Trojan.NSIS.Runner
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 2,142 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 1,339 |
| First Seen: | March 7, 2023 |
| Last Seen: | April 23, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.NSIS.Runner |
|---|---|
| Signature status: | Hash Mismatch |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6d5ae4a08e45947a9b3de864de569795
SHA1:
79462ca843bd01d60d265529a1ef6d7e436d23e5
File Size:
215.77 KB, 215768 bytes
|
|
MD5:
6c54c5502f0b090820e83a37ef6ec9fb
SHA1:
130594979115e6ac34452b3a314eb4254a0591fe
File Size:
1.14 MB, 1142361 bytes
|
|
MD5:
a43859c52607388f86751596e93afd7c
SHA1:
eb6baac6121cdef9853679f6ca710554a5a4bad0
File Size:
415.39 KB, 415392 bytes
|
|
MD5:
603257c5a5e303ce011a0bcd312ae849
SHA1:
851dbfd0ca16da0acbc8e101f5bcfff6d334160c
File Size:
1.07 MB, 1070720 bytes
|
|
MD5:
7b02c65b9e07a1ae4c86e13871523a88
SHA1:
2212912ebf33459c6a5f5dfb8e046ec755f5fec6
SHA256:
B9D57404715B916F5B95F59CF9345E879158B8F9348E8972904E958B3EA3858D
File Size:
179.37 KB, 179368 bytes
|
Show More
|
MD5:
41757f7fbd07d7f936adf9d56ab3ba88
SHA1:
cc44854a00e5730e8dfec729c08661d08f7105e5
SHA256:
7298CB753FDA24DB49C3719E45100F227A86FFB8A762BA4BB0443F9BF91CC7E3
File Size:
415.42 KB, 415416 bytes
|
|
MD5:
d65b16d57ae3eab62c7dc21ce3519d7d
SHA1:
42eb79e95acbf5fff98ea775255153e924bc153f
SHA256:
1784B74641AD1F30868C43AF016D2E07588C6F50798E39D8175524A808C7C079
File Size:
1.14 MB, 1141771 bytes
|
|
MD5:
682c7bb53c58da7877cf0a4083477ddc
SHA1:
a39626785a22d39fed114eaae1f028aa342fcf04
SHA256:
CCA3C9155FD9C26B4997473E1B97CA4241A6C7D8B1254F9253D8D3C5A2232DBE
File Size:
415.35 KB, 415352 bytes
|
|
MD5:
78aac684c847ebdc9c0d7dfd6717cc3d
SHA1:
f7fbbb158bccce978fd45ff5aad1f14c4f182182
SHA256:
1B523F191E75828E0B734DBA53ADE14487D13309A317C08F7C9F57098DFF986C
File Size:
415.37 KB, 415368 bytes
|
|
MD5:
bd07ea73a82072d5c8d35892f2dca1a6
SHA1:
65b32cb60bc712c9296668d926402541011009fb
SHA256:
C40AA0ED344B64B897EE6485D2C398256542ECF1C869013D7D85BD469DD32E95
File Size:
415.13 KB, 415128 bytes
|
|
MD5:
afd959df8c190871be136d3068de70f7
SHA1:
80d6b0d5671a0674d4a5ccde12d9b24e70b04afa
SHA256:
5FA8E3060772F553474622EF82A47220B1B023205074814C32E5D45A5429D993
File Size:
415.39 KB, 415392 bytes
|
|
MD5:
27acf6e42769dbec8d9b3118bccd16b7
SHA1:
f7a670d77c123242e33584148cb62af9c7c2790d
SHA256:
E43ABCD2E449D1893F32594B2CEC28113AB004B06DD44EBDCABD8932C06A4193
File Size:
415.38 KB, 415376 bytes
|
|
MD5:
783b2681a93e3eb3b88abca92a95d8b9
SHA1:
b756870f270eaa654b217977615c44c785774b95
SHA256:
4C731B69ACC727B9BEBBA99BBF5912973FE99E640CE41E833B55C700E86B0569
File Size:
415.37 KB, 415368 bytes
|
|
MD5:
049bce36cf05356340ff77f51d016c0d
SHA1:
7133a8b1d65aefef04981cb4a41be6caf6c3e42c
SHA256:
246D5DC9E459AD4B7987440232BA7F207DC513260D6200BCEB0105A6136EEE17
File Size:
3.35 MB, 3353032 bytes
|
|
MD5:
8667cf31116d8e69caeef1dd562881f9
SHA1:
b8ca8633d7bcaca5e4255332979fca1da802dae0
SHA256:
54BDB12E6312D8E1213AAFFC94FA67375BB048D5A93043C49A49A78E121C6D1D
File Size:
415.39 KB, 415392 bytes
|
|
MD5:
544c972358b69779e4664d7480a6ee23
SHA1:
84e7d170c0c6953f1a0152164479900981c0069a
SHA256:
D15DBC881AD5F2D5874002EE90CD06416E05855CE671367382BDAEA507FFE68C
File Size:
179.37 KB, 179368 bytes
|
|
MD5:
8d28782d4fc943c9fbab0d4eadbf504d
SHA1:
ac80c89465ed39c2e169e47cdb44cddb39ea029c
SHA256:
843065AF1B84E21A59F8DBC2826E4AB6E7F1A6DFF6E83435E06E64C60AD3FC4A
File Size:
1.23 MB, 1231815 bytes
|
|
MD5:
06d607a433ea59a1815434776dc12871
SHA1:
7c06ea4ab52fb756acfb6d3db683ca1facd21826
SHA256:
8C3816B5A97BD7063A7E805C2723BB74DC31D51FE9E971E86151B9B1A0D50DE0
File Size:
36.76 KB, 36759 bytes
|
|
MD5:
ffe38187c60ab051fc10a7a845172c64
SHA1:
8d5229a717314a252e88d93fee22a462542f3493
SHA256:
494C90E01CFDB60B6E292A1942EA75CAA55E43D070016D4D76AD2CF7A5121EB3
File Size:
266.17 KB, 266168 bytes
|
|
MD5:
55539b074bc4814615715fb480b82615
SHA1:
f183778be235e2b36e5bd3de3c0b123333f43c19
SHA256:
7F5CD1D93B2D094B308BECF7C4839668C3E048546B47BC5CEEE40FD8EA2464C4
File Size:
415.38 KB, 415376 bytes
|
|
MD5:
cf58561d45c646ec8c4439ba6f1ee3bd
SHA1:
435939143fe57bd239ff960c2bfb3723e68c0fb5
SHA256:
0BF769C1AA6A77F21EF54AC3E50C5D73E74DF58D165A509AB14038D0369C7FBF
File Size:
1.08 MB, 1081602 bytes
|
|
MD5:
77528d1937622c634d1a4183019b26bd
SHA1:
20af6889b98654959daba0e3fb951bc8b5cab3d0
SHA256:
41276A7D697C759FD4FF1036B0A65DABF71E25D80CF9F1C3332E1E18FF73997D
File Size:
470.71 KB, 470712 bytes
|
|
MD5:
a8b14c651ae12f6a112ed7c8232d4bf0
SHA1:
b226e1be7109f142c8e7868883684b4237848cfb
SHA256:
80E3EDC018EBED21D00F4814B9B922E805D2FD9A242687146029A3765CD82FB1
File Size:
415.37 KB, 415368 bytes
