Resubmissions
23-07-2024 17:59
240723-wk4grs1hrl 1023-07-2024 17:56
240723-wjg75svcla 1023-07-2024 17:55
240723-whgvzsvcjg 823-07-2024 17:52
240723-wf3pns1hll 823-07-2024 17:45
240723-wbtafa1gpr 1023-07-2024 17:42
240723-v97eaavane 1023-07-2024 17:40
240723-v8625a1fpm 823-07-2024 17:39
240723-v8bafs1fll 823-07-2024 17:36
240723-v62dvs1eqq 10Analysis
-
max time kernel
466s -
max time network
466s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
23-07-2024 17:59
General
-
Target
https://github.com/Da2dalus/The-MALWARE-Repo
Malware Config
Extracted
metasploit
windows/download_exec
http://149.129.72.37:23456/SNpK
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP09; NP09; MAAU)
Extracted
azorult
http://boglogov.site/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
UAC bypass 3 TTPs 5 IoCs
-
Windows security bypass 2 TTPs 1 IoCs
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (172) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 2 IoCs
-
Blocks application from running via registry modification 13 IoCs
Adds application to list of disallowed applications.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 22 IoCs
-
Sets file to hidden 1 TTPs 8 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 64 IoCs
-
Modifies file permissions 1 TTPs 38 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 10 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Modifies WinLogon 2 TTPs 6 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 11 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 21 IoCs
-
Hide Artifacts: Hidden Users 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 13 IoCs
-
Drops file in Windows directory 5 IoCs
-
Launches sc.exe 24 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 9 IoCs
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 17 IoCs
-
Modifies registry class 64 IoCs
-
Runs .reg file with regedit 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 10 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff801869758,0x7ff801869768,0x7ff8018697782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2872 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5204 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5104 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3016 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3744 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2992 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4720 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3544 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5512 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5440 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1536 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2944 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4556 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2940 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3920 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5324 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4844 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2900 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2940 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2168 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5240 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2168 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5240 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=876 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2944 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2512 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5428 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3360 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=876 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4428 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5496 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3600 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5308 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=4480 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=688 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5084 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5472 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5112 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5624 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5516 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5652 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2876 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5388 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5560 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2944 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5544 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2992 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3920 