Analysis
-
max time kernel
150s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
07/07/2023, 12:32
General
-
Target
498202687dad7eexeexeexeex.exe
-
Size
328KB
-
MD5
498202687dad7e6c0c462302a302e737
-
SHA1
a969fb6d571dc6c5187f34c17bdf29ea9cb503dd
-
SHA256
8fca0dcc9c1e38ebcce835aab603535210a8a0fe54c390463c5511f1883c533d
-
SHA512
7b2be240595294d31e8b4d852bfccfd0edcb99153f161522396a2b496cc23bc741c9e245514bbc947cfa9e0521d67f0b25a0fa524393ad05354db5bfdf7ab050
-
SSDEEP
6144:YaXDq1Ydmf2KM6m8fne6xJGB8QO2Jf97+60MLB5KSFLb6HbfuNiH13/j4cbIOU:THmfu6RlyBHO2Jt+hZiibmIBr4cXU
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 20 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\oSQkMskg\uigoYgME.exe"C:\Users\Admin\oSQkMskg\uigoYgME.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\zQMQoQUg\dyIoEcAE.exe"C:\ProgramData\zQMQoQUg\dyIoEcAE.exe"2⤵
- Modifies extensions of user files
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"6⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"8⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"10⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"12⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"14⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"16⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"18⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"20⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"22⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"24⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"26⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"28⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"30⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"32⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"34⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"36⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"38⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"40⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"42⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"44⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"46⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"48⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"50⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"52⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"54⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"56⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"58⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"60⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"62⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"64⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"66⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"68⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"70⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"72⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"74⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"76⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"78⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"80⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"82⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"84⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"86⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"88⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"90⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"92⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"94⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"96⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"98⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"100⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"102⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex103⤵
- Adds Run key to start application
-
C:\Users\Admin\JUsQsoMc\EEIcgYwE.exe"C:\Users\Admin\JUsQsoMc\EEIcgYwE.exe"104⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 36105⤵
- Program crash
-
-
-
C:\ProgramData\UEoEkwsY\CQAQkIwA.exe"C:\ProgramData\UEoEkwsY\CQAQkIwA.exe"104⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 36105⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"104⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"106⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"108⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"110⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"112⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"114⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"116⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"118⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex"120⤵
-
C:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\498202687dad7eexeexeexeex121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-