|
|
MD5:
4164d80ade12fd8aa36fbaa4cc9c9740
SHA1:
5f85d1550d3d654ac16a9262555a586ccf167a0f
SHA256:
88977075356DC9E4C81FF59E5FFC004AB3D62070C1062CE7B690A941D5328090
File Size:
4.61 MB, 4613984 bytes
|
|
MD5:
23be698d0015322298f99202035ad442
SHA1:
a5806ba03fca19c0bb2fa25b483268fb5ca7a0ab
SHA256:
93ADFD985CE8841411C65A5FDF1E151FB18DF92CCE3B2AA9DE1A1689B207E80E
File Size:
415.37 KB, 415368 bytes
|
|
MD5:
a66e70b05b56b154354456ab53f6276b
SHA1:
0911a565fc8b813af3adfc520291410cc869d44a
SHA256:
8A9468B0879CC88D2315B686305736829377EC5521E0D2C2A95648822AA7CA7C
File Size:
415.37 KB, 415368 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | R2 Sistemas Informáticos |
| File Description | Actualizador R2 Metro |
| File Version | 2016.12.0.0900 |
| Legal Copyright | Copyright © 2016 R2 Sistemas Informáticos S.L. |
| Product Name | R2 Metro |
| Product Version | 2016.12.0.0900 |
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Discord Inc. | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Hash Mismatch |
| NVIDIA Corporation | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Hash Mismatch |
| PROXIMA BETA PTE. LIMITED | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Self Signed |
| Tencent Technology (Shenzhen) Company Limited | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Self Signed |
| PROXIMA BETA PTE. LIMITED | DigiCert Trusted Root G4 | Root Not Trusted |
Show More
| PROXIMA BETA PTE. LIMITED | DigiCert Trusted Root G4 | Root Not Trusted |
| Skype Software Sarl | Microsoft Code Signing PCA 2011 | Hash Mismatch |
| R2 Sistemas Informaticos SL | Symantec Class 3 Extended Validation Code Signing CA - G2 | Self Signed |
| Samsung SDS Co., Ltd | thawte Primary Root CA | Root Not Trusted |
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 101 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 101 |
| Unknown Blocks: | 0 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.LA
- Brute.BHA
- Chapak.HBX
- CobaltStrike.GI
- CobaltStrike.GIA
Show More
- MSILZilla.TC
- Rozena.XC
- Trojan.Agent.Gen.VN
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\536613\o | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\536613\origin.com | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\inetcache\536613\origin.com | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\avenue | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\benz | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\booking | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\cab05632.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\inetcache\candidate | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\microsoft\windows\inetcache\causing | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\centre | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\comfortable | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\consumer | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\decide | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\dual | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\excessive | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\excessive.cmd | Synchronize,Write Data |
| c:\users\user\appdata\local\microsoft\windows\inetcache\gone | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\harmony | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\justin | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\inetcache\keeps | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\manor | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\manor.cmd | Synchronize,Write Data |
| c:\users\user\appdata\local\microsoft\windows\inetcache\movements | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\nano | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\oxide | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\papers | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\prevent | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\programmes | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\restrictions | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\serving | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\serving.cmd | Synchronize,Write Data |
| c:\users\user\appdata\local\microsoft\windows\inetcache\sr | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\validity | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache\widespread | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\accordingly | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\amazoncom | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\appliance | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\apply | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\bangladesh | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\bangladesh.cmd | Synchronize,Write Data |
