Analysis
-
max time kernel
1795s -
max time network
1521s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
21/02/2024, 11:43
General
-
Target
2024-02-21_9bf351853b70dc260a5baac08d6fbaeb_goldeneye.exe
-
Size
372KB
-
MD5
9bf351853b70dc260a5baac08d6fbaeb
-
SHA1
77430875bf961ab9e1f0c81892476b2164df5287
-
SHA256
66ef52467495a8042844dccfdaefabb7d3c690c3f29b3ec29a2c292ed766e874
-
SHA512
d56c700b6424a44b49ec7dad44dfef639c89a6ffc828b2cf9e214ea43184997cdd3a826ad4045b0ceae4deacd1cb8180c6b9441a04800b80d090c41a17f0ed52
-
SSDEEP
3072:CEGh0oVmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGKl/Oe2MUVg3vTeKcAEciTBqr3
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_9bf351853b70dc260a5baac08d6fbaeb_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_9bf351853b70dc260a5baac08d6fbaeb_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF3916CA-9524-495c-92C0-28EF774EC1CB}.exeC:\Windows\{DF3916CA-9524-495c-92C0-28EF774EC1CB}.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75B8C948-0A7D-4364-8726-08CE364C99B9}.exeC:\Windows\{75B8C948-0A7D-4364-8726-08CE364C99B9}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{513EEFE1-C9B8-4611-A61C-64A38814348C}.exeC:\Windows\{513EEFE1-C9B8-4611-A61C-64A38814348C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A9B336D-2183-4406-B391-437BC7E17D67}.exeC:\Windows\{7A9B336D-2183-4406-B391-437BC7E17D67}.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{237C8625-C7F6-4cea-A878-CFAD46A46447}.exeC:\Windows\{237C8625-C7F6-4cea-A878-CFAD46A46447}.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99C24AA5-3F97-49e8-A47F-E14FDCC0E032}.exeC:\Windows\{99C24AA5-3F97-49e8-A47F-E14FDCC0E032}.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2E76142-471E-404a-BFE2-553C6A37A7D0}.exeC:\Windows\{B2E76142-471E-404a-BFE2-553C6A37A7D0}.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5543F531-65C6-4c69-9C10-8A739103E095}.exeC:\Windows\{5543F531-65C6-4c69-9C10-8A739103E095}.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{439ADDF5-3153-4332-B3EC-5CEDB2BE56EF}.exeC:\Windows\{439ADDF5-3153-4332-B3EC-5CEDB2BE56EF}.exe10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB8A8841-D03B-4e30-AD8A-6ADACFC7C4DF}.exeC:\Windows\{AB8A8841-D03B-4e30-AD8A-6ADACFC7C4DF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{959DE87C-ADB1-408d-A76A-B94415F96EA3}.exeC:\Windows\{959DE87C-ADB1-408d-A76A-B94415F96EA3}.exe12⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0A8B2D1B-E5BD-4f96-929A-6AC01CB2FDF9}.exeC:\Windows\{0A8B2D1B-E5BD-4f96-929A-6AC01CB2FDF9}.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{37805C89-366E-4f86-B630-9FA5D3D5603D}.exeC:\Windows\{37805C89-366E-4f86-B630-9FA5D3D5603D}.exe14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{69A6DCFA-7E85-4695-994E-6C035CCDA1F6}.exeC:\Windows\{69A6DCFA-7E85-4695-994E-6C035CCDA1F6}.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69A6D~1.EXE > nul16⤵
-
-
