Analysis
-
max time kernel
137s -
max time network
80s -
platform
windows7_x64 -
resource
win7-20230705-en -
resource tags
-
submitted
06-07-2023 13:40
General
-
Target
5cdfaad20cdf58exeexeexeex.exe
-
Size
334KB
-
MD5
5cdfaad20cdf5895477b8dd451a38b76
-
SHA1
f59d1bc399d988d5d5169e7df09b8e57589c1127
-
SHA256
1fbfc0b007a6e3e6d21635f4fc6862f73193a94eb54ca6561eb8de30ede2b155
-
SHA512
78229d6cd0432671aa91a770a95b97691376d1283a6ad4be59cb01eb439e987eb87f341405fe54889f6e2957fe874c6940d53ade0dcaf0be7698a634b86828d1
-
SSDEEP
6144:lv3XLrZ99999999999999X99999999999999X99999999999999X99999999999j:NnLrZ99999999999999X99999999999D
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 20 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\TgkIoIgc\JKEYEYgQ.exe"C:\Users\Admin\TgkIoIgc\JKEYEYgQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\ayAkAcYw\nYAssIgA.exe"C:\ProgramData\ayAkAcYw\nYAssIgA.exe"2⤵
- Modifies extensions of user files
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"6⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"8⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"10⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"12⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"14⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"16⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"18⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"20⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"22⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"24⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"26⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"28⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"30⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"32⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"34⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"36⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"38⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"40⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"42⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"44⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"46⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"48⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"50⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"52⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"54⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"56⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"58⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"60⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"62⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"64⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"66⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"68⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"70⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"72⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"74⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"76⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"78⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"80⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"82⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"84⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"86⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"88⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"90⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"92⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"94⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"96⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"98⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"100⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"102⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"104⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"106⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"108⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"110⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"112⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"114⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"116⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"118⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex"120⤵
-
C:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\5cdfaad20cdf58exeexeexeex121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-