Analysis
-
max time kernel
150s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
09/07/2023, 11:17
General
-
Target
999766eac0319aexeexeexeex.exe
-
Size
185KB
-
MD5
999766eac0319ae8cfbbda2ecf496d3d
-
SHA1
d511634e8f067f6266cee3997c55feddfa212733
-
SHA256
f1703e7b6ce37b8e9e59def975fad8adce23ea0a73844e249c8e89968c521154
-
SHA512
dbabaf35d535295c1d7787bbb0cd5849798852bfdf4aecc07a7c46de339a691cf2bf00cd24291cebb56c8404fbf42d87df5eebbce6801272c1d54fce6bd865e1
-
SSDEEP
3072:KFCe6/bc8ZN3QAtj88EJ/c9SGDglw3mRYh4hflAqcAOGb0AAr0cOalA9TNh1kqli:yC3v1G/c9LDqRbg5yrGkbDXmUgD
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 20 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\YwMsUswI\EMoccgsg.exe"C:\Users\Admin\YwMsUswI\EMoccgsg.exe"2⤵
- Modifies extensions of user files
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\OCEYoEIM\pMUYUcYI.exe"C:\ProgramData\OCEYoEIM\pMUYUcYI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"6⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"8⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"10⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"12⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"14⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"16⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"18⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"20⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"22⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"24⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"26⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"28⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"30⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"32⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"34⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"36⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"38⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"40⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"42⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"44⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"46⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"48⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"50⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"52⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"54⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"56⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"58⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"60⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"62⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"64⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"66⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"68⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"70⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"72⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"74⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"76⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"78⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"80⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"82⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"84⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"86⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"88⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"90⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"92⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"94⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"96⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"98⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"100⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"102⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"104⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"106⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"108⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"110⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"112⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"114⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"116⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"118⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex"120⤵
-
C:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\999766eac0319aexeexeexeex121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-