C:\Windows\{2F7AC9A9-7AA0-4132-AF87-1401E3D10BBF}.exeC:\Windows\{2F7AC9A9-7AA0-4132-AF87-1401E3D10BBF}.exe16⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{70C7EC87-AAA2-41f8-9CB1-3C396F8E0017}.exeC:\Windows\{70C7EC87-AAA2-41f8-9CB1-3C396F8E0017}.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{94182851-CAD0-4ac7-A23E-F0A5CAFE8A77}.exeC:\Windows\{94182851-CAD0-4ac7-A23E-F0A5CAFE8A77}.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{19B60F16-64BD-41db-8392-2708B94BEE97}.exeC:\Windows\{19B60F16-64BD-41db-8392-2708B94BEE97}.exe19⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{630143E4-47E8-4d86-9A6A-345982EF544D}.exeC:\Windows\{630143E4-47E8-4d86-9A6A-345982EF544D}.exe20⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{606D3A8D-EDF3-4927-942C-C3595E7E97B4}.exeC:\Windows\{606D3A8D-EDF3-4927-942C-C3595E7E97B4}.exe21⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A83C2E07-4279-447f-ADD4-2DD8CC36D686}.exeC:\Windows\{A83C2E07-4279-447f-ADD4-2DD8CC36D686}.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4264E937-895A-4d8c-B737-883D14044E25}.exeC:\Windows\{4264E937-895A-4d8c-B737-883D14044E25}.exe23⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5D491113-9898-47e3-AF2B-CEC1E70634A0}.exeC:\Windows\{5D491113-9898-47e3-AF2B-CEC1E70634A0}.exe24⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{14C764DF-6268-4c96-A63C-74C5ED126149}.exeC:\Windows\{14C764DF-6268-4c96-A63C-74C5ED126149}.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{09C11BC6-B250-483c-99D1-B2149096182D}.exeC:\Windows\{09C11BC6-B250-483c-99D1-B2149096182D}.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8D6E1E72-155A-433a-9271-3FC806E134DF}.exeC:\Windows\{8D6E1E72-155A-433a-9271-3FC806E134DF}.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{15E94F3D-49DC-4aa3-AE56-1B1892ED59A6}.exeC:\Windows\{15E94F3D-49DC-4aa3-AE56-1B1892ED59A6}.exe28⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F2BAF08F-F96A-43e4-BD8A-9B15AFF66510}.exeC:\Windows\{F2BAF08F-F96A-43e4-BD8A-9B15AFF66510}.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{67F9BD7B-8666-49c8-A45C-70BEF2503590}.exeC:\Windows\{67F9BD7B-8666-49c8-A45C-70BEF2503590}.exe30⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0234127B-A3A3-49bb-A4C6-5BCC85DC5C90}.exeC:\Windows\{0234127B-A3A3-49bb-A4C6-5BCC85DC5C90}.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9CF9B743-4A04-47b9-91FB-469C85AFD002}.exeC:\Windows\{9CF9B743-4A04-47b9-91FB-469C85AFD002}.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A30E4369-FBA5-4329-BDA2-5205DD9A56A0}.exeC:\Windows\{A30E4369-FBA5-4329-BDA2-5205DD9A56A0}.exe33⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D82E759D-2CB9-445f-A45A-A43A53728068}.exeC:\Windows\{D82E759D-2CB9-445f-A45A-A43A53728068}.exe34⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1999EBE3-582D-4cd6-AAE9-C66C09D01974}.exeC:\Windows\{1999EBE3-582D-4cd6-AAE9-C66C09D01974}.exe35⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1B9AEBC0-7AE0-4b2f-BF2C-38DDC332D36C}.exeC:\Windows\{1B9AEBC0-7AE0-4b2f-BF2C-38DDC332D36C}.exe36⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{614AD9CB-5527-4845-83FA-41F6D6CA90B8}.exeC:\Windows\{614AD9CB-5527-4845-83FA-41F6D6CA90B8}.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D4B320E7-2DC0-4283-B903-574351E35D56}.exeC:\Windows\{D4B320E7-2DC0-4283-B903-574351E35D56}.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F2D4A0BA-F051-4122-AD91-68D430A5BD72}.exeC:\Windows\{F2D4A0BA-F051-4122-AD91-68D430A5BD72}.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2D4A~1.EXE > nul40⤵