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4824 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5036 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5596 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3744 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2876 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4888 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=960 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5628 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=916 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5020 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4720 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3600 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5764 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5688 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5876 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4816 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5020 --field-trial-handle=1784,i,15866320099199915806,14687125744150232163,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\FuckSystem\Xyeta.exe"C:\Users\Admin\Desktop\FuckSystem\Xyeta.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 4962⤵
- Program crash
-
-
C:\Users\Admin\Desktop\FuckSystem\Xyeta.exe"C:\Users\Admin\Desktop\FuckSystem\Xyeta.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 4602⤵
- Program crash
-
-
C:\Users\Admin\Desktop\FuckSystem\Xyeta.exe"C:\Users\Admin\Desktop\FuckSystem\Xyeta.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 4642⤵
- Program crash
-
-
C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"2⤵
-
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"2⤵
-
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"2⤵
-
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\xpsrchvw.exe"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\FuckSystem\ImportRedo.dwfx"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FuckSystem\HeadTail.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FuckSystem\HeadTail.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FuckSystem\HeadTail.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FuckSystem\HeadTail.vbs"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\FuckSystem\CobaltStrike.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\FuckSystem\CobaltStrike.doc" /o ""1⤵
-
C:\Users\Admin\Desktop\FuckSystem\Bumerang.exe"C:\Users\Admin\Desktop\FuckSystem\Bumerang.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\ddraw32.dllC:\Windows\system32\ddraw32.dll2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 200 -s 3043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\ddraw32.dllC:\Windows\system32\ddraw32.dll :C:\Users\Admin\Desktop\FuckSystem\Bumerang.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\FuckSystem\Blackkomet.exe"C:\Users\Admin\Desktop\FuckSystem\Blackkomet.exe" C:\Users\Admin\Desktop\FuckSystem\Brontok.exe1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\Desktop\FuckSystem\Blackkomet.exe" +s +h2⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\Desktop\FuckSystem" +s +h2⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h3⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h3⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵
-
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies WinLogon
- Hide Artifacts: Hidden Users
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\ProgramData\Microsoft\Intel\wini.exeC:\ProgramData\Microsoft\Intel\wini.exe -pnaxui2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regedit.exeregedit /s "reg1.reg"5⤵
- UAC bypass
- Windows security bypass
- Hide Artifacts: Hidden Users
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "reg2.reg"5⤵
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\timeout.exetimeout 25⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\ProgramData\Windows\rutserv.exerutserv.exe /silentinstall5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Windows\rutserv.exerutserv.exe /firewall5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Windows\rutserv.exerutserv.exe /start5⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB +H +S C:\Programdata\Windows\*.*5⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB +H +S C:\Programdata\Windows5⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\sc.exesc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/10005⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config RManService obj= LocalSystem type= interact type= own5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config RManService DisplayName= "Microsoft Framework"5⤵
- Launches sc.exe
-
-
-
-
C:\ProgramData\Windows\winit.exe"C:\ProgramData\Windows\winit.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\programdata\install\cheat.exeC:\programdata\install\cheat.exe -pnaxui2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Microsoft\Intel\taskhost.exe"C:\ProgramData\Microsoft\Intel\taskhost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\programdata\microsoft\intel\P.exeC:\programdata\microsoft\intel\P.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\programdata\microsoft\intel\R8.exeC:\programdata\microsoft\intel\R8.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\programdata\install\ink.exeC:\programdata\install\ink.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc start appidsvc2⤵
-
C:\Windows\SysWOW64\sc.exesc start appidsvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc start appmgmt2⤵
-
C:\Windows\SysWOW64\sc.exesc start appmgmt3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config appidsvc start= auto2⤵
-
C:\Windows\SysWOW64\sc.exesc config appidsvc start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config appmgmt start= auto2⤵
-
C:\Windows\SysWOW64\sc.exesc config appmgmt start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete swprv2⤵
-
C:\Windows\SysWOW64\sc.exesc delete swprv3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop mbamservice2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop mbamservice3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop bytefenceservice2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop bytefenceservice3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete bytefenceservice2⤵
-
C:\Windows\SysWOW64\sc.exesc delete bytefenceservice3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete mbamservice2⤵
-
C:\Windows\SysWOW64\sc.exesc delete mbamservice3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete crmsvc2⤵
-
C:\Windows\SysWOW64\sc.exesc delete crmsvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete "windows node"2⤵
-
C:\Windows\SysWOW64\sc.exesc delete "windows node"3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop Adobeflashplayer2⤵
-
C:\Windows\SysWOW64\sc.exesc stop Adobeflashplayer3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete AdobeFlashPlayer2⤵
-
C:\Windows\SysWOW64\sc.exesc delete AdobeFlashPlayer3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop MoonTitle2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop MoonTitle3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete MoonTitle"2⤵
-
C:\Windows\SysWOW64\sc.exesc delete MoonTitle"3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop AudioServer2⤵
-
C:\Windows\SysWOW64\sc.exesc stop AudioServer3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete AudioServer"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc delete AudioServer"3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop clr_optimization_v4.0.30318_642⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop clr_optimization_v4.0.30318_643⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete clr_optimization_v4.0.30318_64"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc delete clr_optimization_v4.0.30318_64"3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop MicrosoftMysql2⤵
-
C:\Windows\SysWOW64\sc.exesc stop MicrosoftMysql3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete MicrosoftMysql2⤵
-
C:\Windows\SysWOW64\sc.exesc delete MicrosoftMysql3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\svchost.exe" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Zaxar" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls c:\programdata\Malwarebytes /deny Admin:(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls c:\programdata\Malwarebytes /deny System:(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Programdata\MB3Install /deny Admin:(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Programdata\MB3Install /deny System:(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Programdata\Indus /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Programdata\Driver Foundation Visions VHG" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\KVRT_Data /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)2⤵
-
-
C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Blackkomet.exe"C:\Users\Admin\Desktop\FuckSystem\Blackkomet.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\Desktop\FuckSystem\Blackkomet.exe" +s +h2⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\Desktop\FuckSystem" +s +h2⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h3⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h3⤵
- Sets file to hidden
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵
-
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe2⤵
-
-
C:\Users\Admin\Desktop\FuckSystem\Brontok.exe"C:\Users\Admin\Desktop\FuckSystem\Brontok.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FuckSystem\HeadTail.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FuckSystem\HeadTail.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FuckSystem\HeadTail.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FuckSystem\HeadTail.vbs"1⤵
-
C:\Windows\System32\xpsrchvw.exe"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\FuckSystem\ImportRedo.dwfx"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\xpsrchvw.exe"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\FuckSystem\ImportRedo.dwfx"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\FuckSystem\CobaltStrike.doc" /o ""1⤵
-
C:\Windows\System32\xpsrchvw.exe"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\FuckSystem\ImportRedo.dwfx"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\xpsrchvw.exe"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\FuckSystem\ImportRedo.dwfx"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\NJRat.exe"C:\Users\Admin\Desktop\FuckSystem\NJRat.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\Desktop\FuckSystem\NJRat.exe" "NJRat.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Users\Admin\Desktop\FuckSystem\RedBoot.exe"C:\Users\Admin\Desktop\FuckSystem\RedBoot.exe" C:\Users\Admin\Desktop\FuckSystem\NJRat.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\66656745\protect.exe"C:\Users\Admin\66656745\protect.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\66656745\assembler.exe"C:\Users\Admin\66656745\assembler.exe" -f bin "C:\Users\Admin\66656745\boot.asm" -o "C:\Users\Admin\66656745\boot.bin"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\66656745\overwrite.exe"C:\Users\Admin\66656745\overwrite.exe" "C:\Users\Admin\66656745\boot.bin"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"1⤵
- Drops startup file
- Executes dropped EXE
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"2⤵
-
-
C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"C:\Users\Admin\Desktop\FuckSystem\WinNuke.98.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"C:\Users\Admin\Desktop\FuckSystem\Seftad.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\FuckSystem\CobaltStrike.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe"C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe" {0358B920-0AC7-461F-98F4-58E32CD89148} -Embedding2⤵
- Process spawned unexpected child process
-
-
C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe"C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe" {0358B920-0AC7-461F-98F4-58E32CD89148} -Embedding2⤵
- Process spawned unexpected child process
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3af5055 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5976 -s 4683⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Desktop\FuckSystem\Satana.exe"C:\Users\Admin\Desktop\FuckSystem\Satana.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 4683⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\FuckSystem\NJRat.exe"C:\Users\Admin\Desktop\FuckSystem\NJRat.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"C:\Users\Admin\Desktop\FuckSystem\SporaRansomware.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"C:\Users\Admin\Desktop\FuckSystem\Azorult.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Execution
System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
3Hidden Files and Directories
2Hidden Users
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
2File Deletion
2Modify Registry
8Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53a97266c0c325f36690eba5147dcdfc1
SHA1dc02b754bcacbb826b17bb2d383fce1b46623dac
SHA256c17f6bb53f7e886594d8af83502338a25e94dacd10d9c795cf4e9323e4de990c
SHA5124867ae034a5a0ed6dcd5541d0dad5923463eeb638ec89076725ecfb35eb1a3fbd9e30d45684b34d17c7c8a1b8dfa9f28754f655e8d0c1ee22e64b805958da079
-
Filesize
2KB
MD59ec4ec62b0d6d478d49927695a70da45
SHA10525261122bd32f8ef6595291916c1aee490d606
SHA256e223d0c4d98c6d92331e9080f7e6879e6e496bcb2fcecb5ea9e5f5ed46bb499e
SHA51233ea62c6b4090eea73a48d8b333cbcb6bf6b9be43ec34cfe34fc28d3a7533f3bda895f73aa33b155f30e371475a85cc967c35035a90707dc4662589b37834c78
-
Filesize
1KB
MD5117335d80074d228f4a583bb3ff9383b
SHA1d85b28515d4445353f2a2f6e1a9ddf093cfd40ed
SHA2567f0c440508b904980481300b4bd07c8435c37e1b3b49a18d41fb6a97df7d0d06
SHA512d143650aaf4d3b71775926b11d54217281f2ed2dfc710962f20cb13f0621e203634e8d432184429adb5ac53a5277d06e587492b3fb10ab634ecbf3d688187267
-
Filesize
1KB
MD553c8fd4e1ceefdacaf65a151ba7861f7
SHA129c66b777f82c9283ebef0154f5d33017355d214
SHA2560226d3ef2877bb1b20369c6d13657f31987a8bcebfd8791f777aeee68cc37ea7
SHA51242c6575737a05a2cf20559590b503a92aa8f59d8f0391a685a06f31809276176b1b3c7a5f66ac161ea05bb821066b03df7f890771516eb490d6fbe9ec4b90790
-
Filesize
1KB
MD5fd9a33b192c01fffbdb613284575c4ce
SHA15866fcb6ff0edd094fa889870dbde1487aefdb22
SHA256f9f80f2eac7eab9748c6c21e643020cdef472556d3f163b3c38511104d307f2b
SHA512312d62c209efe3b2b955cd611d3de914adc2ef634f373d60a8c55b07aa272ec9cc68b2692809302731e87233c3f9456fc123f634146f11bb40c83c556543ee72
-
Filesize
1KB
MD5c1331a0cb9060ac76a5d2bf7426a85b5
SHA1fab895516711e579cb57e5c51dde87bc96734abe
SHA25681ee4c4429d7c8dab83ba68bc57ac4c3d24cc88799b8d07c1c86898827ed34d7
SHA512bfbd1cd903ed9797f14e4924d5a05ce5e7ea98acec37a2716801d86ccd000bbe4c65ea34d56bc2aae3977d2732de4952a9b9db1ba3d2eb9aac84f2dede740502
-
Filesize
1KB
MD57dca60f84c8816c513625d27877cec73
SHA16c5db51d3513ae3ed221a59a220456b43237476b
SHA256ed030cd05279fd904254f49c9028b80475dad492d39bf1ee703f6440a376f23d
SHA51270076eefff7abe578ed482288c463fb07023b21659fb90cd41c8aa6e24500dadb6e8d1767fb50250d68bc73f5b9eb73de82f3f0f6fb9b98e8a50cc2de0d48606
-
Filesize
1KB
MD506da384d994d1f05580c8a05b1ff22a2
SHA1e80f5b88d54ebddcf800d0c38bca7b7e1ce042d9
SHA25677a3131d6934802fc74d9e64774724f25cbcfcb8a90ed11a222ad082ae7c67fe
SHA512f1bb4feb9bfbecc2cc61ca39c603b8110490a7cda73a7fa6236de3afe13c0be55f552398170726e8fba32f7bede350e9273fc75a990b2a3cbb3b4acf06842286
-
Filesize
1KB
MD5db10eb558b0cd7b8dc05aa537f90608e
SHA1f55b6406169df27dae7419d6fbe9b0a7a7f28946
SHA2567a60d18c42af8154d95655fb923060658cbce1215e17e3a8432dd608e9075816
SHA51287a2de519e2416b7e841920c973a3028864930ad62d02889185826b4355a24df2d7bd4356cb19c8fd9255757b4f47d794113287a3993ec733b22cca92be76051
-
Filesize
1KB
MD562b9bfe8dd8a78c00bfd87d2afcec08f
SHA1d1d24d33ceec687179be3f4c65df66feb564ffe8
SHA2566881201840b6256a55d3fca3553d572cf38e848096168c2d0fc647fa7d020166
SHA5121198b58c735205aa3844ba4da89e693b7c43e6b6f9863e782d66daff6979459c460660c66b2493c759647fde4578cb58508dbe25745104e95f6c082e1947e7b3
-
Filesize
1KB
MD5a991410e220b4bf2c161ef356bb4dbb0
SHA15ff91e1af04fad6ce6438ce8c66fbaf7136ae518
SHA25660e09909a337e8b443e45b7df0f8b14b350e493a5885c3f0bfcde7b04a3b264a
SHA512b4c2755ab4c74af556ee21c29508a1060db64920736284c3d6b9623ac1c142bb2caf5bbf2fd7a565109600c7d88bfd27e1b5e5689146c88cdd4b8782d1074466
-
Filesize
1KB
MD53033a194ffb3f0b80da77f5f865bd103
SHA1cb5791b96d394d48d51a22bac928e38d409d64cc
SHA256948ee57a9f09267b6cdc98ec8cf581229712c3b162cf1b16617c3212911f96c6
SHA5128da50832eb46e2d3cf0dba6bbe57d6e38f5b017afb2dbbcfda10b84fc72061de178ebe1c30dc509046f58e3d6ae615c141e6ac9572c6c9bad8c0b51ddfab6aa4
-
Filesize
1KB
MD511a22d3a07811b8d77f2d5c746a5545e
SHA1078df194836aebf691edcfa149e1db45ba3c0b6b
SHA256daeeb38147b64224e63cd85cf679bcd439fa8d0ba76225094a0c8612550dbd65
SHA5123eeabc73ee18f4ed0f3fd3f45ee516d1ca481affcdae56421d470940fac4b1ead3d07a9561ac834ba017334975afa41d45f0de5e2d48ee7e95f3b0e08949cad9
-
Filesize
1KB
MD5e66e750e22524b7fd1d8c5c6a4072d24
SHA1a82fb48828ae4800477f0a14709549b58d96570d
SHA256c5b1415853cad491f929c782344a387c8ff845decf558bc4bc9567c355e27a73
SHA51289e3ab4f80bc2542b1de0e01e320f282fe333bbdd3a333af8256bbbe094d7b3bdb6bc436af4ba88c9e81457cfeb116a0139dca4e3dd63b8eab2ab57a280732dc
-
Filesize
1KB
MD5d79d5f101a31aa84fb3d6531c71306a5
SHA1f11db7122b28e0599128341af919c23ed8b2cc92
SHA2566b27cf8bc7ba4e3531a20518672752817b04795f8fbfb03845e4700ee6890f0c
SHA51294fe5a9ceef9935fa14b99e737d13defc3796da5a7dc042104dc3fb478b781d1b252cf03788776f01a87ebc4c2bfbc24aebb8880b4ba9fda503449573a11d629
-
Filesize
1KB
MD57b30e6de6b7ccc3a94454d683027f089
SHA194c92df675304d7218a6cb179843ff71c64af1d2
SHA2562e9c5c1db142c0654a36c9de7544cca592ba8d05e012fc104b67a0277ab67125
SHA51209fbf4735121564b2ccf5961e8abc1f9c2df27b68865b26fe8e26cd34267a4d8ebc8a902efee52ceab7e1af25889381ba251a58fe8f71dadcc9dc2f5614f73a4
-
Filesize
1KB
MD5e38eb6ad774774c7de49ecd36563c6c4
SHA110eba0d5c53c11df850a1ff4a8fcc4d13e9bf154
SHA256ddce2de194706aec635e7193c6b90fde319e1eb1d97ae6ceed0af0b929da5560
SHA512474c3bfd4081e77afe12c3f15a44177bd6390468a32b7c2e3bb5a34bfac66b351ae549951656c168b2561d15894442df3b1d505f01dd187f7720b469e96ac375
-
Filesize
1KB
MD5cd75dfcd36280a9324be748d57df65b1
SHA135781f5a6e6dac7b069accbcb7c6ff7fd2fd4b74
SHA25661cdfc88d9cdeb68c56d5d3cc331743888fd068543143137283335b10124d604
SHA512068ddd75e9050bb379db1cbe6ff385c08e2176c88e9652af163732d43afd60ecc594071e10317395f6cd3b41c87a4cf77a909d814c2ffc1f8e4ff93f7efb6bd6
-
Filesize
1KB
MD5840bae413f896492f424ffb066b37976
SHA15a72883d208b1f336584aee7cca35f3735a274b8
SHA256d3b64d86c77530386348ba9537ce8f20fa269eefcca851bdf4774c6341203c52
SHA5121d2220fe10d33a6a8f288c3eb493b685f39b563f63955e640cd6bca008b8c9bf5a4efb208df7a2dd57bc49fa384e9801de149560a2699b3352a03d8157a04696
-
Filesize
1KB
MD58ac9ba11bef820562d3a797498324713
SHA1c68f4daa00f06534004c4dfafb7ccdc0d20a7f89
SHA256f146ffd9fb88e045e03b06a0f0b031907bc41ef2779ad9c88f96d966a6026cf5
SHA512d66db41032877e33b0c21440317c79ca2216bccd585f1d73a6c775d55122063606c83863bbc2f828d80f99b9ad2946370027c2fb04ecded6275765c9d50e7b9b
-
Filesize
1KB
MD535aca033df51058e9c9d4c0b9d1f6408
SHA1528f3dd74bf6dd425e64f882846ff78b81b64bc2
SHA256b4bd86bf6637c4de839dca3ceb174d56d9ca2bc6272f4daa72a809e4bea54dda
