Analysis
-
max time kernel
185s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 05:52
General
-
Target
8454227e6f55c92b8dd7d5d64fe135951323600303ab361306ac13d7aaaf6b01.exe
-
Size
205KB
-
MD5
45d6c8a8101d170246c9268938ec27ee
-
SHA1
caf32d712cb855a5d2febe7d4dc7de9500825c65
-
SHA256
8454227e6f55c92b8dd7d5d64fe135951323600303ab361306ac13d7aaaf6b01
-
SHA512
1362a2051c80443873d6e4a37ecde2c90abab0f96c02044eb183256d1ff0206d8b9c23f079c8416ecc437cb5f42fbebb01fda683cc5d98238cb1e996d6ee65e3
-
SSDEEP
3072:LqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:LqhMPssRARoiSoS3SsQLH5AK
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
-
Modifies system executable filetype association 2 TTPs 12 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 12 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 12 IoCs
-
UAC bypass 3 TTPs 6 IoCs
-
Disables RegEdit via registry modification 6 IoCs
-
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 64 IoCs
-
Sets file execution options in registry 2 TTPs 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 46 IoCs
-
Checks whether UAC is enabled 1 TTPs 6 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 28 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 12 IoCs
-
Modifies registry class 64 IoCs
-
Runs ping.exe 1 TTPs 18 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8454227e6f55c92b8dd7d5d64fe135951323600303ab361306ac13d7aaaf6b01.exe"C:\Users\Admin\AppData\Local\Temp\8454227e6f55c92b8dd7d5d64fe135951323600303ab361306ac13d7aaaf6b01.exe"1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8454227e6f55c92b8dd7d5d64fe135951323600303ab361306ac13d7aaaf6b01.exeC:\Users\Admin\AppData\Local\Temp\8454227e6f55c92b8dd7d5d64fe135951323600303ab361306ac13d7aaaf6b01.exe2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\izha.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\izha.exe" csrss6⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen5⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe5⤵
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 12105⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im kspoold.exe /im kspool.exe5⤵
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im tati.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im wscript.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im sys.exe5⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe3⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\namw.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\namw.exe" smss6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe7⤵
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe8⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~7⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen7⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im kspoold.exe /im kspool.exe7⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe7⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe7⤵
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 12107⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13407⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13407⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im tati.exe7⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im wscript.exe7⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im sys.exe7⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen5⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im kspoold.exe /im kspool.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im tati.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe5⤵
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 12105⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im wscript.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im sys.exe5⤵
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\dsnv.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\dsnv.exe" smss4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen5⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im kspoold.exe /im kspool.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im tati.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im wscript.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im sys.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe5⤵
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 12105⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe5⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~5⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen5⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im kspoold.exe /im kspool.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe5⤵
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 12105⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im tati.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im wscript.exe5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im sys.exe5⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen3⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe3⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im tati.exe3⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im kspoold.exe /im kspool.exe3⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im wscript.exe3⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe3⤵