-
-
C:\Windows\{60B90B0A-D09F-4a53-A3C0-E43464B165A8}.exeC:\Windows\{60B90B0A-D09F-4a53-A3C0-E43464B165A8}.exe40⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1071F5D0-36B8-4549-BDBE-6CDC603E827E}.exeC:\Windows\{1071F5D0-36B8-4549-BDBE-6CDC603E827E}.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0611703F-E8AB-4e4c-BD68-70DBA26968B5}.exeC:\Windows\{0611703F-E8AB-4e4c-BD68-70DBA26968B5}.exe42⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9308047A-BB91-4887-A82B-CFFBC2B1761F}.exeC:\Windows\{9308047A-BB91-4887-A82B-CFFBC2B1761F}.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9BCEB2AB-F117-492b-AF1D-E0C0CC8E9709}.exeC:\Windows\{9BCEB2AB-F117-492b-AF1D-E0C0CC8E9709}.exe44⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9901F4A6-CE03-43b9-B6FC-F1B94B4A150D}.exeC:\Windows\{9901F4A6-CE03-43b9-B6FC-F1B94B4A150D}.exe45⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C694EE32-1328-431c-A280-785ACF706FBF}.exeC:\Windows\{C694EE32-1328-431c-A280-785ACF706FBF}.exe46⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{6F9D0591-73A3-4204-B2C0-8DE474AB40A3}.exeC:\Windows\{6F9D0591-73A3-4204-B2C0-8DE474AB40A3}.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{EBE7BB42-3D47-4312-85E5-472F28A4C46B}.exeC:\Windows\{EBE7BB42-3D47-4312-85E5-472F28A4C46B}.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C199007B-0109-42d5-B613-08E603677B84}.exeC:\Windows\{C199007B-0109-42d5-B613-08E603677B84}.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{476D9A55-CEC1-46fd-86E6-5DEF3A9EB3D0}.exeC:\Windows\{476D9A55-CEC1-46fd-86E6-5DEF3A9EB3D0}.exe50⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{EEA91F35-AE46-4580-B820-C5A468872E5E}.exeC:\Windows\{EEA91F35-AE46-4580-B820-C5A468872E5E}.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{28CF50BA-889B-4356-A040-393F8044CDDE}.exeC:\Windows\{28CF50BA-889B-4356-A040-393F8044CDDE}.exe52⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{AC8EB82B-408A-41b8-A0A5-1E0DE1168771}.exeC:\Windows\{AC8EB82B-408A-41b8-A0A5-1E0DE1168771}.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC8EB~1.EXE > nul54⤵
-
-
C:\Windows\{DAA7086D-4ADF-4e18-8768-F60480334A00}.exeC:\Windows\{DAA7086D-4ADF-4e18-8768-F60480334A00}.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{51044596-100C-4047-A94A-491D1B0EFFF1}.exeC:\Windows\{51044596-100C-4047-A94A-491D1B0EFFF1}.exe55⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D4C575B8-D9C5-413f-A0D9-A8A58D0CE5C7}.exeC:\Windows\{D4C575B8-D9C5-413f-A0D9-A8A58D0CE5C7}.exe56⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1BE5E24C-E129-49bc-8BA6-E970F5FEEB3B}.exeC:\Windows\{1BE5E24C-E129-49bc-8BA6-E970F5FEEB3B}.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{DC610B8F-8123-49ae-9723-F97BCFF0A093}.exeC:\Windows\{DC610B8F-8123-49ae-9723-F97BCFF0A093}.