Resubmissions
05-11-2022 19:59
221105-yqefyabgdl 1005-11-2022 19:56
221105-yn7dyabgcp 1005-11-2022 19:39
221105-ydcftabfgr 1005-11-2022 19:22
221105-x3ef2ahce6 10Analysis
-
max time kernel
690s -
max time network
693s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-de -
resource tags
arch:x64arch:x86image:win10v2004-20220812-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
05-11-2022 19:59
Static task
static1
Behavioral task
behavioral1
Sample
Crack UZ1/DriverDoc.exe
Resource
win10v2004-20220812-de
Behavioral task
behavioral2
Sample
Setup_DriverDoc_2022.exe
Resource
win10v2004-20220812-de
Errors
General
-
Target
Setup_DriverDoc_2022.exe
-
Size
6.0MB
-
MD5
c65a354ac28f2f45c7ca8a38e4f778d6
-
SHA1
42d84f6be5cfa1503dc7bd8275073872d71a4fc0
-
SHA256
396cb9e17c57f09c4afab97f91e72011e3f115b15e764c39d26473d92fe2c45e
-
SHA512
7acba2651fb1378a97c47ce6723808235ddd74d2cb736f5fb6f28a241f3b33188e9a511c6be2eb3ca8e7cad68c05a76a0c853edc5a417a16aacd5c0388950017
-
SSDEEP
98304:KSi1jH0UJukUYMwioEgGU9KM+ZFNIO05p0oO2gz8+fyTx:MUvkUMiij9KM+7Npc0R4+KTx
Malware Config
Signatures
-
Affect hook table 5 IoCs
resource yara_rule behavioral2/files/0x0006000000022e24-135.dat win_hook behavioral2/files/0x0006000000022e24-142.dat win_hook behavioral2/files/0x0006000000022e5e-144.dat win_hook behavioral2/files/0x0006000000022e27-148.dat win_hook behavioral2/files/0x0006000000022e5e-167.dat win_hook -
Anti-Sandbox checks for ThreatExpert 1 IoCs
resource yara_rule behavioral2/files/0x0006000000022e27-148.dat antisb_threatExpert -
Bypass DEP 6 IoCs
resource yara_rule behavioral2/memory/3816-132-0x0000000000400000-0x00000000004E4000-memory.dmp disable_dep behavioral2/files/0x0006000000022e24-135.dat disable_dep behavioral2/memory/3816-136-0x0000000000400000-0x00000000004E4000-memory.dmp disable_dep behavioral2/memory/3816-137-0x0000000000400000-0x00000000004E4000-memory.dmp disable_dep behavioral2/files/0x0006000000022e24-142.dat disable_dep behavioral2/memory/3816-168-0x0000000000400000-0x00000000004E4000-memory.dmp disable_dep -
Check_OutputDebugStringA_iat 5 IoCs
resource yara_rule behavioral2/files/0x0006000000022e60-145.dat Check_OutputDebugStringA_iat behavioral2/files/0x0006000000022e60-146.dat Check_OutputDebugStringA_iat behavioral2/files/0x0006000000022e3f-150.dat Check_OutputDebugStringA_iat behavioral2/files/0x0006000000022e3f-149.dat Check_OutputDebugStringA_iat behavioral2/files/0x0006000000022e60-169.dat Check_OutputDebugStringA_iat -
Checks if being debugged 10 IoCs
resource yara_rule behavioral2/files/0x0006000000022e24-135.dat anti_dbg behavioral2/files/0x0006000000022e24-142.dat anti_dbg behavioral2/files/0x0006000000022e5e-144.dat anti_dbg behavioral2/files/0x0006000000022e60-145.dat anti_dbg behavioral2/files/0x0006000000022e60-146.dat anti_dbg behavioral2/files/0x0006000000022e27-148.dat anti_dbg behavioral2/files/0x0006000000022e3f-150.dat anti_dbg behavioral2/files/0x0006000000022e3f-149.dat anti_dbg behavioral2/files/0x0006000000022e5e-167.dat anti_dbg behavioral2/files/0x0006000000022e60-169.dat anti_dbg -
DebuggerCheck__QueryInfo 2 IoCs
resource yara_rule behavioral2/files/0x0006000000022e5e-144.dat DebuggerCheck__QueryInfo behavioral2/files/0x0006000000022e5e-167.dat DebuggerCheck__QueryInfo -
DebuggerException__SetConsoleCtrl 2 IoCs
resource yara_rule behavioral2/files/0x0006000000022e24-135.dat DebuggerException__SetConsoleCtrl behavioral2/files/0x0006000000022e24-142.dat DebuggerException__SetConsoleCtrl -
SEH_Init 20 IoCs
resource yara_rule behavioral2/files/0x0006000000022e24-135.dat SEH_Init behavioral2/files/0x0006000000022e24-142.dat SEH_Init behavioral2/files/0x0006000000022e5e-144.dat SEH_Init behavioral2/files/0x0006000000022e27-148.dat SEH_Init behavioral2/files/0x0006000000022e5e-167.dat SEH_Init behavioral2/memory/3908-170-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Init behavioral2/memory/3908-194-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Init behavioral2/files/0x0006000000022e61-205.dat SEH_Init behavioral2/files/0x0006000000022e61-204.dat SEH_Init behavioral2/files/0x0006000000022e61-203.dat SEH_Init behavioral2/memory/3908-206-0x0000000004AD0000-0x0000000004BD2000-memory.dmp SEH_Init behavioral2/files/0x0006000000022e61-209.dat SEH_Init behavioral2/memory/3908-210-0x00000000057A0000-0x00000000058A2000-memory.dmp SEH_Init behavioral2/files/0x0006000000022e61-208.dat SEH_Init behavioral2/files/0x0006000000022e61-226.dat SEH_Init behavioral2/files/0x0006000000022e61-227.dat SEH_Init behavioral2/memory/3908-228-0x0000000004C90000-0x0000000004D92000-memory.dmp SEH_Init behavioral2/memory/3164-242-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Init behavioral2/memory/3908-243-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Init behavioral2/memory/3164-244-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Init -
