| mal_adduser.exe | |
| PE32 executable (GUI) Intel 80386, for MS Windows | 73802 bytes |
| 2016-12-01 14:26:03 | |
| ce7ac6478624596f0e9c6e58a78eaecc | |
| eea6244863e3850b9ca8160ad4a23568d300e98d | |
| 94aec9ce9358224b24d8d649ff4248a46bb98f795be55da32f2bafcabcc786e9 | |
| 7eb639db74c3e59d4fa71b22a09de4c49639a94b5e50786793091d19861df8e7c66c15452f67d49d55ac56f7029f1bdbe941a91df5a5c04301f35ddbfa7d5d25 | |
| 1536:IdAavRCCbf7z+ihVXFPnEvkiIaUbMb+KR0Nc8QsJq39:U7yqV/g9Ebe0Nc8QsC9 | |
| 481f47bbb2c9c21e108d65f52b04c448 | |
| N/A | |
| Source: |

| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor |
| HKEY_CURRENT_USER\Software\Microsoft\Command Processor |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups |
| HKEY_LOCAL_MACHINE\System\WPA\Starter |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName |
| ActiveComputerName |