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F2636712-029E-4e2b-986B-1EC9A3C9E860}.exeC:\Windows\{F2636712-029E-4e2b-986B-1EC9A3C9E860}.exe59⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{193CD24C-BE53-4f62-80D6-D01E2A417ACA}.exeC:\Windows\{193CD24C-BE53-4f62-80D6-D01E2A417ACA}.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{CF5C5B94-6290-459d-893E-5143D5718ADA}.exeC:\Windows\{CF5C5B94-6290-459d-893E-5143D5718ADA}.exe61⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3C4133BB-AD5F-4072-962A-B9C6C62D46CD}.exeC:\Windows\{3C4133BB-AD5F-4072-962A-B9C6C62D46CD}.exe62⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5D240771-72CE-40fa-BA1F-238C4C98C30E}.exeC:\Windows\{5D240771-72CE-40fa-BA1F-238C4C98C30E}.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{6C0F95D7-FAC5-46f0-8A43-836C4F52FCEC}.exeC:\Windows\{6C0F95D7-FAC5-46f0-8A43-836C4F52FCEC}.exe64⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C0F9~1.EXE > nul65⤵
-
-
C:\Windows\{3561D533-7893-4184-ABF9-9F1D139185DD}.exeC:\Windows\{3561D533-7893-4184-ABF9-9F1D139185DD}.exe65⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\{5F05B382-C267-4a62-B166-933E663C1741}.exeC:\Windows\{5F05B382-C267-4a62-B166-933E663C1741}.exe66⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{048DEFA1-F254-4b62-BC97-1E38D21CAE39}.exeC:\Windows\{048DEFA1-F254-4b62-BC97-1E38D21CAE39}.exe67⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{01CBC9BD-64E7-4604-B769-039E278BD93F}.exeC:\Windows\{01CBC9BD-64E7-4604-B769-039E278BD93F}.exe68⤵
- Modifies Installed Components in the registry
-
C:\Windows\{9BE1C449-6544-408f-8B6E-6317388406F2}.exeC:\Windows\{9BE1C449-6544-408f-8B6E-6317388406F2}.exe69⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{FEBA69D1-D79D-4840-AF03-7422DA19E4AB}.exeC:\Windows\{FEBA69D1-D79D-4840-AF03-7422DA19E4AB}.exe70⤵
- Modifies Installed Components in the registry
-
C:\Windows\{BF97D121-F614-496d-A761-CA1B0BBE858A}.exeC:\Windows\{BF97D121-F614-496d-A761-CA1B0BBE858A}.exe71⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{2D42FC6C-1807-48ce-95E6-1169A0A36A8F}.exeC:\Windows\{2D42FC6C-1807-48ce-95E6-1169A0A36A8F}.exe72⤵
-
C:\Windows\{67FA5347-58B9-4d88-8FAD-B37829A629DA}.exeC:\Windows\{67FA5347-58B9-4d88-8FAD-B37829A629DA}.exe73⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{85100AF0-EFC7-4ad8-98EA-7BCD1C48F957}.exeC:\Windows\{85100AF0-EFC7-4ad8-98EA-7BCD1C48F957}.exe74⤵
- Modifies Installed Components in the registry
-
C:\Windows\{5322F418-B608-4f56-94BC-2FC72A4B8351}.exeC:\Windows\{5322F418-B608-4f56-94BC-2FC72A4B8351}.exe75⤵
- Modifies Installed Components in the registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5322F~1.EXE > nul76⤵
-
-
C:\Windows\{F7588000-BBEB-4d83-B269-B3069FABE8A3}.exeC:\Windows\{F7588000-BBEB-4d83-B269-B3069FABE8A3}.exe76⤵
- Modifies Installed Components in the registry
-
C:\Windows\{A010B4F6-528D-49a5-A0B7-4CFF42FC7CED}.exeC:\Windows\{A010B4F6-528D-49a5-A0B7-4CFF42FC7CED}.exe77⤵
- Drops file in Windows directory
-
C:\Windows\{2EA591CC-1922-44e7-9047-35EF9881449E}.exeC:\Windows\{2EA591CC-1922-44e7-9047-35EF9881449E}.exe78⤵
- Drops file in Windows directory
-