| c:\users\user\appdata\local\temp\cab05992.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\cabinets | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\circumstances | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\collective | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\decrease | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dildos | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\disagree | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\eds | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\email | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\epic | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\estimated | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\false | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\farming | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\fish | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\highlights | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ing | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\input | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ins | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\interview | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\itsa | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\joe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ladder | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\legacy | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\marker | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\meters | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\months | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsa599e.tmp\execcmd.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc42e2.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsc42e2.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc42e2.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsc59c6.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsc59c6.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc59c6.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsf3d35.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsf3d35.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsf3d35.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsg226e.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsg226e.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsg226e.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsgde1a.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsgde1a.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgde1a.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsi4572.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsi4572.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsi4572.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsmc316.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsmc316.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsmc316.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsnaa45.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsnaa45.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsnaa45.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nso62e2.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nso62e2.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nso62e2.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsof3fe.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsof3fe.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsof3fe.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nspc359.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nspc359.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nspc359.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsqe898.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsqe898.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsqe898.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nst617b.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nstab01.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nstab01.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nstab01.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nste021.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nste021.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nste021.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nstfff9.tmp\execcmd.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsv4b2f.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsv4b2f.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsv4b2f.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsw662.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsw662.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsw662.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsy54f8.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsy54f8.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy54f8.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsy8b52.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsy8b52.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy8b52.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\platinum | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\pour | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\proposition | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\sons | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\specific | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\stop | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\stop.cmd | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\stop.cmd | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\stops | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\subject | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\talks | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\teaching | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\technological | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\wow | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\downloads\cxmlpsat.exe | Generic Write,Read Attributes |
| c:\users\user\downloads\cxmlpupdate.exe | Generic Write,Read Attributes |
| c:\users\user\downloads\installutil.installlog | Generic Write,Read Attributes |
| c:\users\user\downloads\r2kill.exe | Generic Write,Read Attributes |
| c:\users\user\downloads\r2update.exe | Generic Write,Read Attributes |
| c:\users\user\downloads\r2update.installlog | Generic Write,Read Attributes |
| c:\users\user\downloads\r2update.installstate | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\appcompat\programs\amcache.hve | Read Data,Read Control,Write Data |
| c:\windows\appcompat\programs\amcache.hve.log1 | Read Data,Write Data |
| c:\windows\appcompat\programs\amcache.hve.log2 | Read Data,Write Data |
| c:\windows\caughtkinda | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\consentnightmare | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\constraintswidescreen | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\definereviewer | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\essaygmc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\feelsexpanding | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\instanthelped | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\interferenceconnector | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\portalalan | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\prototypereject | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\queensmale | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\tookfought | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Vpimzfxj\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Vpimzfxj\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Vpimzfxj\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Vpimzfxj\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Vpimzfxj\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Vp | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ⱥ數Ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Bctfxvfi\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Bctfxvfi\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Bctfxvfi\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
Show More
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Bctfxvfi\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Bctfxvfi\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Bc | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Oqgqgyup\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Oqgqgyup\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Oqgqgyup\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Oqgqgyup\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Oqgqgyup\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Oq | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Qdruetha\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Qdruetha\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Qdruetha\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Qdruetha\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Qdruetha\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Qd | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ꯅ쎚☂ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Wclnpseg\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Wclnpseg\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Wclnpseg\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Wclnpseg\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Wclnpseg\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Wc | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cfscfapt\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cfscfapt\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Cfscfapt\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cfscfapt\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Cfscfapt\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Cf | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Eovxzeya\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Eovxzeya\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Eovxzeya\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Eovxzeya\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Eovxzeya\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Eo | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Yqrdshsd\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Yqrdshsd\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Yqrdshsd\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Yqrdshsd\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Yqrdshsd\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Yq | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Bodiilvc\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Bodiilvc\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Bodiilvc\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Bodiilvc\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Bodiilvc\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Bo | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Twgydifb\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Twgydifb\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Twgydifb\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Twgydifb\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Twgydifb\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Tw | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 泋꣘䪾ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 祳ꥧ䪾ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\eventlog\application\r2update::eventmessagefile | C:\Windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Mucwuepn\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Mucwuepn\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Mucwuepn\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Mucwuepn\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Mucwuepn\AppData\Local\Temp\~nsuA.tmp \??\C:\Users\Mu | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Windows\SystemTemp\77e37ce0-8214-4414-aced-551c5ae204d7.tmp \??\C:\Windows\SystemTemp\e28eadcf-6ab0-4d8c-8821-7ce9a6aba1 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 콡樰ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 鯨 ȁ 獖} 偫~ 엦1d ᵂċ ᵆċ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\run::suu | "c:\users\user\downloads\7c06ea4ab52fb756acfb6d3db683ca1facd21826_0000036759" | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\run::olathe | "C:\Program Files (x86)\glade\epigram.exe" | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 혜ﭽ毳ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 塰ﰢ毳ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ͋ﲯ毳ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䯜ﴹ毳ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 聬﷏毳ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\sandbox_live\tmp\112502\4148\c\users\user\appdata\local\temp\~nsua.tmp\un_a.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\sandbox_live\tmp\112502\4148\c\users\user\appdata\local\temp\~nsua.tmp\un_a.exe *1\??\C:\sandbox_live\tmp\112502\4148\ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352 *1\??\C:\P | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ﱆ븯褅ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62 *1\??\C:\P | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Process Shell Execute |
|
| Syscall Use |
Show More
63 additional items are not displayed above. |
| Process Manipulation Evasion |
|
| Other Suspicious |
|
| Process Terminate |
|
| Encryption Used |
|
| Service Control |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Vpimzfxj\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\
|
open cmd /c copy Stop Stop.cmd & Stop.cmd
|
WriteConsole: 1 file(s
|
WriteConsole:
|
WriteConsole: C:\Users\Hbpokrn
|
Show More
WriteConsole: Set
|
WriteConsole: Intent=M
|
WriteConsole: UxUThreads
|
WriteConsole:
|
WriteConsole: 'UxUThreads' is
|
WriteConsole: xiFit
|
WriteConsole: Cottages Thu Ac
|
WriteConsole: 'xiFit' is not r
|
WriteConsole: BgImpressive
|
WriteConsole: Verified Mariah
|
WriteConsole: 'BgImpressive' i
|
WriteConsole: JPGrain
|
WriteConsole: Erotica Adelaid
|
WriteConsole: 'JPGrain' is not
|
WriteConsole: ZcLHDiana
|
WriteConsole: Webcams Fleece
|
WriteConsole: 'ZcLHDiana' is n
|
WriteConsole: Women=S
|
WriteConsole: GCResource
|
WriteConsole: Cards Recommend
|
WriteConsole: 'GCResource' is
|
WriteConsole: nFxTemplates
|
WriteConsole: Automated Annou
|
WriteConsole: 'nFxTemplates' i
|
WriteConsole: BTJill
|
WriteConsole: Island Nextel R
|
WriteConsole: 'BTJill' is not
|
WriteConsole: IiYDildos
|
WriteConsole: Moore Yeast Sym
|
WriteConsole: 'IiYDildos' is n
|
WriteConsole: fYrMj
|
WriteConsole: Reports Targete
|
WriteConsole: 'fYrMj' is not r
|
WriteConsole: Diameter=6
|
WriteConsole: gTDeviant
|
WriteConsole: Massive Install
|
WriteConsole: 'gTDeviant' is n
|
WriteConsole: vCUsc
|
WriteConsole: 'vCUsc' is not r
|
WriteConsole: GzInterested
|
WriteConsole: Contributors Bi
|
WriteConsole: 'GzInterested' i
|
WriteConsole: USUrCoins
|
WriteConsole: 'USUrCoins' is n
|
WriteConsole: eQOutreach
|
WriteConsole: Tables Explicit
|
WriteConsole: 'eQOutreach' is
|
WriteConsole: cYKdLas
|
WriteConsole: Announcements
|
WriteConsole: 'cYKdLas' is not
|
WriteConsole: LoAAppeals
|
WriteConsole: Well Prefix Her
|
WriteConsole: 'LoAAppeals' is
|
WriteConsole: cexWilderness
|
WriteConsole: Teens Idea Tric
|
WriteConsole: 'cexWilderness'
|
WriteConsole: Reply=V
|
WriteConsole: NJNetworking
|
WriteConsole: Frozen Jeff Rea
|
WriteConsole: 'NJNetworking' i
|
WriteConsole: LxwInc
|
WriteConsole: Villas Mariah F
|
WriteConsole: 'LxwInc' is not
|
WriteConsole: pVPCocks
|
WriteConsole: Course Invision
|
WriteConsole: 'pVPCocks' is no
|
WriteConsole: yaYmSurgeon
|
WriteConsole: 'yaYmSurgeon' is
|
WriteConsole: mXgrAlbuquerque
|
WriteConsole: Accompanied Sr
|
WriteConsole: 'mXgrAlbuquerque
|
WriteConsole: MkSuburban
|
WriteConsole: Farmers Gerald
|
WriteConsole: 'MkSuburban' is
|
WriteConsole: WlnMake
|
WriteConsole: July Wi Chronic
|
WriteConsole: 'WlnMake' is not
|
WriteConsole: MWiOpportunity
|
WriteConsole: Bloggers
|
WriteConsole: 'MWiOpportunity'
|
WriteConsole: nPWIBumper
|
WriteConsole: Adventure Openi
|
WriteConsole: 'nPWIBumper' is
|
WriteConsole: OrkFloors
|
WriteConsole: Floppy Globe Ba
|
WriteConsole: 'OrkFloors' is n
|
WriteConsole: Edmonton=Y
|
WriteConsole: FkWCognitive
|
WriteConsole: Draws
|
WriteConsole: 'FkWCognitive' i
|
WriteConsole: ORVWhich
|
WriteConsole: Mineral Beginne
|
WriteConsole: 'ORVWhich' is no
|
WriteConsole: lyqIMotivated
|
WriteConsole: Revealed Capito
|
WriteConsole: 'lyqIMotivated'
|
WriteConsole: cIlRecognition
|
WriteConsole: Stat Locally Se
|
WriteConsole: 'cIlRecognition'
|
WriteConsole: mLBucks
|
WriteConsole: Ii Rewards Hart
|
WriteConsole: 'mLBucks' is not
|
WriteConsole: CqKNg
|
WriteConsole: Beef Soup Leaf
|
WriteConsole: 'CqKNg' is not r
|
WriteConsole: KzQuit
|
WriteConsole: Variety
|
WriteConsole: 'KzQuit' is not
|
WriteConsole: LDChelsea
|
WriteConsole: Gm Potato Prosp
|
WriteConsole: 'LDChelsea' is n
|
WriteConsole: XQaImplemented
|
WriteConsole: Offering Provid
|
WriteConsole: 'XQaImplemented'
|
WriteConsole: sEYaDraft
|
WriteConsole: 'sEYaDraft' is n
|
WriteConsole: Costume=4
|
WriteConsole: XLCircumstances
|
WriteConsole: Scoring Wood Fo
|
WriteConsole: 'XLCircumstances
|
WriteConsole: WxUBarrier
|
WriteConsole: Heights Stanley
|
WriteConsole: 'WxUBarrier' is
|
WriteConsole: uxaWax
|
WriteConsole: Printer She Fas
|
WriteConsole: 'uxaWax' is not
|
WriteConsole: maACurrently
|
WriteConsole: Accountability
|
WriteConsole: 'maACurrently' i
|
WriteConsole: pJImports
|
WriteConsole: Handy
|
WriteConsole: 'pJImports' is n
|
WriteConsole: Conversion=D
|
WriteConsole: YSzWLearned
|
WriteConsole: Nicaragua Holly
|
WriteConsole: 'YSzWLearned' is
|
WriteConsole: qIMLemon
|
WriteConsole: Terminology
|
WriteConsole: 'qIMLemon' is no
|
WriteConsole: vOLloyd
|
WriteConsole: Terrain Mood Go
|
WriteConsole: 'vOLloyd' is not
|
WriteConsole: vkWeighted
|
WriteConsole: Risks Oops Worn
|
WriteConsole: 'vkWeighted' is
|
2689 additional execution are not displayed above.
