Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/10/2022, 23:16
Behavioral task
behavioral1
Sample
0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe
Resource
win10v2004-20220812-en
General
-
Target
0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe
-
Size
32KB
-
MD5
41a992c2e74797e76521dc86fba9d730
-
SHA1
ffc0e7ca2b9ad263a325fd30e3e2bda867ec310b
-
SHA256
0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a
-
SHA512
8b2ea42d3ed6d14d67754c60d4784fdfad97c565e5d495dc3e68b26d762eca44e93c4e33a428494be7bc631ac4aeeff810ba16193ed6b24a327a540caba4fe04
-
SSDEEP
768:r51WbPH59kgi2fKACIaFleZQWTGBxMLfb41CYR/9m:rHWbZltfjCHwQWT/81L
Malware Config
Extracted
joker
http://mmtie.oss-cn-hangzhou.aliyuncs.com
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Downloads MZ/PE file
-
Drops file in Drivers directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\rsndisp.sys install1968982.exe File opened for modification C:\Windows\system32\drivers\bc.sys duba_1_244.exe File opened for modification C:\Windows\system32\drivers\rsutils.sys install1968982.exe File created C:\Windows\system32\drivers\kisnetm64.sys duba_1_244.exe File created C:\Windows\system32\drivers\ksapi.sys duba_1_244.exe File created C:\Windows\system32\drivers\ksapi64.sys duba_1_244.exe File opened for modification C:\Windows\SysWOW64\drivers\KAVBase.sys duba_1_244.exe File created C:\Windows\system32\drivers\kisknl.sys duba_1_244.exe File opened for modification C:\Windows\SysWOW64\drivers\kisknl.sys kxescore.exe File created C:\Windows\system32\drivers\bc.sys duba_1_244.exe File created C:\Windows\system32\drivers\kisnetmxp.sys duba_1_244.exe File created C:\Windows\system32\drivers\ksskrpr.sys duba_1_244.exe File opened for modification C:\Windows\system32\drivers\kisknl.sys kxescore.exe File created C:\Windows\system32\drivers\kisknl.sys kxescore.exe File opened for modification C:\Windows\system32\drivers\sysmon.sys install1968982.exe File created C:\Windows\system32\drivers\sysmon.sys install1968982.exe File created C:\Windows\system32\drivers\rsutils.sys install1968982.exe File created C:\Windows\system32\drivers\kisknl64.sys duba_1_244.exe File created C:\Windows\system32\drivers\kisnetm.sys duba_1_244.exe File created C:\Windows\system32\drivers\rsndisp.sys install1968982.exe -
Executes dropped EXE 15 IoCs
pid Process 1600 duba_1_244.exe 608 install1968982.exe 1736 kavlog2.exe 1528 kxetray.exe 276 kislive.exe 728 kxescore.exe 368 kxescore.exe 1252 kxetray.exe 2084 kwsprotect64.exe 1280 Process not Found 1396 Process not Found 2256 RsMgrSvc.exe 2308 popwndexe.exe 2528 ravmond.exe 2560 ravmond.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32 duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll" duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment" duba_1_244.exe -
Sets file execution options in registry 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UNINST.EXE duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXESCORE.EXE duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCOMREGSVRV8.EXE duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVLOG2.EXE duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISCALL.EXE duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXETRAY.EXE duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSIGNSP.EXE duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISADDIN.EXE duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRECYCLE.EXE duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSETUPWIZ.EXE duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KDRVMGR.EXE duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISMAIN.EXE duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSCAN.EXE duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe duba_1_244.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLIVE.EXE duba_1_244.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kisknl\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\kisknl.sys" kxescore.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\kisknl\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\kisknl.sys" kxescore.exe -
resource yara_rule behavioral1/files/0x00070000000132fc-59.dat upx behavioral1/files/0x00070000000132fc-61.dat upx behavioral1/memory/1600-64-0x0000000000400000-0x000000000051E000-memory.dmp upx behavioral1/files/0x00070000000132fc-66.dat upx behavioral1/files/0x00070000000132fc-65.dat upx behavioral1/files/0x00070000000132fc-67.dat upx behavioral1/files/0x0006000000014d2f-80.dat upx behavioral1/files/0x0006000000014d2f-82.dat upx behavioral1/files/0x0006000000014d2f-86.dat upx behavioral1/files/0x0006000000014d2f-85.dat upx behavioral1/files/0x0006000000014d2f-84.dat upx behavioral1/memory/608-91-0x0000000000400000-0x0000000000600000-memory.dmp upx behavioral1/memory/1600-144-0x0000000000400000-0x000000000051E000-memory.dmp upx behavioral1/memory/1600-188-0x0000000000400000-0x000000000051E000-memory.dmp upx behavioral1/memory/608-260-0x0000000000400000-0x0000000000600000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1544 cmd.exe -