C:\Windows\{A6722B9C-E39C-44bf-AA20-387ACB17DE2C}.exeC:\Windows\{A6722B9C-E39C-44bf-AA20-387ACB17DE2C}.exe79⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{B9A5AA6F-84EE-48c6-9BD7-651A4B3AF061}.exeC:\Windows\{B9A5AA6F-84EE-48c6-9BD7-651A4B3AF061}.exe80⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9A5A~1.EXE > nul81⤵
-
-
C:\Windows\{FE3DFFE4-1E30-488e-8CC1-C28402A6F684}.exeC:\Windows\{FE3DFFE4-1E30-488e-8CC1-C28402A6F684}.exe81⤵
- Modifies Installed Components in the registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE3DF~1.EXE > nul82⤵
-
-
C:\Windows\{6196EABD-E226-4f32-91BE-42FE8AF727E6}.exeC:\Windows\{6196EABD-E226-4f32-91BE-42FE8AF727E6}.exe82⤵
- Modifies Installed Components in the registry
-
C:\Windows\{AD3A5B6D-6D7A-4ee3-980D-4EC82546FBE5}.exeC:\Windows\{AD3A5B6D-6D7A-4ee3-980D-4EC82546FBE5}.exe83⤵
-
C:\Windows\{F80D0298-35EF-4f07-A119-E86ECAC19E2D}.exeC:\Windows\{F80D0298-35EF-4f07-A119-E86ECAC19E2D}.exe84⤵
-
C:\Windows\{8C583FB5-AB2C-483b-899F-4AF133EB2698}.exeC:\Windows\{8C583FB5-AB2C-483b-899F-4AF133EB2698}.exe85⤵
- Drops file in Windows directory
-
C:\Windows\{7FB6B5CC-D7AC-4bc5-879D-B9040509B4B4}.exeC:\Windows\{7FB6B5CC-D7AC-4bc5-879D-B9040509B4B4}.exe86⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{B1B19C61-6747-4702-9CEB-5FBFA63A6D22}.exeC:\Windows\{B1B19C61-6747-4702-9CEB-5FBFA63A6D22}.exe87⤵
- Modifies Installed Components in the registry
-
C:\Windows\{1A34657C-F2F2-46cd-B489-96CB5287E927}.exeC:\Windows\{1A34657C-F2F2-46cd-B489-96CB5287E927}.exe88⤵
-
C:\Windows\{C4B6282E-C515-4b2c-B327-5CE67B26FCA0}.exeC:\Windows\{C4B6282E-C515-4b2c-B327-5CE67B26FCA0}.exe89⤵
- Modifies Installed Components in the registry
-
C:\Windows\{9072BC53-25BC-4ef3-874B-431E1C0665CA}.exeC:\Windows\{9072BC53-25BC-4ef3-874B-431E1C0665CA}.exe90⤵
-
C:\Windows\{419DD0D3-0589-4868-AA41-22464314BAF4}.exeC:\Windows\{419DD0D3-0589-4868-AA41-22464314BAF4}.exe91⤵
-
C:\Windows\{2AAB03A4-EB42-453f-AF8E-9D6FEF771205}.exeC:\Windows\{2AAB03A4-EB42-453f-AF8E-9D6FEF771205}.exe92⤵
- Drops file in Windows directory
-
C:\Windows\{6BCB9690-BB89-4d77-8763-A3EC7469C0AB}.exeC:\Windows\{6BCB9690-BB89-4d77-8763-A3EC7469C0AB}.exe93⤵
- Drops file in Windows directory
-
C:\Windows\{08EB6A5D-0F6E-49b3-99E3-106EF192276D}.exeC:\Windows\{08EB6A5D-0F6E-49b3-99E3-106EF192276D}.exe94⤵
- Modifies Installed Components in the registry
-
C:\Windows\{F55A580E-9DDB-425e-9367-17B31472AD72}.exeC:\Windows\{F55A580E-9DDB-425e-9367-17B31472AD72}.exe95⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F55A5~1.EXE > nul96⤵
-
-
C:\Windows\{6CA67982-60ED-45ea-B193-B670F42FEC63}.exeC:\Windows\{6CA67982-60ED-45ea-B193-B670F42FEC63}.exe96⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{47F3B051-112E-42e3-B82B-BFCD40631850}.exeC:\Windows\{47F3B051-112E-42e3-B82B-BFCD40631850}.exe97⤵
- Drops file in Windows directory
-
C:\Windows\{2DE4009E-4390-432f-9F11-55E38CF7ABF9}.exeC:\Windows\{2DE4009E-4390-432f-9F11-55E38CF7ABF9}.exe98⤵
-
C:\Windows\{A1A00A11-FAFD-4d5f-BEA5-A121D27DACFD}.exeC:\Windows\{A1A00A11-FAFD-4d5f-BEA5-A121D27DACFD}.exe99⤵
-
C:\Windows\{DD6C00A7-7556-497b-A1E0-E76951778B81}.exeC:\Windows\{DD6C00A7-7556-497b-A1E0-E76951778B81}.exe100⤵
-