SHA51233ebe601afdd227b83e71ce0b8b2d874413edb23f3dd627d0918dcbcadd7fd4013ae5af913dadda01df93bcf8555041fc6e72661f1173b12aadadd3ead437948
-
Filesize
1KB
MD574483d33239d00ba71c584ea84e55751
SHA1b0c79265e68fee8d4c4a36341522bbfb3d6d0867
SHA256ffefdfd4c57de7c2d0897f303e1257897d3e7ce3dff9244cd2274c15f8d81e9d
SHA51259f6a8ea1664514b13bca82de35f1e1dad80d29fc9ab6abafb041c1f0cb51f292d7bd83108d22a7be6f83498ab4131652d84ccd0217d8ebf6b32da8a25719ac2
-
Filesize
1KB
MD5791a942bb530839e7b21aa28ec92128c
SHA14f18d95faeb1b1c5d2aaf27378fa3c1cb601c43d
SHA256e6f66910616818971502b123d116819eaf2f955769ba8c30a101abda4b7f6f45
SHA5127d6e89d56556c06127b94c60c667908679d80475b65420d9d42697ac8ddc64007bdc607215f5d65c2cffa5f6984bce47b47875ace5d5104e4988b3c8d2a56ba2
-
Filesize
7KB
MD53545eb7cc0a7d74af77f21e8cdd2a8cf
SHA1b874a5cf07e7ef435e8af6de7a523f86afb50515
SHA2561e8392ab16f2582c1a4f68ee5450ac30d146391a1a7de2b12e85bed335c15634
SHA51251433fad91cdf4e265803a5632be14761c370f2f0dee943189151e769bee7a43ddcd434b1dc9426f9e30cc0111ba4339e9f694316914402d2a08e3c949e95eed
-
Filesize
7KB
MD5af242a9d8ef70829eb4a449e01412b9e
SHA19944a01f57331ab2ebcc457a39fe222a5dfae928
SHA256408c6406e5045bf0f894ab89f663eaffa52b280253b5ca2544ce08c0d1cf04c6
SHA5129cdc3d4f06ef525181bb28a585494b68d8a28afc104ac66e5c2a2ada94902d9e0af023eb4a75e6a83e4300651e45061a11c4989342b2c40c27b2abdfd340a785
-
Filesize
7KB
MD5dce6978797e638f82428aa789c3a931f
SHA1e60b5758bddece188c05cef1b83c258215395760
SHA256c954a05a22387a6f14126a888f238d47d3a9cfce370ddb48969de61efb2ba052
SHA5121222206115e0bda28bb838f5403fc997cbe8cc47120f135e4fedc504afe9e6e8a4b0515e086f21d47f39b40ba836f8eb7b386abf72cbeed123a92d5152724a56
-
Filesize
7KB
MD54ac138ee1228842246945b6d29ead7c2
SHA1fcdfe3c6640f258f3c2ef1832583e9570e844dbe
SHA256e50477cb281b42225e719e091bfcf2dbdaca7f0fa9bef5bd4f9bbb1e0352c4c1
SHA51219de54c48987536a9ccbc784455f99a21377a769a0391db69052660fc6f306651cff89212d5764310cc458a3f64aa29cfc173ade52d10566215f41ba7975399d
-
Filesize
6KB
MD5dff128f0238da65153cce577e3b5f45f
SHA10ddfa3b4dccc147ae2789617f93616c319c4dd1f
SHA2561590299b860007fefd0bbfcf7d95464b55a84d711c1c5fb6ac933c31403f3263
SHA51230ba5e2203355e069d3b1fd0a5a7b876c24d9b0f6caa307f1d7dfde02fb93360b0e7017eed7f1057cfcb532b08975e60059da39a19f0752b6b49bbf82cda876f
-
Filesize
6KB
MD509000abbde118e91957306b2cbda34ee
SHA1dc038127cba951d0b4a673b9f8fadacc5b56e08a
SHA256040f203a8243284807ec2a64536345e5f312c26f89267f961f7f1b545091de77
SHA51267b43db9d413cf644c1832a30ffc18ab781cffa942e6231be3130dfc4171e604c2feb4956ce57b15fdb168880b47ef3f7cfa40c8e6d2ffb59096b1036057d89d
-
Filesize
7KB
MD5902c52f65d5233001ca568b1dbc93bb6
SHA13688d214d644c47113c08e236e89786f65985d67
SHA25657ee9e56c7a6b1c8f15c384e83dd930e00701f0d8c65de77308d222bedc7d0c8
SHA512d0436d43f5b64a0ca38dfdd4ac63fe5e02c880852b8951fd16d1286d095369675e0f5f99e264737ffa92ddc95052405a9ef025705e3534cbf79af66278dbcf26
-
Filesize
6KB
MD552df9e00a889ba53fd5cd3f2cbc3fba0
SHA18fa10270baa5f869df0bf5651500304cc9fd5366
SHA256c3bde8c46f9ef53159b1943ee1b5d97d6d4002e69499c78441b28ce2cea17fbc
SHA512b5ef9c5b1c869e5eef43c272ddbe5ecfc85d85b3094bd238f6e25a7b787c3b6f1cdabc74ee5e6c9b9e8900c95b67c9f0174cf711e5d72b6e4d8d3087618ca439
-
Filesize
7KB
MD578f65e415176a49deccfa3e6234e91eb
SHA102d72cd0ce1ea75d33c76799266eded1405ee01c
SHA256c09415d5ab0decf48dc89aa141fe8c595f698e0d513b3309f15a74e15868cb93
SHA5121a90bd4c3f451e2e9b728f937bc93debcf322f1710ae90993cebc8b3dc16b5c393907f67c42d2e057337de9997515b8a8111a25203af3438e5310629daeeff97
-
Filesize
7KB
MD5291d58c4a2c9addb12477834a619cbda
SHA16699f03b8c780e64810694d3ffabd01b5c3eda89
SHA25645dc3711b546af91e49fdb5ccf3219359bbed813d86340d2e84b1f561c7352d2
SHA512f34bc0b61606f5a0e9a388863dbee842555f8b76d0603e6f00c42b89c5f45fb4ba47cfab836ffe490d454845b32cb6f29c31e1a2190155757ffeb0d2d5af6177
-
Filesize
138KB
MD5511b816efaa36ed38dca4a0c10fd42f7
SHA12c7276fa6b68a35d046fe99aa6f9ca2a97650c71
SHA256ac14f517277ce404f6f0a50e7ff75944fa292c8879bab507655c6bbe54f765e8
SHA512c9b05df9c4a54cd2a17f8c1450dc65c9c88d0e38e9436aa7458cc9789dceeaa87c5da0c9c518935cfc5da45fe33c48c337df5061dab717132379fd74633911b4
-
Filesize
138KB
MD537e50b6f33608057d1c02d8ac94459d7
SHA11020fb8eb902798655b2e824d9598b9a78cf2946
SHA2562363c6958256b5b7ac3c76578ff29c71ad978c71613399d5db9c87224c681409
SHA5125c2309e0691b6a6e96dff3ea6b7ea7281aaec1cac12d952975bf3b55e0f9d5c2e6bef971bc73647b37d294a0e1a044bcdc08108416af02dd59538c26ac7523de
-
Filesize
137KB
MD56099768fe1a00541a7ffe70efb26f5f7
SHA1c2813610e3dd4f2762fd022a9aa01a31fea8e7be
SHA2569477bf6f905d348696fad992efdfb593793c4a042cd714b692177b0abc2a6cb5
SHA5125151a538059a8a47f09c0a4365392e2a9a5fe538a9b3942f694ed1a257b662ad0f121ccbb21ca5a353577b30d5b146b8cb67e5599c8698f9281ad756744b5359
-
Filesize
138KB
MD515ec4b78b1e905d1f6a1e96dcd2ba45c
SHA15163f6eb27f59b743adfeaee59ce76d56d39fb26
SHA25688f1a313c915fa42bed3b749322ef7100576ea19d56e9bb963d3dac862da75d8
