Analysis
-
max time kernel
150s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
08-07-2023 18:04
General
-
Target
72fa596bea9904exeexeexeex.exe
-
Size
196KB
-
MD5
72fa596bea99044869b1fb4837edd93f
-
SHA1
f3d93b71db69ed0c6cc4c16a502a5a724f9f9ea6
-
SHA256
50710a837e7e04b0ca0672729a2d18aca8f2820e9f16071ac43f604fdb2c9308
-
SHA512
d7237f31458e5c66cbfabc77d9858c53578028ef30e63aca1c1de08f1ed55fc7673bde861188dea80dccc42c060df522b15ba5a8bbd0a7e963ec6b299b82bcf2
-
SSDEEP
3072:o24UhzMGVrQN3m9vxC4/zgDXRMRPcStGonSj+o/LCES/sK9cJvuXoOf:oBUK8QNeCczyRMxntGonSaIytyw4
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 20 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\DCgsUYAA\bUAQcQQc.exe"C:\Users\Admin\DCgsUYAA\bUAQcQQc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\QmMAIEkU\qeYMEcMY.exe"C:\ProgramData\QmMAIEkU\qeYMEcMY.exe"2⤵
- Modifies extensions of user files
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"6⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"8⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"10⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"12⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"14⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"16⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"18⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"20⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"22⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"24⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"26⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"28⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"30⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"32⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"34⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"36⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"38⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"40⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"42⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"44⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"46⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"48⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"50⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"52⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"54⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"56⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"58⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"60⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"62⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"64⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"66⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"68⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"70⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"72⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"74⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"76⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"78⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"80⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"82⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"84⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"86⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"88⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"90⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"92⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"94⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"96⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"98⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"100⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"102⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"104⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"106⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"108⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"110⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"112⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"114⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"116⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"118⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"120⤵
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-