SEH_Save 10 IoCs
resource yara_rule behavioral2/files/0x0006000000022e24-135.dat SEH_Save behavioral2/files/0x0006000000022e24-142.dat SEH_Save behavioral2/files/0x0006000000022e5e-144.dat SEH_Save behavioral2/files/0x0006000000022e27-148.dat SEH_Save behavioral2/files/0x0006000000022e5e-167.dat SEH_Save behavioral2/memory/3908-170-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Save behavioral2/memory/3908-194-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Save behavioral2/memory/3164-242-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Save behavioral2/memory/3908-243-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Save behavioral2/memory/3164-244-0x0000000000400000-0x0000000000C26000-memory.dmp SEH_Save -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\msisadrv.sys DrvInst.exe -
Executes dropped EXE 6 IoCs
pid Process 3988 Setup_DriverDoc_2022.tmp 4184 DriverDoc.exe 3376 DriverPro.exe 1492 stub64.exe 4944 stub64.exe 2456 DOCSchedule.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Setup_DriverDoc_2022.tmp -
Loads dropped DLL 10 IoCs
pid Process 4184 DriverDoc.exe 3376 DriverPro.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3164 DriverDoc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Setup_DriverDoc_2022.tmp File opened (read-only) \??\N: Setup_DriverDoc_2022.tmp File opened (read-only) \??\P: Setup_DriverDoc_2022.tmp File opened (read-only) \??\R: Setup_DriverDoc_2022.tmp File opened (read-only) \??\S: Setup_DriverDoc_2022.tmp File opened (read-only) \??\T: Setup_DriverDoc_2022.tmp File opened (read-only) \??\Y: Setup_DriverDoc_2022.tmp File opened (read-only) \??\Z: Setup_DriverDoc_2022.tmp File opened (read-only) \??\A: Setup_DriverDoc_2022.tmp File opened (read-only) \??\G: Setup_DriverDoc_2022.tmp File opened (read-only) \??\H: Setup_DriverDoc_2022.tmp File opened (read-only) \??\J: Setup_DriverDoc_2022.tmp File opened (read-only) \??\L: Setup_DriverDoc_2022.tmp File opened (read-only) \??\V: Setup_DriverDoc_2022.tmp File opened (read-only) \??\E: Setup_DriverDoc_2022.tmp File opened (read-only) \??\F: Setup_DriverDoc_2022.tmp File opened (read-only) \??\I: Setup_DriverDoc_2022.tmp File opened (read-only) \??\K: Setup_DriverDoc_2022.tmp File opened (read-only) \??\O: Setup_DriverDoc_2022.tmp File opened (read-only) \??\B: Setup_DriverDoc_2022.tmp File opened (read-only) \??\Q: Setup_DriverDoc_2022.tmp File opened (read-only) \??\U: Setup_DriverDoc_2022.tmp File opened (read-only) \??\W: Setup_DriverDoc_2022.tmp File opened (read-only) \??\X: Setup_DriverDoc_2022.tmp -
Drops file in System32 directory 27 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF DriverDoc.exe File created C:\Windows\System32\DriverStore\Temp\{d15de2ea-994e-c849-aa82-e2fab300b9cf}\SETDA22.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g33q35.inf_amd64_e9941dd830075741\g33q35.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ich9core.inf_amd64_11099e449d0dade9\ich9core.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ec606a52-ab27-474d-9c3b-e1b2b487b7c5}\SET2564.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d15de2ea-994e-c849-aa82-e2fab300b9cf}\ich9core.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d15de2ea-994e-c849-aa82-e2fab300b9cf}\SETDA32.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ich9core.inf_amd64_11099e449d0dade9\ich9core.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ich9core.inf_amd64_11099e449d0dade9\ich9core.PNF stub64.exe File created C:\Windows\System32\DriverStore\Temp\{ec606a52-ab27-474d-9c3b-e1b2b487b7c5}\SET2554.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\g33q35.inf_amd64_e9941dd830075741\g33q35.PNF stub64.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g33q35.inf_amd64_e9941dd830075741\g33q35.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec606a52-ab27-474d-9c3b-e1b2b487b7c5}\g33q35.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\g33q35.inf_amd64_e9941dd830075741\g33q35.PNF DriverDoc.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d15de2ea-994e-c849-aa82-e2fab300b9cf}\SETDA32.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d15de2ea-994e-c849-aa82-e2fab300b9cf}\ich9core.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d15de2ea-994e-c849-aa82-e2fab300b9cf} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec606a52-ab27-474d-9c3b-e1b2b487b7c5}\g33q35.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec606a52-ab27-474d-9c3b-e1b2b487b7c5}\SET2564.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d15de2ea-994e-c849-aa82-e2fab300b9cf}\SETDA22.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ich9core.inf_amd64_11099e449d0dade9\ich9core.PNF DriverDoc.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec606a52-ab27-474d-9c3b-e1b2b487b7c5}\SET2554.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec606a52-ab27-474d-9c3b-e1b2b487b7c5} DrvInst.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\af0e9c3b-9f92-484a-a26c-c98357057305.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221105210736.pma setup.exe -
Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log stub64.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\disk.PNF DriverDoc.exe File created C:\Windows\INF\c_media.PNF DriverDoc.exe File opened for modification C:\Windows\INF\printqueue.PNF DriverDoc.exe File opened for modification C:\Windows\INF\kdnic.PNF DriverDoc.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\oem2.PNF DriverDoc.exe File created C:\Windows\INF\c_display.PNF DriverDoc.exe File created C:\Windows\INF\c_volume.PNF DriverDoc.exe File opened for modification C:\Windows\INF\cpu.PNF DriverDoc.exe File created C:\Windows\INF\c_processor.PNF DriverDoc.exe File opened for modification C:\Windows\INF\machine.PNF DriverDoc.exe File opened for modification C:\Windows\INF\machine.PNF stub64.exe File opened for modification C:\Windows\INF\machine.PNF stub64.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\INF\c_monitor.PNF DriverDoc.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\c_swdevice.PNF DriverDoc.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\INF\c_diskdrive.PNF DriverDoc.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\oem3.PNF DriverDoc.exe File opened for modification C:\Windows\INF\netrtl64.PNF DriverDoc.exe File opened for modification C:\Windows\INF\audioendpoint.PNF DriverDoc.exe File opened for modification C:\Windows\INF\vhdmp.PNF DriverDoc.exe File opened for modification C:\Windows\INF\setupapi.dev.log stub64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs stub64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 stub64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID stub64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom stub64.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ParentIdPrefix DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Driver DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ DriverDoc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LocationInformation DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ParentIdPrefix DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E\ DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceCharacteristics DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UINumberDescFormat DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceCharacteristics DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 stub64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom stub64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ParentIdPrefix DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0003 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 stub64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UINumberDescFormat DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Driver DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0003 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceCharacteristics DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom stub64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs stub64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID stub64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 DriverDoc.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 4 IoCs
pid Process 3332 taskkill.exe 3104 taskkill.exe 3524 taskkill.exe 1296 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "169" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 3988 Setup_DriverDoc_2022.tmp 3988 Setup_DriverDoc_2022.tmp 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 4184 DriverDoc.exe 3376 DriverPro.exe 3376 DriverPro.exe 996 msedge.exe 996 msedge.exe 3308 msedge.exe 3308 msedge.exe 4776 identity_helper.exe 4776 identity_helper.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 3908 DriverDoc.exe 2456 DOCSchedule.exe 2456 DOCSchedule.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3988 Setup_DriverDoc_2022.tmp 3908 DriverDoc.