SHA5129cc338521c0401630381ff62d61b43cd6618fcb3b815a10a6de1d35ee7cc9ea6897da713e8e0714b2c90913b4a594a6739278b0af62dd5e514c8bd020633bbfa
-
Filesize
138KB
MD566e4fc812254ac63b635b27d1d24f2ac
SHA1612ba4241e5ad53258642c8b838c16c900024edf
SHA256133f93e9d4adaf4c73129dce36439e8aaacc6fd9ee73ed62475e48e033e4ebc6
SHA51203d0916da5b7b3bff27a90b6d88df23b9054b73830eed178d344eeffbebb54da99bd239293d76b078e1e1526d0a5264245c809167119afa7368ef9af85dc9fb7
-
Filesize
138KB
MD5cc64ea32da62d2afd88c35c269da0ac0
SHA141a68591492e6c1630847450139e51022eed44ef
SHA2562d06fe19c9ddcba54d313e28ba134625f88bfa835b2d2737f86b6ae484bf660e
SHA5123dc9b5c7a0b094688037a8e72567f4a743cfc3ae77c8680cbbe8c9199dd4edd82b97c207d213b68915e72f703938d121e5b409998ab8450045bfe3596722c85a
-
Filesize
137KB
MD556381b694fbd4f90e938f3cd42b79cdc
SHA112e3cf926fd6ed53b8995f19ee5287903f910b6f
SHA2567f89160ddd2342b41087e3cb0e4fd3f2e7642d703eccc6400d5c9846c043c075
SHA51289abe40ab053a1dca680ebdbe0807a9598dc71a2e43c5688053af72aa4db24d5ba50cfe2ba45af6583d85a1299c657fb1027164dec93a00c29bebfde7fc5857d
-
Filesize
138KB
MD577d6d22a26a786167582853165e960fb
SHA1fcf4be5a71d6e1e53dc001aed2375ecdd953c4b0
SHA2566dbe77aaf6ad2377d045634449864a84f49ccf69b1846d51481ef7634c4295bb
SHA51250b480d3de14a5a54d1dc57a7108db7f4d08e04b03a60ab9c69e1235c6cb08dd8c6f572c91dddd4dd7bcce19b4aa90c179d4888f0cdbc04a5a141de70f38ef0b
-
Filesize
182KB
MD5a5a23792545fa6dd90d34bdf3b6c969e
SHA1b961d2d0fe04ad4f07b4d975ade55fb2671bb928
SHA2560cb6f28a3dfe9fcfe72b0038a0b36aa3f750bae4a9367cb4428728db5460cfc8
SHA512b325740a79dad6b34d854aba85703bc7e0d3d49eb329d491c7131570aa695810ac9d98d7a193bf94530d54f5a97788a550fd05cb08ada80f96c0f3446e97610b
-
Filesize
163KB
MD5ec9cf47649d031cf4c8dcb3cb41629c6
SHA1738f4e157a1f0b69255483d8f695dd16fa598df9
SHA256a9a324e2ae795bf39d286ca578ebffb61a13da85cd53186066d7901bc0df4bcf
SHA512260aec38ba36471550076c834505de13da88be78b3a1f90c7c208e0f5367952e2fff96aaa5046ed822bffbc4803917499270a8293ff115fe3ff5eea6ac4c8d12
-
Filesize
100KB
MD58a4942b90a5b98d8c55d98a787941311
SHA10e72c22ee1c1f5347af585a7ab120f48b3b13214
SHA25605bfc8f117b5cc1bdec082de5ab057c52adb84a2dce3c8e305602e290c5abe08
SHA5125226f9dd64da4a3dfe8a17ff9b845770e8ebc91569c4a084d5a32cb2a165b001320431eec92061888fd30d5565a4dfe1994acc4b255069bc4e397e54e4746f62
-
Filesize
108KB
MD5d4c75157d0c05aae3955f0c2ae9193aa
SHA18e977ef43d407b2a52e486fc7ccfd32075489631
SHA2568bb4417c3351765a7fbc072776e4ec5bc6771821b885ee14a8c10f40bb4a1d11
SHA512448d062cbc3764c3eddb8cddc2690b5ed72b62566cfce24b5000549511ceffb7f8e49afd5d5a0c64871732425331d7c5f178f1a81c400e288b065f05c4c17bd9
-
Filesize
104KB
MD527de064009f39647d3c8261a41adcc80
SHA1c5aed0fca572c4c22b0ed6973fab21448e927231
SHA256abc57dd27c160559df2ba0dce59ee02154ed4da735d1e6cdccd94b6001912d3e
SHA512cf5faad37036a63e96ef3dc80cbd62962df30b9833bb542289ca74421d0e6f8ff839989b558735e21b3ffad2ff0923ec4d87b3132d1a44bf7476e234fe31e355
-
Filesize
98KB
MD538cc4b166879ad7aeb10a993ee9664db
SHA12e26c7f3915b2a430286422b33e1090bbcd05b5b
SHA25697faea405cd86800c1e5f54301823550fa37ecf6f804e688bc566c47b1da9cad
SHA512273297cfe3b5a48ec4829d45fb5a1bc7d2ebfdef137be687b4d93b87b2b65bf7a785eca41a6e308072e376e4806f5002d389c6254fef193101fa09ef88a45d75
-
Filesize
264KB
MD559cda5cd48c21591ed835799396c332b
SHA15d8fe188d38e7aa407511a05434fd9b5b3343c74
SHA256be5e9d09f6845d5c8cdf1b56260e38e5a4075348efd54cecd38c148f5db4ce79
SHA512495185d4a25d418381bcc33880364aa58478f3828207c63c6b1a433c4ed61b1ddb9d6d381fb94e4f9e9be81499651fab37928a9db1946d390eaeb977bb7e96cb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
4.5MB
MD5f9a9b17c831721033458d59bf69f45b6
SHA1472313a8a15aca343cf669cfc61a9ae65279e06b
SHA2569276d1bb2cd48fdf46161deaf7ad4b0dbcef9655d462584e104bd3f2a8c944ce
SHA512653a5c77ada9c4b80b64ae5183bc43102b32db75272d84be9201150af7f80d96a96ab68042a17f68551f60a39053f529bee0ec527e20ab5c1d6c100a504feda8
-
Filesize
663B
MD5ed3c1c40b68ba4f40db15529d5443dec
SHA1831af99bb64a04617e0a42ea898756f9e0e0bcca
SHA256039fe79b74e6d3d561e32d4af570e6ca70db6bb3718395be2bf278b9e601279a
SHA512c7b765b9afbb9810b6674dbc5c5064ed96a2682e78d5dffab384d81edbc77d01e0004f230d4207f2b7d89cee9008d79d5fbadc5cb486da4bc43293b7aa878041
-
Filesize
261B
MD599e5c52974ae267578e32a4d3742e7e7
SHA1412bffa980f487750138fc6e8d535a7c6ec8d438
SHA256fc3b711b1be58731e24a45801dbead6f36c864129c2992e5e324cb3f93da3755
SHA512e411fa9e5318c5effd8da87d1434034ea9d1fb9d99365b74f240b2034ad9cf10532ecd9c10bc87d6c3bfed657857ec722c281759481d7a8fcf913e7078852c4e
-
Filesize
8KB
MD594b47c68cf5d6599b2fede82336d9a4c
SHA141743f99f8bc7600b552eda401e77072bf2a08f4
SHA256e7d30e6d9249163332f37472353ec97962e30277339ff699c4b8f65a6fc97c36
SHA512a46ca7057bc773e5e8ef5e9faf33848a35dbee40f2daa25e3e0b03a6d80a8dcbb58fef064b8cc01bd7015081c9c4d88cf67b12db4e9586c180c1416932464ccd
-
Filesize
1KB
MD51c15105e77f34eac88c6f7ee15b1e39f