Loads dropped DLL 64 IoCs
pid Process 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 608 install1968982.exe 608 install1968982.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 1600 duba_1_244.exe 276 kislive.exe 276 kislive.exe 1528 kxetray.exe 1736 kavlog2.exe 1528 kxetray.exe 728 kxescore.exe 728 kxescore.exe 728 kxescore.exe 728 kxescore.exe 1528 kxetray.exe 1528 kxetray.exe 1736 kavlog2.exe 276 kislive.exe 276 kislive.exe 1528 kxetray.exe 1736 kavlog2.exe 1736 kavlog2.exe 368 kxescore.exe 368 kxescore.exe 1528 kxetray.exe 276 kislive.exe 276 kislive.exe 276 kislive.exe 1252 kxetray.exe 1252 kxetray.exe 1252 kxetray.exe 1252 kxetray.exe 1252 kxetray.exe 1252 kxetray.exe 1252 kxetray.exe 1252 kxetray.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe 368 kxescore.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun" duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RSDTRAY = "\"C:\\Program Files (x86)\\Rising\\RSD\\popwndexe.exe\"" install1968982.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 3 IoCs
description ioc Process File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini duba_1_244.exe File opened for modification \??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini duba_1_244.exe File opened for modification C:\Program Files (x86)\Rising\RAV\desktop.ini install1968982.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: kxetray.exe File opened (read-only) \??\F: kxetray.exe File opened (read-only) \??\Q: kxetray.exe File opened (read-only) \??\N: kxetray.exe File opened (read-only) \??\O: kxetray.exe File opened (read-only) \??\P: kxetray.exe File opened (read-only) \??\T: kxetray.exe File opened (read-only) \??\U: kxetray.exe File opened (read-only) \??\Z: kxetray.exe File opened (read-only) \??\E: kxetray.exe File opened (read-only) \??\G: kxetray.exe File opened (read-only) \??\M: kxetray.exe File opened (read-only) \??\D: kxetray.exe File opened (read-only) \??\I: kxetray.exe File opened (read-only) \??\L: kxetray.exe File opened (read-only) \??\K: kxetray.exe File opened (read-only) \??\R: kxetray.exe File opened (read-only) \??\S: kxetray.exe File opened (read-only) \??\V: kxetray.exe File opened (read-only) \??\W: kxetray.exe File opened (read-only) \??\Y: kxetray.exe File opened (read-only) \??\H: kxetray.exe File opened (read-only) \??\J: kxetray.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 duba_1_244.exe File opened for modification \??\PhysicalDrive0 install1968982.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\KAVEventLog.EVT kavlog2.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ravmond.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\MSCRT9\msvcr90.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVDEFDB\uprsuser.dat install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\CompsVer.inf install1968982.exe File created C:\Program Files (x86)\Rising\RAV\XMLS\RAVBASE.xml install1968982.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kae\kaearcha.dat duba_1_244.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\floatskin\shrink_skin_history.ini kxetray.exe File opened for modification C:\Program Files (x86)\Rising\RSD\localopt.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\popwndexe.exe install1968982.exe File created C:\Program Files (x86)\Rising\RSD\update.xml install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\64\rsutils.sys install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\repairmanager.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RAV\XMLS\HOOKBASE.xml install1968982.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kpretend.dat duba_1_244.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsui64.dll duba_1_244.exe File opened for modification \??\c:\program files (x86)\kingsoft\kingsoft antivirus\log\defmsg.log kxescore.exe File opened for modification C:\Program Files (x86)\Rising\RAV\traywnd.dll install1968982.exe File created C:\Program Files (x86)\Rising\RAV\XMLS\RSCOMM.xml install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RAV\bacore.dll install1968982.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\microsoft.vc80.mfc.manifest duba_1_244.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kae\kaecore.ini duba_1_244.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVCONFIG\ravcfg.xml install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVDEFDB\mondef.dll install1968982.exe File created C:\Program Files (x86)\Rising\RAV\cfgxml\mondcoms.xml install1968982.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\delaydownloader.dat duba_1_244.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RSD1252\Eng.lag install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\rssqlite.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\cnt08.dll install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVXP\ravxp.exe install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RAV\rsxml3a.dll install1968982.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\floatskin\shrink_skin_config.ini duba_1_244.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\bc.sys duba_1_244.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSDK\rsxml3w.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\Proccomm.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RAV\Cloudv3.dll install1968982.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\game.xml duba_1_244.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavmenu64.dll duba_1_244.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSDK\RSDK.xml install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RSD950\CHT.lag install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RAVBASE.xml install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\Label.dat install1968982.exe File created C:\Program Files (x86)\Rising\RAV\XMLS\HOOKBASE.xml install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RAV\XMLS\MSCRT9.xml install1968982.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\liectrl.config duba_1_244.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdgui2.dll duba_1_244.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\expand_rule.dat kxescore.exe File opened for modification C:\Program Files (x86)\Rising\RAV\rspalvd.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RAV\syslay.dll install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\MSCRT9\msvcp90.dll install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\syslay.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RAV\cloudnet.dll install1968982.exe File created C:\Program Files (x86)\Rising\RAV\rav936\lics936.txt install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RAV\dataups.dat install1968982.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\forecastmsg.xml duba_1_244.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm64.sys duba_1_244.exe File created C:\Program Files (x86)\Rising\RSD\RSD1252\Eng.lag install1968982.exe File created C:\Program Files (x86)\Rising\RAV\hookbase.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\comx3.dll install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\MONBASEDUI\MONBASEDUI.xml install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVMAINDUI\rsmain.exe install1968982.exe File opened for modification C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVMAINDUI\rsmain.exe install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\cnt09.dll install1968982.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\CLOUDV3\cloudwork.dll install1968982.exe File opened for modification \??\c:\program files (x86)\kingsoft\kingsoft antivirus\fdsdcache.db-journal kxescore.exe File created C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RavSetup.dll install1968982.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1592 taskkill.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ravmond.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcInfo = "1664674410" install1968982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828} install1968982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C} install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\ravmonexe = "AbfYXQSXFycZMwBCAWgKJgpL" install1968982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32 duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0} duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\monServerName = "AbfYXQSXNzU9PxlhCih3" install1968982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32 duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "c8ekj5i4wd2mxe4mycfvbihnoz4x" duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} kxescore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51} duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\ = "CKavMenuShell Class" duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit duba_1_244.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0} duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "b898f042484df647ee4d485047f6ba5a" kxetray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Shellex\ContextMenuHandlers\duba_64bit duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\InstallPath = "AbfYXQSXQBY9ESh-JAsrFz0JORQGLQZCAho9Hzli" install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\rstrayexe = "AbfYXQSXFzUbLA5VSyMXO3o=" install1968982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1" duba_1_244.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAA2D3B1-4BB5-4a45-A17A-122773379D99}\ProcID = "{41765100-C8CE-1B29-3030-303133000000}" install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcDll = "1696296810" install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\Title = "AbfYXQSXrba/md-ere2ns9PS9g==" install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\monShowName = "AbfYXQSXNycZfjxJFzAGPQo2" install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ThreadingModel = "Apartment" duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAA2D3B1-4BB5-4a45-A17A-122773379D99} install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\regtray = "AbfYXQSXNycZCj1tPC8=" install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment" duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" duba_1_244.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "c8ekj5i4wd2mxe4mycfvbihnoz4x" duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\RAV = "AbfYXQSXNwc5tw==" install1968982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\duba_64bit duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0" duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} kxetray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit duba_1_244.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\Shellex\ContextMenuHandlers\duba_64bit duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E} duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" duba_1_244.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "2064282365" duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1" kxetray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcKind = "5" install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\ProcKey = "RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw" install1968982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll" duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers duba_1_244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit duba_1_244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "b898f042484df647ee4d485047f6ba5a" duba_1_244.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1600 duba_1_244.exe 1600 duba_1_244.exe 368 kxescore.exe 608 install1968982.exe 368 kxescore.exe 1252 kxetray.exe 1252 kxetray.exe 2308 popwndexe.exe -
Suspicious behavior: LoadsDriver 10 IoCs
pid Process 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1600 duba_1_244.exe Token: SeDebugPrivilege 276 kislive.exe Token: SeDebugPrivilege 1600 duba_1_244.exe Token: SeDebugPrivilege 1592 taskkill.exe Token: SeDebugPrivilege 368 kxescore.exe Token: 33 368 kxescore.exe Token: SeIncBasePriorityPrivilege 368 kxescore.exe Token: SeDebugPrivilege 1252 kxetray.exe Token: SeDebugPrivilege 1252 kxetray.exe Token: SeBackupPrivilege 2256 RsMgrSvc.exe Token: SeDebugPrivilege 608 install1968982.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1252 kxetray.exe 1252 kxetray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1252 kxetray.exe 1252 kxetray.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2084 kwsprotect64.exe 2084 kwsprotect64.exe 1252 kxetray.exe 1252 kxetray.exe 1252 kxetray.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1600 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 30 PID 1492 wrote to memory of 1600 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 30 PID 1492 wrote to memory of 1600 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 30 PID 1492 wrote to memory of 1600 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 30 PID 1492 wrote to memory of 1600 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 30 PID 1492 wrote to memory of 1600 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 30 PID 1492 wrote to memory of 1600 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 30 PID 1492 wrote to memory of 608 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 31 PID 1492 wrote to memory of 608 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 31 PID 1492 wrote to memory of 608 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 31 PID 1492 wrote to memory of 608 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 31 PID 1492 wrote to memory of 608 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 31 PID 1492 wrote to memory of 608 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 31 PID 1492 wrote to memory of 608 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 31 PID 1600 wrote to memory of 1736 1600 duba_1_244.exe 32 PID 1600 wrote to memory of 1736 1600 duba_1_244.exe 32 PID 1600 wrote to memory of 1736 1600 duba_1_244.exe 32 PID 1600 wrote to memory of 1736 1600 duba_1_244.exe 32 PID 1600 wrote to memory of 1736 1600 duba_1_244.exe 32 PID 1600 wrote to memory of 1736 1600 duba_1_244.exe 32 PID 1600 wrote to memory of 1736 1600 duba_1_244.exe 32 PID 1600 wrote to memory of 1528 1600 duba_1_244.exe 33 PID 1600 wrote to memory of 1528 1600 duba_1_244.exe 33 PID 1600 wrote to memory of 1528 1600 duba_1_244.exe 33 PID 1600 wrote to memory of 1528 1600 duba_1_244.exe 33 PID 1600 wrote to memory of 1528 1600 duba_1_244.exe 33 PID 1600 wrote to memory of 1528 1600 duba_1_244.exe 33 PID 1600 wrote to memory of 1528 1600 duba_1_244.exe 33 PID 1600 wrote to memory of 728 1600 duba_1_244.exe 34 PID 1600 wrote to memory of 728 1600 