Analysis
-
max time kernel
150s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
05-07-2023 16:33
General
-
Target
0fc179c84db1f3exeexeexeex.exe
-
Size
309KB
-
MD5
0fc179c84db1f3fc59598b40d31ceac6
-
SHA1
24729f8dae98db58e10968676377e9e630803c0d
-
SHA256
513540388b50c5e9552542f7c8612a08d33e9b094e989544c1c60327802c66b4
-
SHA512
2b8a18caaf7947dbbcb46695ecd6d6204c941411cb4dfacc16eeb7dcf5bb2dfc06462bf6332a1819a9ec8fe69358556e350583c0e31fbe5057394988ea6d00ff
-
SSDEEP
6144:PmX9n70CNLYqgFvqczDXUvYIq21Rb3dldybVOBevSGbkL:Pe/4vqvI21Rb3dldybMsKGbkL
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 20 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\kOoowcUg\kUAIYoEE.exe"C:\Users\Admin\kOoowcUg\kUAIYoEE.exe"2⤵
- Modifies extensions of user files
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\qUYcMkAI\NyQYYcUg.exe"C:\ProgramData\qUYcMkAI\NyQYYcUg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"6⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"8⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"10⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"12⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"14⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"16⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"18⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"20⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"22⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"24⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"26⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"28⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"30⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"32⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"34⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"36⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"38⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"40⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"42⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"44⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"46⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"48⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"50⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"52⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"54⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"56⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"58⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"60⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"62⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"64⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"66⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"68⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"70⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"72⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"74⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"76⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"78⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"80⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"82⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"84⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"86⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"88⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"90⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"92⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"94⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"96⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"98⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"100⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"102⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"104⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"106⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"108⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"110⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"112⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"114⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"116⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"118⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex"120⤵
-
C:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\0fc179c84db1f3exeexeexeex121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-