SHA1ceb1fc1485f53129a2c974d9c3bf8276bc5507c4
SHA25644035c1d258d24921a7dce889b2891f51587a515b9110d4371723a75fbc39eda
SHA5120805b9151dede982db7201a50b6cdbc6a28a810c6e72b37f1223b7b8a78b5e8dd21a2f8149787fc0f147ca8dc5b22a3a9c8fac4b5662959187bcdf2bb3adb2a8
-
Filesize
3KB
MD5e2b59fcf6aee03977c6b1f92496fd569
SHA10080c70b674f11f1f9af07562229830581ee1de8
SHA25634eb511fb923361571ec9248c6fc1b8942fd6ee32e208ddfecef92c02394b3d3
SHA512444a1aad743af6928ab4615075e4494e07b0187f485a2cd8f58917c99266a63dad3a63c7cc3203d8a2259593f2f7daa86879271d27b7337d86e3bb63044a1357
-
Filesize
756KB
MD5c7dcd585b7e8b046f209052bcd6dd84b
SHA1604dcfae9eed4f65c80a4a39454db409291e08fa
SHA2560e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48
SHA512c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2
-
Filesize
106KB
MD5d7506150617460e34645025f1ca2c74b
SHA15e7d5daf73a72473795d591f831e8a2054947668
SHA256941ebf1dc12321bbe430994a55f6e22a1b83cea2fa7d281484ea2dab06353112
SHA51269e0bd07a8bdbfe066593cdd81acd530b3d12b21e637c1af511b8fee447831b8d822065c5a74a477fe6590962ceff8d64d83ae9c41efd930636921d4d6567f6f
-
Filesize
26KB
MD5b6c78677b83c0a5b02f48648a9b8e86d
SHA10d90c40d2e9e8c58c1dafb528d6eab45e15fda81
SHA256706fce69fea67622b03fafb51ece076c1fdd38892318f8cce9f2ec80aabca822
SHA512302acca8c5dd310f86b65104f7accd290014e38d354e97e4ffafe1702b0a13b90e4823c274b51bcc9285419e69ff7111343ac0a64fd3c8b67c48d7bbd382337b
-
Filesize
86KB
MD596ff9d4cac8d3a8e73c33fc6bf72f198
SHA117d7edf6e496dec4695d686e7d0e422081cd5cbe
SHA25696db5d52f4addf46b0a41d45351a52041d9e5368aead642402db577bcb33cc3d
SHA51223659fb32dff24b17caffaf94133dac253ccde16ea1ad4d378563b16e99cb10b3d7e9dacf1b95911cd54a2cad4710e48c109ab73796b954cd20844833d3a7c46
-
Filesize
33KB
MD5e0a3ab130609c80b452ee423d3a55355
SHA1f5408df5f8d2765738db8f5080bb88cab105c038
SHA256af1de4b7c65071f490cfd1425c45c9538fd7888cb7dc509304d8ec11cb046649
SHA5129326653d66a9866d517cdcdeb1abdf3fb8fdb2a8bc8c2324c916c10aabc7d5ca417c54c7409f0df6454041ad4c446b06b56510e7cc1eaa2b3cf54ec47cb79ae4
-
Filesize
300KB
MD5f52fbb02ac0666cae74fc389b1844e98
SHA1f7721d590770e2076e64f148a4ba1241404996b8
SHA256a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683
SHA51278b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0
-
Filesize
2KB
MD5a56d479405b23976f162f3a4a74e48aa
SHA1f4f433b3f56315e1d469148bdfd835469526262f
SHA25617d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23
SHA512f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a
-
Filesize
31KB
MD529a37b6532a7acefa7580b826f23f6dd
SHA1a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
SHA2567a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
SHA512a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818
-
Filesize
1.2MB
MD5e0340f456f76993fc047bc715dfdae6a
SHA1d47f6f7e553c4bc44a2fe88c2054de901390b2d7
SHA2561001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
SHA512cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc
-
Filesize
49KB
MD546bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
Filesize
48KB
MD586a3a3ce16360e01933d71d0bf1f2c37
SHA1af54089e3601c742d523b507b3a0793c2b6e60be
SHA2562ebe23ba9897d9c127b9c0a737ba63af8d0bcd76ec866610cc0b5de2f62b87bd
SHA51265a3571cf5b057d2c3ce101346947679f162018fa5eadf79c5a6af6c0a3bc9b12731ff13f27629b14983ef8bc73fa9782cc0a9e6c44b0ffc2627da754c324d6e
-
Filesize
24KB
MD54a4a6d26e6c8a7df0779b00a42240e7b
SHA18072bada086040e07fa46ce8c12bf7c453c0e286
SHA2567ad9ed23a91643b517e82ad5740d24eca16bcae21cfe1c0da78ee80e0d1d3f02
SHA512c7a7b15d8dbf8e8f8346a4dab083bb03565050281683820319906da4d23b97b39e88f841b30fc8bd690c179a8a54870238506ca60c0f533d34ac11850cdc1a95
-
Filesize
10.0MB
MD55df0cf8b8aa7e56884f71da3720fb2c6
SHA10610e911ade5d666a45b41f771903170af58a05a
SHA256dd396a3f66ad728660023cb116235f3cb1c35d679a155b08ec6a9ccaf966c360
SHA512724ce5e285c0ec68464c39292be62b80124909e98a6f1cd4a8ddee9de24b9583112012200bf10261354de478d77a5844cb843673235db3f704a307976164669a
-
Filesize
32KB
MD5eb9324121994e5e41f1738b5af8944b1
SHA1aa63c521b64602fa9c3a73dadd412fdaf181b690
SHA2562f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a
SHA5127f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2
-
Filesize
84KB
MD59d15a3b314600b4c08682b0202700ee7
SHA1208e79cdb96328d5929248bb8a4dd622cf0684d1
SHA2563ab3833e31e4083026421c641304369acfd31b957b78af81f3c6ef4968ef0e15
SHA5129916397b782aaafa68eb6a781ea9a0db27f914035dd586142c818ccbd7e69036896767bedba97489d5100de262a554cf14bcdf4a24edda2c5d37217b265398d3
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
28KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
316KB
-
Filesize
12KB
-
Filesize
316KB
-
Filesize
240KB
-
Filesize
828KB
-
Filesize
64KB
-
Filesize
128KB
-
Filesize
248KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
620KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
6.7MB
-
Filesize
108KB
-
Filesize
6.7MB
-
Filesize
28KB