duba_1_244.exe 34 PID 1600 wrote to memory of 728 1600 duba_1_244.exe 34 PID 1600 wrote to memory of 728 1600 duba_1_244.exe 34 PID 1600 wrote to memory of 728 1600 duba_1_244.exe 34 PID 1600 wrote to memory of 728 1600 duba_1_244.exe 34 PID 1600 wrote to memory of 728 1600 duba_1_244.exe 34 PID 1600 wrote to memory of 276 1600 duba_1_244.exe 35 PID 1600 wrote to memory of 276 1600 duba_1_244.exe 35 PID 1600 wrote to memory of 276 1600 duba_1_244.exe 35 PID 1600 wrote to memory of 276 1600 duba_1_244.exe 35 PID 1600 wrote to memory of 276 1600 duba_1_244.exe 35 PID 1600 wrote to memory of 276 1600 duba_1_244.exe 35 PID 1600 wrote to memory of 276 1600 duba_1_244.exe 35 PID 1528 wrote to memory of 1252 1528 kxetray.exe 39 PID 1528 wrote to memory of 1252 1528 kxetray.exe 39 PID 1528 wrote to memory of 1252 1528 kxetray.exe 39 PID 1528 wrote to memory of 1252 1528 kxetray.exe 39 PID 1528 wrote to memory of 1252 1528 kxetray.exe 39 PID 1528 wrote to memory of 1252 1528 kxetray.exe 39 PID 1528 wrote to memory of 1252 1528 kxetray.exe 39 PID 1492 wrote to memory of 1544 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 40 PID 1492 wrote to memory of 1544 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 40 PID 1492 wrote to memory of 1544 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 40 PID 1492 wrote to memory of 1544 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 40 PID 1492 wrote to memory of 1544 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 40 PID 1492 wrote to memory of 1544 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 40 PID 1492 wrote to memory of 1544 1492 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe 40 PID 1544 wrote to memory of 1592 1544 cmd.exe 42 PID 1544 wrote to memory of 1592 1544 cmd.exe 42 PID 1544 wrote to memory of 1592 1544 cmd.exe 42 PID 1544 wrote to memory of 1592 1544 cmd.exe 42 PID 1544 wrote to memory of 1592 1544 cmd.exe 42 PID 1544 wrote to memory of 1592 1544 cmd.exe 42 PID 1544 wrote to memory of 1592 1544 cmd.exe 42 PID 1252 wrote to memory of 2084 1252 kxetray.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe"C:\Users\Admin\AppData\Local\Temp\0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe"C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe" -install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1736
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe"kwsprotect64.exe" (null)5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2084
-
-
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /start kxescore3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:728
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe" /autorun /std /skipcs33⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:276
-
-
-
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe"C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:608 -
C:\Program Files (x86)\Rising\RSD\popwndexe.exe"C:\Program Files (x86)\Rising\RSD\popwndexe.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2308
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s RavExt64.dll3⤵PID:2424
-
-
C:\Program Files (x86)\Rising\RAV\ravmond.exe"C:\Program Files (x86)\Rising\RAV\ravmond.exe" -srv setup /SLIENCE3⤵
- Executes dropped EXE
PID:2528
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe.bat2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM 0554fa5e8f910d1f8ade323076e0efe75dc00d357512976b667e28c6bc915e8a.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368
-
C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
C:\Program Files (x86)\Rising\RAV\ravmond.exe"C:\Program Files (x86)\Rising\RAV\ravmond.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2560
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
511KB
MD5dd1443f153f7cf554addb404aff623f8
SHA1893f24f463d03b3b19e952b85ae06daffcc466d1
SHA256b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887
SHA5126fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd
-
Filesize
1.1MB
MD504eeb71a179940aca8073ddaa5bf4350
SHA102f7c99c4a2784b2db466b20c6e9c02cccc733b6
SHA256acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385
SHA512049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21
-
Filesize
277KB
MD5479263a138a81ac646a04a7ca1060821
SHA17bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3
SHA256bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d
SHA512136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7
-
Filesize
277KB
MD5479263a138a81ac646a04a7ca1060821
SHA17bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3
SHA256bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d
SHA512136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7
-
Filesize
1.4MB
MD5cee09dac2393fb81c34ea3c5ced75d31
SHA1e2d5c7720c65b4dcd7f740104fc9f8890b68a494
SHA256156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570
SHA512c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f
-
Filesize
16.8MB
MD51f1c87b2b8528523907cc58c00923df8
