedit.exe
60	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 5000	4468	ssms.exe	82
PID 4468 wrote to memory of 5000	4468	ssms.exe	82
PID 4468 wrote to memory of 5000	4468	ssms.exe	82
PID 5000 wrote to memory of 2792	5000	cmd.exe	83
PID 5000 wrote to memory of 2792	5000	cmd.exe	83
PID 5000 wrote to memory of 2792	5000	cmd.exe	83
PID 4468 wrote to memory of 2860	4468	ssms.exe	84
PID 4468 wrote to memory of 2860	4468	ssms.exe	84
PID 4468 wrote to memory of 2860	4468	ssms.exe	84
PID 2860 wrote to memory of 3660	2860	ssms.exe	85
PID 2860 wrote to memory of 3660	2860	ssms.exe	85
PID 2860 wrote to memory of 3660	2860	ssms.exe	85
PID 3660 wrote to memory of 4736	3660	cmd.exe	86
PID 3660 wrote to memory of 4736	3660	cmd.exe	86
PID 3660 wrote to memory of 4736	3660	cmd.exe	86
PID 2860 wrote to memory of 4172	2860	ssms.exe	93
PID 2860 wrote to memory of 4172	2860	ssms.exe	93
PID 2860 wrote to memory of 4172	2860	ssms.exe	93
PID 4172 wrote to memory of 3120	4172	ssms.exe	94
PID 4172 wrote to memory of 3120	4172	ssms.exe	94
PID 4172 wrote to memory of 3120	4172	ssms.exe	94
PID 3120 wrote to memory of 2680	3120	cmd.exe	95
PID 3120 wrote to memory of 2680	3120	cmd.exe	95
PID 3120 wrote to memory of 2680	3120	cmd.exe	95
PID 4172 wrote to memory of 3480	4172	ssms.exe	97
PID 4172 wrote to memory of 3480	4172	ssms.exe	97
PID 4172 wrote to memory of 3480	4172	ssms.exe	97
PID 3480 wrote to memory of 4076	3480	ssms.exe	98
PID 3480 wrote to memory of 4076	3480	ssms.exe	98
PID 3480 wrote to memory of 4076	3480	ssms.exe	98
PID 4076 wrote to memory of 2968	4076	cmd.exe	99
PID 4076 wrote to memory of 2968	4076	cmd.exe	99
PID 4076 wrote to memory of 2968	4076	cmd.exe	99
PID 3480 wrote to memory of 1980	3480	ssms.exe	107
PID 3480 wrote to memory of 1980	3480	ssms.exe	107
PID 3480 wrote to memory of 1980	3480	ssms.exe	107
PID 1980 wrote to memory of 4760	1980	ssms.exe	108
PID 1980 wrote to memory of 4760	1980	ssms.exe	108
PID 1980 wrote to memory of 4760	1980	ssms.exe	108
PID 4760 wrote to memory of 1240	4760	cmd.exe	109
PID 4760 wrote to memory of 1240	4760	cmd.exe	109
PID 4760 wrote to memory of 1240	4760	cmd.exe	109
PID 1980 wrote to memory of 1664	1980	ssms.exe	110
PID 1980 wrote to memory of 1664	1980	ssms.exe	110
PID 1980 wrote to memory of 1664	1980	ssms.exe	110
PID 1664 wrote to memory of 1028	1664	ssms.exe	111
PID 1664 wrote to memory of 1028	1664	ssms.exe	111
PID 1664 wrote to memory of 1028	1664	ssms.exe	111
PID 1028 wrote to memory of 3552	1028	cmd.exe	112
PID 1028 wrote to memory of 3552	1028	cmd.exe	112
PID 1028 wrote to memory of 3552	1028	cmd.exe	112
PID 1664 wrote to memory of 3056	1664	ssms.exe	114
PID 1664 wrote to memory of 3056	1664	ssms.exe	114
PID 1664 wrote to memory of 3056	1664	ssms.exe	114
PID 3056 wrote to memory of 2376	3056	ssms.exe	115
PID 3056 wrote to memory of 2376	3056	ssms.exe	115
PID 3056 wrote to memory of 2376	3056	ssms.exe	115
PID 2376 wrote to memory of 1560	2376	cmd.exe	116
PID 2376 wrote to memory of 1560	2376	cmd.exe	116
PID 2376 wrote to memory of 1560	2376	cmd.exe	116
PID 3056 wrote to memory of 1276	3056	ssms.exe	117
PID 3056 wrote to memory of 1276	3056	ssms.exe	117
PID 3056 wrote to memory of 1276	3056	ssms.exe	117
PID 1276 wrote to memory of 2932	1276	ssms.exe	118

C:\Users\Admin\AppData\Local\Temp\ssms.exe
"C:\Users\Admin\AppData\Local\Temp\ssms.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - Runs .reg file with regedit
    PID:2792
- C:\Windows\SysWOW64\ssms.exe
  C:\Windows\system32\ssms.exe 1168 "C:\Users\Admin\AppData\Local\Temp\ssms.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\a.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:4736
- - C:\Windows\SysWOW64\ssms.exe
    C:\Windows\system32\ssms.exe 1172 "C:\Windows\SysWOW64\ssms.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\a.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2680
  - - C:\Windows\SysWOW64\ssms.exe
      C:\Windows\system32\ssms.exe 1152 "C:\Windows\SysWOW64\ssms.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4076
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2968
    - - C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1160 "C:\Windows\SysWOW64\ssms.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1980
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1240
      - C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1188 "C:\Windows\SysWOW64\ssms.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:3552
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1156 "C:\Windows\SysWOW64\ssms.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1560
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1148 "C:\Windows\SysWOW64\ssms.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        9⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1712
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1164 "C:\Windows\SysWOW64\ssms.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        10⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4112
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1140 "C:\Windows\SysWOW64\ssms.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        11⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:560
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1192 "C:\Windows\SysWOW64\ssms.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        12⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1352
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1180 "C:\Windows\SysWOW64\ssms.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        13⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        14⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2272
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 980 "C:\Windows\SysWOW64\ssms.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        14⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        15⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2116
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1176 "C:\Windows\SysWOW64\ssms.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        15⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        16⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4876
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1200 "C:\Windows\SysWOW64\ssms.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        16⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        17⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2036
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1204 "C:\Windows\SysWOW64\ssms.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        17⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        18⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1588
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1208 "C:\Windows\SysWOW64\ssms.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        18⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        19⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4556
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1184 "C:\Windows\SysWOW64\ssms.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        19⤵
        
        PID:944
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        20⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2944
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1216 "C:\Windows\SysWOW64\ssms.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        20⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        21⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4356
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1220 "C:\Windows\SysWOW64\ssms.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        21⤵
        
        PID:744
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        22⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2196
        
        C:\Windows\SysWOW64\ssms.exe
        
        C:\Windows\system32\ssms.exe 1224 "C:\Windows\SysWOW64\ssms.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        22⤵
        
        PID:652
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        23⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:60

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
C:\Windows\SysWOW64\ssms.exe

Filesize
155KB

MD5
14a09a48ad23fe0ea5a180bee8cb750a

SHA1
ac3cdd673f5126bc49faa72fb52284f513929db4

SHA256
b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d

SHA512
3f11e6f0fb03f2857f29f4ba296dd4fdbda93938b1516a80c18d656d67175fec910727ca447c7217e8edf9a160d9c7c02ebd9f35081a0071247d572d960e9734

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit