Analysis
-
max time kernel
158s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
05-02-2022 21:26
Static task
static1
Behavioral task
behavioral1
Sample
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe
Resource
win10v2004-en-20220112
General
-
Target
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe
-
Size
112KB
-
MD5
65977152d62265c0f46751874bd45767
-
SHA1
3b6aaf8ab4eb82062780202248aad45b916376ab
-
SHA256
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
-
SHA512
c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
Malware Config
Extracted
C:\Users\Admin\Downloads\# DECRYPT MY FILES #.txt
http://decrypttozxybarc.onion/865A-5B5E-921E-0006-4B9D
Signatures
-
Adds policy Run key to start application 2 TTPs 6 IoCs
Processes:
mcbuilder.exe8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exemcbuilder.exemcbuilder.exemcbuilder.exemcbuilder.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe -
Executes dropped EXE 5 IoCs
Processes:
mcbuilder.exemcbuilder.exemcbuilder.exemcbuilder.exemcbuilder.exepid process 1844 mcbuilder.exe 1260 mcbuilder.exe 3940 mcbuilder.exe 3756 mcbuilder.exe 1860 mcbuilder.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mcbuilder.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation mcbuilder.exe -
Drops startup file 2 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exemcbuilder.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mcbuilder.lnk 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mcbuilder.lnk mcbuilder.exe -
Adds Run key to start application 2 TTPs 24 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exemcbuilder.exemcbuilder.exemcbuilder.exemcbuilder.exemcbuilder.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mcbuilder = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 45 ipinfo.io -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2508 taskkill.exe 828 taskkill.exe -
Modifies Control Panel 12 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exemcbuilder.exemcbuilder.exemcbuilder.exemcbuilder.exemcbuilder.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{521FF9CE-8547-58DC-1902-C6B9D9719592}\\mcbuilder.exe\"" mcbuilder.exe -
Modifies data under HKEY_USERS 45 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4032" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.999451" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132887464378065423" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe -
Modifies registry class 2 IoCs
Processes:
mcbuilder.exemsedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings mcbuilder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemcbuilder.exemsedge.exepid process 3588 msedge.exe 3588 msedge.exe 1844 mcbuilder.exe 1844 mcbuilder.exe 3524 msedge.exe 3524 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exemcbuilder.exetaskkill.exemcbuilder.exemcbuilder.exemcbuilder.exemcbuilder.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 772 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Token: SeDebugPrivilege 1844 mcbuilder.exe Token: SeIncBasePriorityPrivilege 1844 mcbuilder.exe Token: SeTakeOwnershipPrivilege 1844 mcbuilder.exe Token: SeDebugPrivilege 2508 taskkill.exe Token: SeDebugPrivilege 1260 mcbuilder.exe Token: SeIncBasePriorityPrivilege 1260 mcbuilder.exe Token: SeTakeOwnershipPrivilege 1260 mcbuilder.exe Token: SeDebugPrivilege 3940 mcbuilder.exe Token: SeDebugPrivilege 3756 mcbuilder.exe Token: SeDebugPrivilege 1860 mcbuilder.exe Token: 33 624 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 624 AUDIODG.EXE Token: SeDebugPrivilege 828 taskkill.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 3524 msedge.exe 3524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.execmd.exemcbuilder.exemsedge.exedescription pid process target process PID 772 wrote to memory of 1844 772 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe mcbuilder.exe PID 772 wrote to memory of 1844 772 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe mcbuilder.exe PID 772 wrote to memory of 1844 772 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe mcbuilder.exe PID 772 wrote to memory of 2144 772 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe cmd.exe PID 772 wrote to memory of 2144 772 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe cmd.exe PID 772 wrote to memory of 2144 772 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe cmd.exe PID 2144 wrote to memory of 2508 2144 cmd.exe taskkill.exe PID 2144 wrote to memory of 2508 2144 cmd.exe taskkill.exe PID 2144 wrote to memory of 2508 2144 cmd.exe taskkill.exe PID 2144 wrote to memory of 2480 2144 cmd.exe PING.EXE PID 2144 wrote to memory of 2480 2144 cmd.exe PING.EXE PID 2144 wrote to memory of 2480 2144 cmd.exe PING.EXE PID 1844 wrote to memory of 3940 1844 mcbuilder.exe mcbuilder.exe PID 1844 wrote to memory of 3940 1844 mcbuilder.exe mcbuilder.exe PID 1844 wrote to memory of 3940 1844 mcbuilder.exe mcbuilder.exe PID 1844 wrote to memory of 3756 1844 mcbuilder.exe mcbuilder.exe PID 1844 wrote to memory of 3756 1844 mcbuilder.exe mcbuilder.exe PID 1844 wrote to memory of 3756 1844 mcbuilder.exe mcbuilder.exe PID 1844 wrote to memory of 1048 1844 mcbuilder.exe NOTEPAD.EXE PID 1844 wrote to memory of 1048 1844 mcbuilder.exe NOTEPAD.EXE PID 1844 wrote to memory of 3524 1844 mcbuilder.exe msedge.exe PID 1844 wrote to memory of 3524 1844 mcbuilder.exe msedge.exe PID 1844 wrote to memory of 1052 1844 mcbuilder.exe WScript.exe PID 1844 wrote to memory of 1052 1844 mcbuilder.exe WScript.exe PID 1844 wrote to memory of 1860 1844 mcbuilder.exe mcbuilder.exe PID 1844 wrote to memory of 1860 1844 mcbuilder.exe mcbuilder.exe PID 1844 wrote to memory of 1860 1844 mcbuilder.exe mcbuilder.exe PID 3524 wrote to memory of 808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe PID 3524 wrote to memory of 3808 3524 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe"C:\Users\Admin\AppData\Local\Temp\8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe"C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe"C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe" -watchdog3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:3940 -