C:\Windows\{D5311A15-3F09-42b0-A014-90CEDF176D8B}.exeC:\Windows\{D5311A15-3F09-42b0-A014-90CEDF176D8B}.exe101⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{DE83BBF7-D6A6-4a85-B378-AC648CD57B0E}.exeC:\Windows\{DE83BBF7-D6A6-4a85-B378-AC648CD57B0E}.exe102⤵
- Modifies Installed Components in the registry
-
C:\Windows\{737C6727-4962-4007-8143-F970BB4ADCDD}.exeC:\Windows\{737C6727-4962-4007-8143-F970BB4ADCDD}.exe103⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{737C6~1.EXE > nul104⤵
-
-
C:\Windows\{E349FAB7-CF46-480e-9ADF-84915D72F84B}.exeC:\Windows\{E349FAB7-CF46-480e-9ADF-84915D72F84B}.exe104⤵
- Modifies Installed Components in the registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E349F~1.EXE > nul105⤵
-
-
C:\Windows\{1D84CCD2-569E-492e-BFE5-854441AE7D55}.exeC:\Windows\{1D84CCD2-569E-492e-BFE5-854441AE7D55}.exe105⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
C:\Windows\{94CB4ECC-9723-45be-BF96-3EC4B6998D3A}.exeC:\Windows\{94CB4ECC-9723-45be-BF96-3EC4B6998D3A}.exe106⤵
- Drops file in Windows directory
-
C:\Windows\{731E225D-A552-4d5a-9568-B2061013DE65}.exeC:\Windows\{731E225D-A552-4d5a-9568-B2061013DE65}.exe107⤵
- Drops file in Windows directory
-
C:\Windows\{02D2C06E-B632-46d9-A40A-15BDAF3C6F62}.exeC:\Windows\{02D2C06E-B632-46d9-A40A-15BDAF3C6F62}.exe108⤵
- Modifies Installed Components in the registry
-
C:\Windows\{E7B06599-4262-4205-9607-6F8E1CAE72B3}.exeC:\Windows\{E7B06599-4262-4205-9607-6F8E1CAE72B3}.exe109⤵
- Drops file in Windows directory
-
C:\Windows\{75FB6AE7-6B3C-4c10-B3FC-BBC0B64ADD3F}.exeC:\Windows\{75FB6AE7-6B3C-4c10-B3FC-BBC0B64ADD3F}.exe110⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75FB6~1.EXE > nul111⤵
-
-
C:\Windows\{144EF226-81D8-4cdc-98DC-64F554016DA7}.exeC:\Windows\{144EF226-81D8-4cdc-98DC-64F554016DA7}.exe111⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{144EF~1.EXE > nul112⤵
-
-
C:\Windows\{53E3F65C-59AA-4619-AC18-9FEB0089B6E4}.exeC:\Windows\{53E3F65C-59AA-4619-AC18-9FEB0089B6E4}.exe112⤵
-
C:\Windows\{B618FB7A-12CA-4435-ADA2-D5D8A8E6D7D9}.exeC:\Windows\{B618FB7A-12CA-4435-ADA2-D5D8A8E6D7D9}.exe113⤵
- Modifies Installed Components in the registry
-
C:\Windows\{5560D454-8CA9-4044-88DE-B9C478571C17}.exeC:\Windows\{5560D454-8CA9-4044-88DE-B9C478571C17}.exe114⤵
-
C:\Windows\{98A5A819-CB40-4dee-995A-1FC2F658A54F}.exeC:\Windows\{98A5A819-CB40-4dee-995A-1FC2F658A54F}.exe115⤵
- Modifies Installed Components in the registry
-
C:\Windows\{D024CBB8-7AEC-45ba-9C76-C62420B0660A}.exeC:\Windows\{D024CBB8-7AEC-45ba-9C76-C62420B0660A}.exe116⤵
- Drops file in Windows directory
-
C:\Windows\{125CA564-FFA1-4524-B7AB-E86BA73A21A1}.exeC:\Windows\{125CA564-FFA1-4524-B7AB-E86BA73A21A1}.exe117⤵
-
C:\Windows\{C469E80C-C08B-4a02-8CB8-D5BE7F2F4BDF}.exeC:\Windows\{C469E80C-C08B-4a02-8CB8-D5BE7F2F4BDF}.exe118⤵
-
C:\Windows\{5F0CD1E8-A199-45cd-9378-7BD6640E4FCA}.exeC:\Windows\{5F0CD1E8-A199-45cd-9378-7BD6640E4FCA}.exe119⤵
-
C:\Windows\{63ED721B-2B41-4a7f-8CB5-B1C8E67BFBE5}.exeC:\Windows\{63ED721B-2B41-4a7f-8CB5-B1C8E67BFBE5}.exe120⤵
-
C:\Windows\{71E38D6F-7593-4c14-9E91-D2E7412BD345}.exeC:\Windows\{71E38D6F-7593-4c14-9E91-D2E7412BD345}.exe121⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-