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 12103⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13403⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13403⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe taskkill /f /im sys.exe3⤵
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\ndsv.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\ndsv.exe" 8454227e6f55c92b8dd7d5d64fe135951323600303ab361306ac13d7aaaf6b012⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Change Default File Association
1Hidden Files and Directories
2Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
1Hidden Files and Directories
2Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
76KB
MD567ac959e4e272777f8a9828721638b00
SHA1bfeafa7504d8b043926ae75abe50c93c7d4abc32
SHA25600de14b68b4af970830f4a4f3837f262225f9fd3819305f57d93c9bb7390372d
SHA5125c7746323ca6ecd2ef344d38b74b07b5c23df7ddf5f3cdc60c56f819e4c940e6989ee0a54943611ca91a18e581c3240f732f15d9cb7b85499b97d39b48f418f0
-
Filesize
76KB
MD567ac959e4e272777f8a9828721638b00
SHA1bfeafa7504d8b043926ae75abe50c93c7d4abc32
SHA25600de14b68b4af970830f4a4f3837f262225f9fd3819305f57d93c9bb7390372d
SHA5125c7746323ca6ecd2ef344d38b74b07b5c23df7ddf5f3cdc60c56f819e4c940e6989ee0a54943611ca91a18e581c3240f732f15d9cb7b85499b97d39b48f418f0
-
Filesize
76KB
MD5f1c37f83e4ecfbfc04fd4e83f05c14ad
SHA116fb76c063e9669d5e7211b279f0abf8c60d7bee
SHA256d24a976af7fdfa25bb7a79c56083506433a2dee234cdf4b1786db97486de035f
SHA512d477496ca4346450ef85c32820b3ff7f13100718e35ead83f8698e6c5244f107bafedf2d2339a211f4e1dc1cbce8768a8a0f6272a2435ddb0507bb73be3e4079
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
129KB
MD5e2c33f1d5b2c10d0fff92ec379577f06
SHA1db52e7c71eb6e99ad6fa38305a7c62337246cc9e
SHA2566fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01
SHA5126a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
205KB
MD5fefcdc099f3eb8354185cd49ec0170dc
SHA1d584f2a609381082bccb4faa0f53b89f15cdc3c8
SHA256e001bc071334ea2cf2239932a0a410cb2fe3907a2e094a0d14cf3da2103edc24
SHA5126cf9b6e8e202f77e505a6ee740b774a65dce411bd32d5ad04be9f11ea821de672f2d2ab22c1915e0c5e86ed7ecfe6be8b84c1b6f9471edade77b553ef4c3b47d
-
Filesize
76KB
MD567ac959e4e272777f8a9828721638b00
SHA1bfeafa7504d8b043926ae75abe50c93c7d4abc32
SHA25600de14b68b4af970830f4a4f3837f262225f9fd3819305f57d93c9bb7390372d
SHA5125c7746323ca6ecd2ef344d38b74b07b5c23df7ddf5f3cdc60c56f819e4c940e6989ee0a54943611ca91a18e581c3240f732f15d9cb7b85499b97d39b48f418f0
-
Filesize
76KB
MD5f1c37f83e4ecfbfc04fd4e83f05c14ad
SHA116fb76c063e9669d5e7211b279f0abf8c60d7bee
SHA256d24a976af7fdfa25bb7a79c56083506433a2dee234cdf4b1786db97486de035f
SHA512d477496ca4346450ef85c32820b3ff7f13100718e35ead83f8698e6c5244f107bafedf2d2339a211f4e1dc1cbce8768a8a0f6272a2435ddb0507bb73be3e4079
-
Filesize
76KB
MD54e4beb2d3b7e34c090e53a8537999587
SHA172f9883b07c4b5c2f1b93d126603fd9b2d6f7984
SHA256038e3b437cc6f7907d70f899452b51c63b0080035e1817339d271ce7bb1d62f6
SHA5126728c0cf006dbb27ce2f31c2518f76d1f7f7b1ad6135368cc65747dff8012682e4c7119d224d2e9a46d59a8818e42f0c316a90d71a0907c8f9158a6c25e350a4
-
Filesize
76KB
MD567ac959e4e272777f8a9828721638b00
SHA1bfeafa7504d8b043926ae75abe50c93c7d4abc32
SHA25600de14b68b4af970830f4a4f3837f262225f9fd3819305f57d93c9bb7390372d
SHA5125c7746323ca6ecd2ef344d38b74b07b5c23df7ddf5f3cdc60c56f819e4c940e6989ee0a54943611ca91a18e581c3240f732f15d9cb7b85499b97d39b48f418f0
-
Filesize
76KB
MD567ac959e4e272777f8a9828721638b00
SHA1bfeafa7504d8b043926ae75abe50c93c7d4abc32
SHA25600de14b68b4af970830f4a4f3837f262225f9fd3819305f57d93c9bb7390372d
SHA5125c7746323ca6ecd2ef344d38b74b07b5c23df7ddf5f3cdc60c56f819e4c940e6989ee0a54943611ca91a18e581c3240f732f15d9cb7b85499b97d39b48f418f0
-
Filesize
76KB
MD567ac959e4e272777f8a9828721638b00
SHA1bfeafa7504d8b043926ae75abe50c93c7d4abc32
SHA25600de14b68b4af970830f4a4f3837f262225f9fd3819305f57d93c9bb7390372d
SHA5125c7746323ca6ecd2ef344d38b74b07b5c23df7ddf5f3cdc60c56f819e4c940e6989ee0a54943611ca91a18e581c3240f732f15d9cb7b85499b97d39b48f418f0
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
-
-
Filesize
168KB
-
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
-
-
-
Filesize
168KB
-
-
-
-
-
Filesize
168KB
-
Filesize
168KB
-
-
-
-
-
-
Filesize
168KB
-
-
-
Filesize
168KB
-
Filesize
168KB
-
-
-
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
-
-
-
-
-
Filesize
168KB
-
Filesize
168KB
-
-
-
Filesize
168KB
-
-
Filesize
168KB
-
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
168KB
-
-
Filesize
168KB
-
Filesize
168KB
-
-
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
168KB
-
-
Filesize
168KB
-
-
Filesize
168KB
-
-
Filesize
168KB
-
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
168KB
-
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
-
-
-
-
-
-
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
-
-
-
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
-
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
-
-
-
-
-
Filesize
168KB
-
-
-
Filesize
168KB
-
-
Filesize
168KB
-
Filesize
168KB
-
-
-