SHA1ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514
SHA25637e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a
SHA5122a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc
-
Filesize
16.8MB
MD51f1c87b2b8528523907cc58c00923df8
SHA1ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514
SHA25637e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a
SHA5122a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc
-
Filesize
4.6MB
MD5512fe2eb54dde3c922ce73c075a592a1
SHA14332a256f0a77381ecd11e823475c335691325d7
SHA256110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e
SHA512a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e
-
Filesize
4.6MB
MD5512fe2eb54dde3c922ce73c075a592a1
SHA14332a256f0a77381ecd11e823475c335691325d7
SHA256110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e
SHA512a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e
-
Filesize
536KB
MD54c8a880eabc0b4d462cc4b2472116ea1
SHA1d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA2562026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
SHA5126a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
-
Filesize
612KB
MD5e4fece18310e23b1d8fee993e35e7a6f
SHA19fd3a7f0522d36c2bf0e64fc510c6eea3603b564
SHA25602bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9
SHA5122fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc
-
Filesize
90KB
MD580f899ca024ddcf5218a4fadeacaec54
SHA12756821bde2d8eb44b04da63afbf5496565ddf71
SHA2562a0d8c0778ef91c5e9f7ffac47a0e49a4055d50556895822d84adcbce9375c17
SHA512ae871718f3eb2bcdd4bc6d41a691e9684a98a022d0db9d9444470820847e648e369a5f0c7887dc31d6ffa51572634345fe2448c1defe8535eb79c30f8202f41f
-
Filesize
511KB
MD5dd1443f153f7cf554addb404aff623f8
SHA1893f24f463d03b3b19e952b85ae06daffcc466d1
SHA256b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887
SHA5126fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd
-
Filesize
1.1MB
MD504eeb71a179940aca8073ddaa5bf4350
SHA102f7c99c4a2784b2db466b20c6e9c02cccc733b6
SHA256acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385
SHA512049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21
-
Filesize
213KB
MD51dd2c3ecae68a35cde2d586aa24e0f25
SHA1600f6a6af5b43a00c5ddd040a79afbeadba053cf
SHA256905fbcb0f93015941e884bd37b5d196788bc4422919fead4be12fbfd42fb5440
SHA512237f5623042dfab544458847cebe1a5f95bf83165d6155086378976b1082d7709b0fe8379ba15fff8ea39664ffe67546719983d27ce3e82cec6ac667e0f78145
-
Filesize
816KB
MD553de7a10d35eb29067271ac7b7b290f0
SHA1a90dbc5ac916171f0c79e617012945f020382137
SHA2568a19b8ea0aa65e41911a9f411cf93b9555ce5a8e308f5b37fc124e312b562938
SHA512c0e1d557adcce95697c83cb5521f72d62f3f3bc77c4bd46aab32070bb796c33b4d09d9399fb969ed5af8dedd0f2b6b917fd36355d17d5a922a2200fb39795892
-
Filesize
277KB
MD5479263a138a81ac646a04a7ca1060821
SHA17bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3
SHA256bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d
SHA512136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7
-
Filesize
87B
MD547f61d0f7bd830f5bfe72c3b65941fde
SHA1d7f440877e23679fd2c480dff2b8f3219702d681
SHA256eb09cf1094904f0d3038ce1e981fd4366eba4000c8b6f13a3dbbaefea4797e37
SHA512d234f17af1440aba1a4f6c2b24d04fdeb3a685f25f391cdc1ac048dfed1b470689bed5b21d7b3db94f9186445932982f462bbee8af919c1a957ab89bd69e68f5
-
Filesize
1.4MB
MD5cee09dac2393fb81c34ea3c5ced75d31
SHA1e2d5c7720c65b4dcd7f740104fc9f8890b68a494
SHA256156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570
SHA512c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f
-
Filesize
1KB
MD557e60b666f6c98a0b5ca1f1f7c01a2fa
SHA1f478d9b50584bad36354b466841f485571064c5f
SHA2562c3efa207ee854ce1c9f46bfa577a70818f820e90d2ab784725017c334448867
SHA512fdbc5a5b2d4d134bcbe3651e5c1da6cb894f020cbcc15a2c016d96ea45d043ada5ca5628df993a8fd5e40bc1663ffe772b93682fd71c3b17f3d2db8590be3ec1
-
Filesize
157KB
MD55e5d4efe2127670ca170e46ca673711b
SHA1c95d1a8abe4fdbaf1d74c5044e0482463f47956e
SHA256c840ad47829717a9f0855b7476b5fcf4c2f717d5e8475adba04a7d2c949db814
SHA512f9a5d2fd02e0b1bcec3df3d1d811284ca4fdf1b7fc7b741b8fdcc22d339f21d19abde2da5d8ebb40946859ec1654be361d1b315dc7d392abb68b3d233c0cc980
-
Filesize
166KB
MD5170899a660d5d4a350edf80c77334136
SHA18119313e8a998ad83ee6a13ef88b6fa1c2a0fcae
SHA2563672f758b4e875a66b2d95721c89a5ddd7d0eef27b10db254f321041c9f6cf43
SHA512a87f2fe159f5cae36feda263f10473c7a0df0ddb5c4b82ded1d55b43d4223a4d03ce2a5b7254400d89cff2583f28c793dad2e8cc19cf98a54c42644f08ff7fd3
-
Filesize
90KB
MD580f899ca024ddcf5218a4fadeacaec54
SHA12756821bde2d8eb44b04da63afbf5496565ddf71
SHA2562a0d8c0778ef91c5e9f7ffac47a0e49a4055d50556895822d84adcbce9375c17
SHA512ae871718f3eb2bcdd4bc6d41a691e9684a98a022d0db9d9444470820847e648e369a5f0c7887dc31d6ffa51572634345fe2448c1defe8535eb79c30f8202f41f
-
Filesize
511KB
MD5dd1443f153f7cf554addb404aff623f8
SHA1893f24f463d03b3b19e952b85ae06daffcc466d1
SHA256b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887
SHA5126fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd
-
Filesize
511KB
MD5dd1443f153f7cf554addb404aff623f8
SHA1893f24f463d03b3b19e952b85ae06daffcc466d1
SHA256b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887
SHA5126fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd
-
Filesize
511KB
MD5dd1443f153f7cf554addb404aff623f8
SHA1893f24f463d03b3b19e952b85ae06daffcc466d1
SHA256b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887
SHA5126fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd
-
Filesize
511KB
MD5dd1443f153f7cf554addb404aff623f8
SHA1893f24f463d03b3b19e952b85ae06daffcc466d1
SHA256b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887
SHA5126fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd
-
Filesize
69KB
MD5c8ed4b3af03d82cc3fe2f8c42c22326c
SHA178a2e216262b8f1b35e408685cf20f2fa4685d8f
SHA2561c73f57c31845d3719644f815ca9df1efb18cfc3dfc2dc1b4afddb71261afb31
SHA51234e6cf09afa68875be24005f90be35bb7c490ac9d2f63befadfdd1902136c383ee903442c9df572e2ccd0b7ea1be10857401c76c5b6923c28f8eaecab5b3c45c
-
Filesize
1.1MB
MD504eeb71a179940aca8073ddaa5bf4350
SHA102f7c99c4a2784b2db466b20c6e9c02cccc733b6
SHA256acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385
SHA512049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21
-
Filesize
1.1MB
MD504eeb71a179940aca8073ddaa5bf4350
SHA102f7c99c4a2784b2db466b20c6e9c02cccc733b6
SHA256acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385
SHA512049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21
-
Filesize
1.1MB
MD504eeb71a179940aca8073ddaa5bf4350
SHA102f7c99c4a2784b2db466b20c6e9c02cccc733b6
SHA256acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385
SHA512049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21
-
Filesize
1.1MB
MD504eeb71a179940aca8073ddaa5bf4350
SHA102f7c99c4a2784b2db466b20c6e9c02cccc733b6
SHA256acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385
SHA512049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21
-
Filesize
337KB
MD5bb1ce6771f3bdfa3db16106e6802cf45
SHA19303e90c1782df8dd383ae75235e400e4a75df25
SHA256b30440a7fe3f2cef818e9769df7aea5af5bd150058630299c34836f0eeec0270
SHA512d412665027d7ad1b110a9e62b8ef2d1ab500b559865bb2cfa6584347993bb1e5634e442b158b3a8cbbf2df62d5ccd81714ac3e7f97246aca7b700991147893c2
-
Filesize
337KB
MD5bb1ce6771f3bdfa3db16106e6802cf45
SHA19303e90c1782df8dd383ae75235e400e4a75df25
SHA256b30440a7fe3f2cef818e9769df7aea5af5bd150058630299c34836f0eeec0270
SHA512d412665027d7ad1b110a9e62b8ef2d1ab500b559865bb2cfa6584347993bb1e5634e442b158b3a8cbbf2df62d5ccd81714ac3e7f97246aca7b700991147893c2
-
Filesize
213KB
MD51dd2c3ecae68a35cde2d586aa24e0f25
SHA1600f6a6af5b43a00c5ddd040a79afbeadba053cf
SHA256905fbcb0f93015941e884bd37b5d196788bc4422919fead4be12fbfd42fb5440
SHA512237f5623042dfab544458847cebe1a5f95bf83165d6155086378976b1082d7709b0fe8379ba15fff8ea39664ffe67546719983d27ce3e82cec6ac667e0f78145
-
Filesize
495KB
MD5c423991edd1e101d7c1aa7f2fe5d6670
SHA11f19d1c7e6f9189b2cdc875cc4b5c9afcf976e51
SHA256f6cf76ca159237d0661b94d49d50657363db2df2f1b15188a60ef207c09a9ca4
SHA51273640c9f8342ba3d51649726e85bad9510860ca836f8de21df27d9163ae0a6092a66fe8b10c3870f1ec3084a5ea1cb2917af50572b865a15d8faa8306fb9df9f
-
Filesize
816KB
MD553de7a10d35eb29067271ac7b7b290f0
SHA1a90dbc5ac916171f0c79e617012945f020382137
SHA2568a19b8ea0aa65e41911a9f411cf93b9555ce5a8e308f5b37fc124e312b562938
SHA512c0e1d557adcce95697c83cb5521f72d62f3f3bc77c4bd46aab32070bb796c33b4d09d9399fb969ed5af8dedd0f2b6b917fd36355d17d5a922a2200fb39795892
-
Filesize
277KB
MD5479263a138a81ac646a04a7ca1060821
SHA17bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3
SHA256bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d
SHA512136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7
-
Filesize
277KB
MD5479263a138a81ac646a04a7ca1060821
SHA17bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3
SHA256bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d
SHA512136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7
-
Filesize
277KB
MD5479263a138a81ac646a04a7ca1060821
SHA17bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3
SHA256bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d
SHA512136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7
-
Filesize
277KB
MD5479263a138a81ac646a04a7ca1060821
SHA17bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3
SHA256bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d
SHA512136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7
-
Filesize
1.4MB
MD5cee09dac2393fb81c34ea3c5ced75d31
SHA1e2d5c7720c65b4dcd7f740104fc9f8890b68a494
SHA256156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570
SHA512c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f
-
Filesize
1.4MB
MD5cee09dac2393fb81c34ea3c5ced75d31
SHA1e2d5c7720c65b4dcd7f740104fc9f8890b68a494
SHA256156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570
SHA512c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f
-
Filesize
1.4MB
MD5cee09dac2393fb81c34ea3c5ced75d31
SHA1e2d5c7720c65b4dcd7f740104fc9f8890b68a494
SHA256156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570