C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe"C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe" -stat 1033⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:3756 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵PID:1048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb34b946f8,0x7ffb34b94708,0x7ffb34b947184⤵PID:808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:24⤵PID:3808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3588 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:84⤵PID:4040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:14⤵PID:3620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:14⤵PID:3092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5228 /prefetch:84⤵PID:3760
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:14⤵PID:452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:14⤵PID:2304
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 /prefetch:84⤵PID:3624
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵PID:536
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3159452198369262273,5010143174866947578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 /prefetch:84⤵PID:3604
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵PID:1052
-
C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe"C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe" -stat 1033⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1860 -
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "mcbuilder.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe" > NUL3⤵PID:1408
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "mcbuilder.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:828 -
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:2220 -
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe" > NUL2⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2508 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:2480
-
C:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exeC:\Users\Admin\AppData\Roaming\{521FF9CE-8547-58DC-1902-C6B9D9719592}\mcbuilder.exe1⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:988
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3200
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:204
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x41c 0x4ec1⤵
- Suspicious use of AdjustPrivilegeToken
PID:624
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
0aa762bb10362f552b6144794a0d1888
SHA1750eba61c566f9d0c9b2dd997c77f35a95c515b2
SHA2565eafadbd4100539125257b4a3f3c4a8fe4fd33605fc8a9b52050d715475b4de4
SHA51201a293bdfc4beebac42a0fcfb0fb1dfd52613b35b7de50e942c4638e008f8527fe37a29572a7612ead8b65ad41e848e12ec3258ca5c821030cba2b394805da16
-
MD5
0aa762bb10362f552b6144794a0d1888
SHA1750eba61c566f9d0c9b2dd997c77f35a95c515b2
SHA2565eafadbd4100539125257b4a3f3c4a8fe4fd33605fc8a9b52050d715475b4de4
SHA51201a293bdfc4beebac42a0fcfb0fb1dfd52613b35b7de50e942c4638e008f8527fe37a29572a7612ead8b65ad41e848e12ec3258ca5c821030cba2b394805da16
-
MD5
d43cbeee7e4a0eefc127c59fc9efb645
SHA1336a36c5d362d3d8412da146cee53203d01c25c6
SHA2569affa8832557b0d3d6439f8432cf037078baf5a5d5df3813e45d18c822e904a9
SHA5124b09cc362017f9d89629194e7a02f2e0d0a513a949c8072eebd4fd6330f2e77812fe7be874080e00eec327455efd32028da992b5899b0bbd77841a52fd79a69b
-
MD5
65977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
MD5
65977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
MD5
65977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
MD5
65977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
MD5
65977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
MD5
65977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
MD5
20935e94c458119a4e2e2970d03f7f93
SHA1d78dd763056c34777d826c0746d0b79a2cabb317
SHA25682c0fa282f5e14d2facfefcfca07b3d4cad960b9ce16bd1f8fbae0663ebecd95
SHA51252b122b16452f2beab7d44b207bc7f5f55cc70823f444d2bd79b919644467f584255b755d94d861059902a737046eccf7291391d546c1d6a601d9e7076235d26
-
MD5
0f7a25fafa2210f3b4316a2eb8754c5c
SHA1e6a00f76a03157aff9c6a44b6df10b05f9accda5
SHA2566b950fbea7a76c5c219bee60b6a036454012cfccc22e44ded43310c239234cdb
SHA512135a25970e6cc570b2fa6d7e8c13945b8ba5eb4c107fe20871f5d8f90db528270360aa1835f9ffd840c82f563d09836baac1488312bb0f28c2c71d5c830549ec
-
MD5
e9ffd9f618cbf36ad6c910c161bb8080
SHA1a702b4220bbded577b4b699611bb73593b12ae71
SHA256020ca4b4574a40418b8aa4c2d74b0488e9d150e8d3f5e56e5c6dcca6f7dfaaac
SHA512ee87264e384579df7b74d7ac08e9a490495efa34f1a99e2d4949cb76b839c165fbb281aacae25f4ab7e911401c7bfa3fba4b0e59dd492566985fb8dbd1cf1bef
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e