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 3332 taskkill.exe Token: SeDebugPrivilege 3104 taskkill.exe Token: SeDebugPrivilege 3524 taskkill.exe Token: SeDebugPrivilege 1296 taskkill.exe Token: SeDebugPrivilege 4184 DriverDoc.exe Token: SeIncreaseQuotaPrivilege 4184 DriverDoc.exe Token: SeImpersonatePrivilege 4184 DriverDoc.exe Token: SeLoadDriverPrivilege 4184 DriverDoc.exe Token: SeDebugPrivilege 3908 DriverDoc.exe Token: SeIncreaseQuotaPrivilege 3908 DriverDoc.exe Token: SeImpersonatePrivilege 3908 DriverDoc.exe Token: SeLoadDriverPrivilege 3908 DriverDoc.exe Token: SeAuditPrivilege 4064 svchost.exe Token: SeSecurityPrivilege 4064 svchost.exe Token: SeBackupPrivilege 4164 vssvc.exe Token: SeRestorePrivilege 4164 vssvc.exe Token: SeAuditPrivilege 4164 vssvc.exe Token: SeLoadDriverPrivilege 1492 stub64.exe Token: SeRestorePrivilege 2884 DrvInst.exe Token: SeBackupPrivilege 2884 DrvInst.exe Token: SeLoadDriverPrivilege 2884 DrvInst.exe Token: SeLoadDriverPrivilege 2884 DrvInst.exe Token: SeLoadDriverPrivilege 2884 DrvInst.exe Token: SeLoadDriverPrivilege 2884 DrvInst.exe Token: SeBackupPrivilege 2196 srtasks.exe Token: SeRestorePrivilege 2196 srtasks.exe Token: SeSecurityPrivilege 2196 srtasks.exe Token: SeTakeOwnershipPrivilege 2196 srtasks.exe Token: SeBackupPrivilege 2196 srtasks.exe Token: SeRestorePrivilege 2196 srtasks.exe Token: SeSecurityPrivilege 2196 srtasks.exe Token: SeTakeOwnershipPrivilege 2196 srtasks.exe Token: SeLoadDriverPrivilege 4944 stub64.exe Token: SeLoadDriverPrivilege 3440 DrvInst.exe Token: SeLoadDriverPrivilege 3440 DrvInst.exe Token: SeLoadDriverPrivilege 3440 DrvInst.exe Token: SeLoadDriverPrivilege 3440 DrvInst.exe Token: SeShutdownPrivilege 3908 DriverDoc.exe Token: SeDebugPrivilege 3164 DriverDoc.exe Token: SeIncreaseQuotaPrivilege 3164 DriverDoc.exe Token: SeImpersonatePrivilege 3164 DriverDoc.exe Token: SeLoadDriverPrivilege 3164 DriverDoc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 3988 Setup_DriverDoc_2022.tmp 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3164 DriverDoc.exe 3164 DriverDoc.exe 3164 DriverDoc.exe 3164 DriverDoc.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3164 DriverDoc.exe 3164 DriverDoc.exe 3164 DriverDoc.exe 3164 DriverDoc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4540 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3816 wrote to memory of 3988 3816 Setup_DriverDoc_2022.exe 82 PID 3816 wrote to memory of 3988 3816 Setup_DriverDoc_2022.exe 82 PID 3816 wrote to memory of 3988 3816 Setup_DriverDoc_2022.exe 82 PID 3988 wrote to memory of 3332 3988 Setup_DriverDoc_2022.tmp 91 PID 3988 wrote to memory of 3332 3988 Setup_DriverDoc_2022.tmp 91 PID 3988 wrote to memory of 3332 3988 Setup_DriverDoc_2022.tmp 91 PID 3988 wrote to memory of 3104 3988 Setup_DriverDoc_2022.tmp 93 PID 3988 wrote to memory of 3104 3988 Setup_DriverDoc_2022.tmp 93 PID 3988 wrote to memory of 3104 3988 Setup_DriverDoc_2022.tmp 93 PID 3988 wrote to memory of 3524 3988 Setup_DriverDoc_2022.tmp 95 PID 3988 wrote to memory of 3524 3988 Setup_DriverDoc_2022.tmp 95 PID 3988 wrote to memory of 3524 3988 Setup_DriverDoc_2022.tmp 95 PID 3988 wrote to memory of 1296 3988 Setup_DriverDoc_2022.tmp 97 PID 3988 wrote to memory of 1296 3988 Setup_DriverDoc_2022.tmp 97 PID 3988 wrote to memory of 1296 3988 Setup_DriverDoc_2022.tmp 97 PID 3988 wrote to memory of 4184 3988 Setup_DriverDoc_2022.tmp 100 PID 3988 wrote to memory of 4184 3988 Setup_DriverDoc_2022.tmp 100 PID 3988 wrote to memory of 4184 3988 Setup_DriverDoc_2022.tmp 100 PID 3988 wrote to memory of 3376 3988 Setup_DriverDoc_2022.tmp 101 PID 3988 wrote to memory of 3376 3988 Setup_DriverDoc_2022.tmp 101 PID 3988 wrote to memory of 3376 3988 Setup_DriverDoc_2022.tmp 101 PID 3908 wrote to memory of 4680 3908 DriverDoc.exe 109 PID 3908 wrote to memory of 4680 3908 DriverDoc.exe 109 PID 3908 wrote to memory of 4680 3908 DriverDoc.exe 109 PID 3908 wrote to memory of 4080 3908 DriverDoc.exe 111 PID 3908 wrote to memory of 4080 3908 DriverDoc.exe 111 PID 3908 wrote to memory of 4080 3908 DriverDoc.exe 111 PID 3908 wrote to memory of 716 3908 DriverDoc.exe 113 PID 3908 wrote to memory of 716 3908 DriverDoc.exe 113 PID 3908 wrote to memory of 716 3908 DriverDoc.exe 113 PID 3908 wrote to memory of 2604 3908 DriverDoc.exe 115 PID 3908 wrote to memory of 2604 3908 DriverDoc.exe 115 PID 3908 wrote to memory of 2604 3908 DriverDoc.exe 115 PID 3908 wrote to memory of 3308 3908 DriverDoc.exe 117 PID 3908 wrote to memory of 3308 3908 DriverDoc.exe 117 PID 3308 wrote to memory of 2544 3308 msedge.exe 119 PID 3308 wrote to memory of 2544 3308 msedge.exe 119 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123 PID 3308 wrote to memory of 1892 3308 msedge.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2022.exeC:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2022.exe move "Setup_DriverDoc_2022.exe" "C:/Krat0x0s/"1⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\is-EB6PK.tmp\Setup_DriverDoc_2022.tmp"C:\Users\Admin\AppData\Local\Temp\is-EB6PK.tmp\Setup_DriverDoc_2022.tmp" /SL5="$70114,5347251,879104,C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2022.exe" move "Setup_DriverDoc_2022.exe" "C:/Krat0x0s/"2⤵
- Executes dropped EXE
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "DriverDoc.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "DriverPro.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "DOCSchedule.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "DOCTray.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\DriverDoc\DriverDoc.exe"C:\DriverDoc\DriverDoc.exe" /INSTALL3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
-
C:\DriverDoc\Extra\DriverPro.exe"C:\DriverDoc\Extra\DriverPro.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3376
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1492
-
C:\DriverDoc\DriverDoc.exe"C:\DriverDoc\DriverDoc.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "DriverDoc Schedule" /F2⤵PID:4680
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "DriverDoc Monitoring" /F2⤵PID:4080
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "DriverDoc Schedule" /F2⤵PID:716
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "DriverDoc Monitoring" /F2⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.solvusoft.com/de/driverdoc/install/2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0x40,0x124,0x7ffca6cb46f8,0x7ffca6cb4708,0x7ffca6cb47183⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:23⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:83⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:13⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:13⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --lang=de --service-sandbox-type=service --mojo-platform-channel-handle=4968 /prefetch:83⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:13⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --lang=de --service-sandbox-type=service --mojo-platform-channel-handle=6024 /prefetch:83⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:13⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:13⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:83⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:4664 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff718845460,0x7ff718845470,0x7ff7188454804⤵PID:4192
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,7343266699789188457,5768664018422627567,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
-
-
C:\DriverDoc\stub64.exe"C:\DriverDoc\stub64.exe" install "PCI\VEN_8086&DEV_2918&SUBSYS_11001AF4&REV_02" "C:\ProgramData\DriverDoc\Drivers\E517B372AEF81A8C6777B3EDFC38F0297B8DC3F7\ich9core.inf"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\DriverDoc\stub64.exe"C:\DriverDoc\stub64.exe" install "PCI\VEN_8086&DEV_29C0&SUBSYS_11001AF4&REV_00" "C:\ProgramData\DriverDoc\Drivers\A4E2601824DB5A6277CD8730FADC91DA71BA21FC\g33q35.inf"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "DriverDoc Schedule" /F2⤵PID:1236
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "DriverDoc Monitoring" /F2⤵PID:1408
-
-
C:\DriverDoc\DriverDoc.exe"C:\DriverDoc\DriverDoc.exe" /TRAY2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3164
-
-
C:\DriverDoc\Extra\DOCSchedule.exe"C:\DriverDoc\Extra\DOCSchedule.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2456
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4064 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{446be8af-f90e-cb4e-9d83-b569d8185c2d}\ich9core.inf" "9" "7cf55133b" "0000000000000140" "WinSta0\Default" "0000000000000150" "208" "c:\programdata\driverdoc\drivers\e517b372aef81a8c6777b3edfc38f0297b8dc3f7"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1948
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "PCI\VEN_8086&DEV_2918&SUBSYS_11001AF4&REV_02\3&11583659&0&F8" "C:\Windows\INF\oem2.inf" "oem2.inf:5f63e5346227d1ad:Intel_ISAPNP_DRV:9.1.9.1005:pci\ven_8086&dev_2918," "7cf55133b" "0000000000000140"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ca38b1bd-cbb6-c148-815d-9248917eb619}\g33q35.inf" "9" "77b68c593" "00000000000000B8" "WinSta0\Default" "0000000000000154" "208" "c:\programdata\driverdoc\drivers\a4e2601824db5a6277cd8730fadc91da71ba21fc"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4736
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "PCI\VEN_8086&DEV_29C0&SUBSYS_11001AF4&REV_00\3&11583659&0&00" "C:\Windows\INF\oem3.inf" "oem3.inf:5f63e5340ae96413:Intel_NO_DRV:9.1.9.1005:pci\ven_8086&dev_29c0," "77b68c593" "0000000000000180"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3968855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4540
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
991KB
MD5eeb340cd0317612256596870fdad903f
SHA1c4cd2abe134b3d5e043593dd88c7d61d6d53e417
SHA256aecadb80ac6e9bfdf585933d5bf3741a130206df61324cccbf613a31101a3d54
SHA512a4c03aeada2f9f0b333db50bdf42612eef742b6f26eb39749aebe9d504f47aef4d3e098f49b04cfd10a2c2fb73a7bbb1b53bfd098e4e6ccdd9ce8a9e56554c9e
-
Filesize
991KB
MD5eeb340cd0317612256596870fdad903f
SHA1c4cd2abe134b3d5e043593dd88c7d61d6d53e417
SHA256aecadb80ac6e9bfdf585933d5bf3741a130206df61324cccbf613a31101a3d54
SHA512a4c03aeada2f9f0b333db50bdf42612eef742b6f26eb39749aebe9d504f47aef4d3e098f49b04cfd10a2c2fb73a7bbb1b53bfd098e4e6ccdd9ce8a9e56554c9e
-
Filesize
991KB
MD5eeb340cd0317612256596870fdad903f
SHA1c4cd2abe134b3d5e043593dd88c7d61d6d53e417
SHA256aecadb80ac6e9bfdf585933d5bf3741a130206df61324cccbf613a31101a3d54
SHA512a4c03aeada2f9f0b333db50bdf42612eef742b6f26eb39749aebe9d504f47aef4d3e098f49b04cfd10a2c2fb73a7bbb1b53bfd098e4e6ccdd9ce8a9e56554c9e
-
Filesize
991KB
MD5eeb340cd0317612256596870fdad903f
SHA1c4cd2abe134b3d5e043593dd88c7d61d6d53e417
SHA256aecadb80ac6e9bfdf585933d5bf3741a130206df61324cccbf613a31101a3d54
SHA512a4c03aeada2f9f0b333db50bdf42612eef742b6f26eb39749aebe9d504f47aef4d3e098f49b04cfd10a2c2fb73a7bbb1b53bfd098e4e6ccdd9ce8a9e56554c9e
-
Filesize
991KB
MD5eeb340cd0317612256596870fdad903f
SHA1c4cd2abe134b3d5e043593dd88c7d61d6d53e417
SHA256aecadb80ac6e9bfdf585933d5bf3741a130206df61324cccbf613a31101a3d54
SHA512a4c03aeada2f9f0b333db50bdf42612eef742b6f26eb39749aebe9d504f47aef4d3e098f49b04cfd10a2c2fb73a7bbb1b53bfd098e4e6ccdd9ce8a9e56554c9e
-
Filesize
991KB
MD5eeb340cd0317612256596870fdad903f
SHA1c4cd2abe134b3d5e043593dd88c7d61d6d53e417
SHA256aecadb80ac6e9bfdf585933d5bf3741a130206df61324cccbf613a31101a3d54
SHA512a4c03aeada2f9f0b333db50bdf42612eef742b6f26eb39749aebe9d504f47aef4d3e098f49b04cfd10a2c2fb73a7bbb1b53bfd098e4e6ccdd9ce8a9e56554c9e
-
Filesize
991KB
MD5eeb340cd0317612256596870fdad903f
SHA1c4cd2abe134b3d5e043593dd88c7d61d6d53e417
SHA256aecadb80ac6e9bfdf585933d5bf3741a130206df61324cccbf613a31101a3d54
SHA512a4c03aeada2f9f0b333db50bdf42612eef742b6f26eb39749aebe9d504f47aef4d3e098f49b04cfd10a2c2fb73a7bbb1b53bfd098e4e6ccdd9ce8a9e56554c9e
-
Filesize
6.9MB
MD5593731ec5ad57f5556ba30fbfab0d715
SHA1f1134e4ee01c4a38888193130ea5255f6a782685
SHA2565a5c40820ef02808d9d3759d915d8f8ff52dc6a3fc2590584f4c36a9ad3c1de4
SHA5128d28fcbe6f9b044648c730a189dc860e6fd6330fed4c60feb973b8f296358b83a1977ebe57fcfb22837cffd7a649d0f2d963b77982436e38b344d613c2b3df1f
-
Filesize
6.9MB
MD5593731ec5ad57f5556ba30fbfab0d715
SHA1f1134e4ee01c4a38888193130ea5255f6a782685
SHA2565a5c40820ef02808d9d3759d915d8f8ff52dc6a3fc2590584f4c36a9ad3c1de4
SHA5128d28fcbe6f9b044648c730a189dc860e6fd6330fed4c60feb973b8f296358b83a1977ebe57fcfb22837cffd7a649d0f2d963b77982436e38b344d613c2b3df1f
-
Filesize
12KB
MD5b24c70f0951a902d62e97321ee12be9d
SHA1759555b579c811eaa2bc123edbf49fa6fdc0ab72
SHA256226b01c08d3cd2f0099c6138d97e4ec3096207e220d0203400c9dbeabdf1a446
SHA512b521e94e80d4d97ce6bbc76e954ed3cacfe06fbe9408e8228a442e71c1672218033ba10191083a8dec90e8f5eed475b59c8ad9112c4648099bd1c51778260ee0
-
Filesize
12KB
MD5c4e19798b19173eca54cc2f615a0b99e
SHA16638701c7b4991227e1f883414bcd1315b7b0864
SHA25601539234b53ddc8ac82665ea18daeadd1edd2b4b918b21fa72f3848b6639a301
SHA5124c976fc3282531d5ad32f5ec1f436378cf73f068c650c578e54b25cbe2911a4709bd14c46ebc74ef395afb771e8f8d9f28798b204d5f2a89589f8119ea7c8d20
-
Filesize
4.9MB
MD55a1d85fb3c9062304547475d6bd383ed
SHA1dc8722d155277e841ea9404beabb1c012c7eefc0
SHA256de9a6adbda9378230f1a4caff8c23d208a0d19114dcec00391869a83e129787f
SHA512681b4341548c34e2b7dce6731ef7cd35a2271ef482984e4f706b44c07962ee4673d5b2596020c2d2dd1f92867e7001ea84549ac517032f25b3e899313c758e3f
-
Filesize
12KB
MD5cba424ebfd76fbab92e4c611ebbc6bdf
SHA19678ae22d9585dd12d692522c30aebc5b92a2249
SHA2566951d18ba89c4875983cce91305f802f0f690675d76fd14fa0cb0f792b0aaea3
SHA51222967f3bdd097fa5ffa06945a69d5d39c26b9bd21892a19e9efa234b24349fed7d7e62187506c8d18475055041af15e9b3a877f56ac7eae29478253bc31cc8dc
-
Filesize
11KB
MD52e509dd5f4217be553fbe379a0a90c23
SHA19dd8f007d11ad0f4cf30cbc555bb3cf36d4c2a02
SHA256a1e376b66a11846fd448708b81a894d279032d0247bd5c0f79f606c945397162
SHA5126c11872669e593d77dbcefc4a5bd5257c49329bfa8a5260fcb743855d5e7dcfeaf48a69bbe16b81057b049957fca263c7efca630a257fc5813edb687467063cf
-
Filesize
12KB
MD5d140f9ae6ca875d2f8bcec576bb2c203
SHA1871cc1e85dde0d2b4bdab5566defbe8483348fcf
SHA25639fca6cb75735a2bc2abe2b35ca94cde8da856955de641c165c7e1e1f8b5b516
SHA5125815e0d2e5f9242f587d6d79679232c32a9279b25fde308763f210a4cf365430e76d259b714de0aed9904277b586380fbb04a057dd66ae143cca0eef1329362c
-