SHA512c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f
-
Filesize
1.4MB
MD5cee09dac2393fb81c34ea3c5ced75d31
SHA1e2d5c7720c65b4dcd7f740104fc9f8890b68a494
SHA256156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570
SHA512c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f
-
Filesize
1.4MB
MD5cee09dac2393fb81c34ea3c5ced75d31
SHA1e2d5c7720c65b4dcd7f740104fc9f8890b68a494
SHA256156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570
SHA512c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f
-
Filesize
536KB
MD54c8a880eabc0b4d462cc4b2472116ea1
SHA1d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA2562026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
SHA5126a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
-
Filesize
536KB
MD54c8a880eabc0b4d462cc4b2472116ea1
SHA1d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA2562026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
SHA5126a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
-
Filesize
536KB
MD54c8a880eabc0b4d462cc4b2472116ea1
SHA1d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA2562026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
SHA5126a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
-
Filesize
536KB
MD54c8a880eabc0b4d462cc4b2472116ea1
SHA1d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA2562026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
SHA5126a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
-
Filesize
612KB
MD5e4fece18310e23b1d8fee993e35e7a6f
SHA19fd3a7f0522d36c2bf0e64fc510c6eea3603b564
SHA25602bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9
SHA5122fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc
-
Filesize
612KB
MD5e4fece18310e23b1d8fee993e35e7a6f
SHA19fd3a7f0522d36c2bf0e64fc510c6eea3603b564
SHA25602bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9
SHA5122fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc
-
Filesize
612KB
MD5e4fece18310e23b1d8fee993e35e7a6f
SHA19fd3a7f0522d36c2bf0e64fc510c6eea3603b564
SHA25602bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9
SHA5122fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc
-
Filesize
612KB
MD5e4fece18310e23b1d8fee993e35e7a6f
SHA19fd3a7f0522d36c2bf0e64fc510c6eea3603b564
SHA25602bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9
SHA5122fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc
-
Filesize
166KB
MD5170899a660d5d4a350edf80c77334136
SHA18119313e8a998ad83ee6a13ef88b6fa1c2a0fcae
SHA2563672f758b4e875a66b2d95721c89a5ddd7d0eef27b10db254f321041c9f6cf43
SHA512a87f2fe159f5cae36feda263f10473c7a0df0ddb5c4b82ded1d55b43d4223a4d03ce2a5b7254400d89cff2583f28c793dad2e8cc19cf98a54c42644f08ff7fd3
-
Filesize
259KB
MD51636dd864151388451acb8b2fc1fccb8
SHA106e3ac51140a1f7c35f79f8c69e997919838bd01
SHA256859bdfd8e8f067c3d2328e3cc910d906d07298fd2a5ffc9e89f22df61c499126
SHA512694911e645fc982ec31aba9283c5e247a93d05b378a3e6eee1374d7f405257bef0e665f58fe29f1dd8417169373a772b6015548c1dc4643266a457b283dcaf10
-
Filesize
259KB
MD51636dd864151388451acb8b2fc1fccb8
SHA106e3ac51140a1f7c35f79f8c69e997919838bd01
SHA256859bdfd8e8f067c3d2328e3cc910d906d07298fd2a5ffc9e89f22df61c499126
SHA512694911e645fc982ec31aba9283c5e247a93d05b378a3e6eee1374d7f405257bef0e665f58fe29f1dd8417169373a772b6015548c1dc4643266a457b283dcaf10
-
Filesize
842KB
MD5c833984034607e01850987d075f4c3b9
SHA1c5cb941666198a1678c88faf22be0a1b0b007813
SHA256c6027958286a3f1a0e5ff5e104d461c6a1df7e1d0a828ab78fffa506ee2cc294
SHA512918e3fee2fae74e8f278277774d8237c658b3d7c994ec20640c81667e66671a3029bdf7ff8e9fcfdbff8f1b2d8f98bd5492d5a3200d516a47db19a2ecce72d59
-
Filesize
16.8MB
MD51f1c87b2b8528523907cc58c00923df8
SHA1ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514
SHA25637e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a
SHA5122a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc
-
Filesize
16.8MB
MD51f1c87b2b8528523907cc58c00923df8
SHA1ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514
SHA25637e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a
SHA5122a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc
-
Filesize
16.8MB
MD51f1c87b2b8528523907cc58c00923df8
SHA1ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514
SHA25637e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a
SHA5122a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc
-
Filesize
4.6MB
MD5512fe2eb54dde3c922ce73c075a592a1
SHA14332a256f0a77381ecd11e823475c335691325d7
SHA256110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e
SHA512a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e
-
Filesize
4.6MB
MD5512fe2eb54dde3c922ce73c075a592a1
SHA14332a256f0a77381ecd11e823475c335691325d7
SHA256110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e
SHA512a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e
-
Filesize
4.6MB
MD5512fe2eb54dde3c922ce73c075a592a1
SHA14332a256f0a77381ecd11e823475c335691325d7
SHA256110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e
SHA512a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e