Analysis
-
max time kernel
150s -
max time network
68s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
09/07/2023, 19:42
General
-
Target
becf2cfb41d78dexeexeexeex.exe
-
Size
200KB
-
MD5
becf2cfb41d78df0b5ebe54c11498eb5
-
SHA1
6401e8cea4f9ed8a67ccf262776b1f814d2e870e
-
SHA256
66386489d7232fe00e3e1c4c4840db85b2b3535002029911fb48cb1b1d844b95
-
SHA512
cdd9a8d5ea50edf769eb6e645930fec175b8ee82c215d70c899a8d0fd157b63b1be59b17decc97d39320f2da4133183ec039b238efc920b201fcfe87cd974965
-
SSDEEP
3072:GO9uxAQx4MPd3QkSGQnkHWR1fYA3/cZ2YJM6Ogpm+pRE/Osc2d:vuxAUQnk2xcF/Joxr1d
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 20 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 14 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\TeIUcwEI\neIQgcsU.exe"C:\Users\Admin\TeIUcwEI\neIQgcsU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\UowMEcYU\CiEUUYgM.exe"C:\ProgramData\UowMEcYU\CiEUUYgM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"6⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"8⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"10⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"12⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"14⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"16⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"18⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"20⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"22⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"24⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"26⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"28⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"30⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"32⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"34⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"36⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"38⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"40⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"42⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"44⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"46⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"48⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"50⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"52⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"54⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"56⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"58⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"60⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"62⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"64⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"66⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"68⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"70⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"72⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"74⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"76⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"78⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"80⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"82⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"84⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"86⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"88⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"90⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"92⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"94⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"96⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"98⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"100⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"102⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"104⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"106⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"108⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"110⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"112⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"114⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"116⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"118⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex"120⤵
-
C:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\becf2cfb41d78dexeexeexeex121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-