Filesize
13KB
MD5637686253a68504cc01fe055a25346f7
SHA159e36e5a2e71887acb4eac090e1cdb8d240379b1
SHA256f008522a75e279cdb23489e24b4835ce6516cf2a669df705c072b23f311b7a3a
SHA51216377b987a8ede42a379a39b641cf3a6c2dc11c454e9cc460808ab3dc8dab5c5782de26923ce524eaeaa5d389bfce5ba46561791424a65b08de2a69b71652fda
-
Filesize
13KB
MD5cae7b08264859d094eccbcd1686e4b58
SHA131e000b5f93a4af158e3211e9ef6ee24a43df6ed
SHA2561cdef54fcbaf02d46fb31cee5738e2e1f9d5bcd89b58f49ef98c011329266e69
SHA51231646eba2f4e4d312fafe191608c5fa963c4ed1753cc55340314c9c6142424b36d819f67bd9218ad41c2627c8289c5764a752ebc449d3e8e43aa5ab833631771
-
Filesize
12KB
MD549c62ebd53b8d40b961ab63d16d1b18c
SHA1b002185abcc6f84fb272445a3579cfe96972e19a
SHA2569f47adfacf4d1855d0de2b806149084cf6051de2b6de09692fbf17a93b149343
SHA5127895f99d82f95cb3f6c0f91a0c283472205f052c81e8321cd01ebae20d94813a9139262815a0d4258bd719e4cba63e5a2ae9457902f10244affaebed33e72d24
-
Filesize
15KB
MD54cc34523cefbe42b62cf1839c0f54663
SHA1fdaa0ad16c693906978f7e1364b1c850869354bf
SHA25694c1b8fc0bda3ba585e92b4ed812421bc6dea4da29b2321b1286d27615571b79
SHA512c0ffb819229709cc3bc340c859330da8c5c91763fb5ccccbaed073ed282150dbcefd329fbab440e88dafe30c39e8055be0009113a1400d9170a6701ba63b2824
-
Filesize
11KB
MD53285372c3ad0355bd7eec8488f40629d
SHA148288694c5a5724e8c56339d675666d8476741aa
SHA2562c402fd6e6aab9d8ffc93ca29f07fc55420a598ed1368ec2ad381cb4808195f2
SHA512ea6bd5c5274deb99c4c70f29f17e324649139b5b47cc054a52a2e3b3c4f0e4b1fd80cd105fd32d0b3ab29af115cc09ced4c7f8529bd651f7a6d265dd3d00acab
-
Filesize
13KB
MD592bfc521b92d8ac30cb6fdb31ee37fb2
SHA114f04856f4a3661007fabb846b83499ebc34cdf7
SHA256357ac44df2a8fa996a78061bc67531b8dd5d2770a3a4aa7ed1aad3c5c52e4050
SHA5124dfc21cdaa3c00e93008ad55061bbb02d31504cec26271cb040356a1e04408fa766b12425aea0e91adb230fe0d231466de4392f0b48c1477b9f083e795ab9b66
-
Filesize
12KB
MD50f20f0dbb696e41aeca13072308fcaf0
SHA1945719a73305822d94cb571e05327bc324d091de
SHA25641bdd7d91831f50f75ced32e200818427adc17c0071ef7c11913a767f54833fd
SHA512b3aebd905ae0740162c33f6fd90345933d23321da7c72e3d5e8661558135beb6eaefc6f968276237868efc02d70db4c36f820e15dc7f3befe1f891d4fc69b9ac
-
Filesize
21KB
MD5b4b289047fd327d99e5809234174736b
SHA1c9f2e45efa8ce22720f2dc49bc85764dee49025d
SHA256eb0f8c2bfd6f0d3744e16ddd7db56590e5c9a4f1960b4ea9c2240f691b2504e4
SHA512dccac50a017bb1482e7657f5b166f0316336d049ef446ecc26b1a3cd38ca7e90cbb713bdac3b59414f8e2800fd0b25d25d3ccd4641993213052329e272b96f9a
-
Filesize
68B
MD519bd1abdc3e765562c44b16eeb26f51d
SHA1469a5b82924fb428a996027862f3df978b108230
SHA256d9ddd32e495129dfe3fb9864635fc0f5d4153394572e316076258a4d3a5d18af
SHA512eeb3d7aa81ef6b0e21c3d0c4038c3929a325618359d302b7d49d75b0609b2e6a65626a66ea485747412b60cbb8dd7c5e0c3ef7147a7dc711bb8d2a534ba0829c
-
Filesize
12KB
MD53eb3ce7cb9d27f10c18ba319882cc7ed
SHA17e09a5a88f46570f0d95d19602f38379ae01742e
SHA256419ef75a40cc8d0ae3ae7767bc87f9c967b0068afa8bb03cd67b697c00f40cea
SHA5125ec29890eaf47e4ea91dc948811bd1f9dc7dac27b8b116a620b634baf8e33ee605a6e815da04df45478c1460f4cca371ae469f7e4093e12184e24a3a934ef059
-
Filesize
12KB
MD545b6b39f4009ef7a14dde07ceb42647a
SHA15372f2432e6a110ee2fff3b37e30a1443132f38f
SHA2561388b135d43d916af79f2630308b7a28e010fb5e32205c70e796130c0828c7fb
SHA51248936b2885b73c0c7841d237a78ad38b0c60f63cac5746e4da87342fbc3b234e7feb437e7456dcb5824c06d022e5351c237819231b3f0d013762c34a2c0844ec
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
60KB
MD5cd6435d6d42b7e772a0d1c851a0bd293
SHA1c86c3381333674e2789bc67061c59cc2ab9be4c8
SHA256db466e2f031de3a4d709483d2513026f68d2fbcc89f5ce79f6f168ea7b9038b2
SHA5126fadb9227eb819d21b06f631d705a0db08e672b42d07a4915485885bf9c6317f73423f25db131a5c315ea407dd5a7570c1998faccbf59800224a3783ad542561
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
460KB
MD51f0f2db6fc3aeb7acc96d038ae887c57
SHA10b3f6d636348817ef85697e96bb31068c5a06374
SHA2567aba740868f8aa0ce45984d86a394ba71d04185f8ed5417c7322e3adf669c36d
SHA5121f8313e78229e08b8506c9e3857b86e8b10b8bde34f2d71392c24bae4bb0bedad8b1dc4fad984c01aeb9358130505bb7a0f3a27d20eba9e42eb9ea7414cb11d6
-
Filesize
460KB
MD51f0f2db6fc3aeb7acc96d038ae887c57
SHA10b3f6d636348817ef85697e96bb31068c5a06374
SHA2567aba740868f8aa0ce45984d86a394ba71d04185f8ed5417c7322e3adf669c36d
SHA5121f8313e78229e08b8506c9e3857b86e8b10b8bde34f2d71392c24bae4bb0bedad8b1dc4fad984c01aeb9358130505bb7a0f3a27d20eba9e42eb9ea7414cb11d6
-
Filesize
460KB
MD51f0f2db6fc3aeb7acc96d038ae887c57
SHA10b3f6d636348817ef85697e96bb31068c5a06374
SHA2567aba740868f8aa0ce45984d86a394ba71d04185f8ed5417c7322e3adf669c36d
SHA5121f8313e78229e08b8506c9e3857b86e8b10b8bde34f2d71392c24bae4bb0bedad8b1dc4fad984c01aeb9358130505bb7a0f3a27d20eba9e42eb9ea7414cb11d6
-
Filesize
3.1MB
MD5d70a98daf7a810ee18ce451ec673e399
SHA1274dff37313f3fbdf82dfc4afd94582359b79fee
SHA2569621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340
SHA512a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60
-
Filesize
3.1MB
MD5d70a98daf7a810ee18ce451ec673e399
SHA1274dff37313f3fbdf82dfc4afd94582359b79fee
SHA2569621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340
SHA512a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60
-
Filesize
145KB
MD55f04cd0fe4e449073ac8b33d824c251e
SHA1c10ebd7b41c5850824619a5c99f63209762c5563
SHA2563bc2279f42ed7476fc37a497761a991b10d958866ec3e90d3cd81ef81889e755
SHA51226279c0f7f3fd36995fafac267764c85083d975ab9ac7c426fb3e371157d12171a8fd57914765e7368ef2e19b40bca409de94d0e4dc5632cb48e5236013f3318
-
Filesize
19KB
MD5bc7ff14dda8cb5df1fc5f5e1bfee7491
SHA1b081e57b1455374fb610eec26f6154a8870b8859
SHA256791623f421c6c6cacbaa1b04d339c23ea527471a970ac65b7a81940cb9d655ba
SHA512a062b227766217a3e55b8b13a12118667453e5047cd2b9cb29336a8a2ceb29791f01fdd0ccff844958b6150129d7a3d5bd40aab4f86607b4caf0170d439e21a2
-
Filesize
12KB
MD53cbabb025d9e9d616a4e65532f05cb1a
SHA155fc653506e73d0ef241309c7f5e3a6366568bc1
SHA256d1ac4fd46b0125f94be9bf22c6fb1a5382d65c4242da3cf227a383d8772cebf0
SHA512ec368bf659ab793709b803e6617768405819521d865205ef0c16bcde9626b9779891176c6bfa9752cce864e33fb315f33e929db9bda5ae63c6b1c17278b428f0
-
Filesize
2KB
MD5762bfbe904cebd07a8689395800ea5f9
SHA13c2e50fd742769fea3fb1857836d4c62c7a55556
SHA2561522b78f6da7f10a51351b4222b6e95b7b28a356a580df1fe6152102b2df34bd
SHA5123a7f5f04318bf18595a43e945e0e608f6d889f5f62fefc48c327fd5b6054cc0a00f6ceca0ef0b4ea3d3cc1c82e9ed42f6881252e443ab06ecce34c411e664f80
-
Filesize
154KB
MD5eeb1e391267d7b56dcc969befb7f08ca
SHA11cc03752dac8207966626315e1a6c02ed645b778
SHA256f836560b7c21ec541df9269326c366a2c27ea2107adaa157d9eac87bbd038dcd
SHA512f73b8524285f28a98bada86f8ec0540765c42ae87ea35ffa3f1ee14b33192eec8638d9574a9e3003207fd2133c1488704506826cd1c2624c35674cd5c5fabb56
-
Filesize
154KB
MD5af07dc3665415be410f23275aeb7ffa6
SHA1f1d7a83a8dbae4d302043ce10ddef62e876f39b5
SHA256bee831953bd84b63667d0405b273899a41b7d8cb4286ba1c31708440ada715f1
SHA512e569eda136d445f4ea414fbd8bf13bb47d5fa2b0614f5021cb3670629b414487f0348eda969621cc4a36e94a80b7b3188580da18a1d72e55b6948cf7ac3836fa
-
Filesize
154KB
MD5a872f8cd9db396e869b0a0a0fa9f310a
SHA133134de93b18e8fd2e6220e8bfefffbad8892260
SHA256e5da913c2d43132c2793915e4385ad85fa9f44681c33f177e23a166c12ee58b2
SHA512f03f16922932e9ce631d33e71fc2569911b84ace8a79e7ed13ca11c8c7646bde53c51951288b9961db1197d20da7eca32c58cfca53c21649c5aa5a2d109803c7
-
Filesize
19KB
MD5bc7ff14dda8cb5df1fc5f5e1bfee7491
SHA1b081e57b1455374fb610eec26f6154a8870b8859
SHA256791623f421c6c6cacbaa1b04d339c23ea527471a970ac65b7a81940cb9d655ba
SHA512a062b227766217a3e55b8b13a12118667453e5047cd2b9cb29336a8a2ceb29791f01fdd0ccff844958b6150129d7a3d5bd40aab4f86607b4caf0170d439e21a2
-
Filesize
145KB
MD55f04cd0fe4e449073ac8b33d824c251e
SHA1c10ebd7b41c5850824619a5c99f63209762c5563
SHA2563bc2279f42ed7476fc37a497761a991b10d958866ec3e90d3cd81ef81889e755
SHA51226279c0f7f3fd36995fafac267764c85083d975ab9ac7c426fb3e371157d12171a8fd57914765e7368ef2e19b40bca409de94d0e4dc5632cb48e5236013f3318
-
Filesize
19KB
MD5bc7ff14dda8cb5df1fc5f5e1bfee7491
SHA1b081e57b1455374fb610eec26f6154a8870b8859
SHA256791623f421c6c6cacbaa1b04d339c23ea527471a970ac65b7a81940cb9d655ba
SHA512a062b227766217a3e55b8b13a12118667453e5047cd2b9cb29336a8a2ceb29791f01fdd0ccff844958b6150129d7a3d5bd40aab4f86607b4caf0170d439e21a2
-
Filesize
145KB
MD5b646169a2739d7e93db93c8d3d8e9275
SHA14ce6d57c762728678875bf0c2882f35ca2a732cd
SHA2561186f4994c10be00c86b0bf484c5ff5c456c047ad567aff99349da3c6b8c284e
SHA5122e3f56196d5f5ea5f438dfbcb156b4ef50d908fbadcc939aa7f51d6c8445be884764cae195703f6fd00bf1b6386b87e91f9997dca58fccd6817f39688f97bde0
-
Filesize
12KB
MD53cbabb025d9e9d616a4e65532f05cb1a
SHA155fc653506e73d0ef241309c7f5e3a6366568bc1
SHA256d1ac4fd46b0125f94be9bf22c6fb1a5382d65c4242da3cf227a383d8772cebf0
SHA512ec368bf659ab793709b803e6617768405819521d865205ef0c16bcde9626b9779891176c6bfa9752cce864e33fb315f33e929db9bda5ae63c6b1c17278b428f0
-
Filesize
145KB
MD55f04cd0fe4e449073ac8b33d824c251e
SHA1c10ebd7b41c5850824619a5c99f63209762c5563
SHA2563bc2279f42ed7476fc37a497761a991b10d958866ec3e90d3cd81ef81889e755
SHA51226279c0f7f3fd36995fafac267764c85083d975ab9ac7c426fb3e371157d12171a8fd57914765e7368ef2e19b40bca409de94d0e4dc5632cb48e5236013f3318
-
Filesize
19KB
MD5bc7ff14dda8cb5df1fc5f5e1bfee7491
SHA1b081e57b1455374fb610eec26f6154a8870b8859
SHA256791623f421c6c6cacbaa1b04d339c23ea527471a970ac65b7a81940cb9d655ba
SHA512a062b227766217a3e55b8b13a12118667453e5047cd2b9cb29336a8a2ceb29791f01fdd0ccff844958b6150129d7a3d5bd40aab4f86607b4caf0170d439e21a2