Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
22-12-2022 19:31
General
-
Target
windows.10.codec.pack.v2.2.0.setup.exe
-
Size
45.5MB
-
MD5
908ea32c938f24669728a7c026a6552b
-
SHA1
2695b6cd468636b09c1495a86a69ce4f56203a0c
-
SHA256
435506cbe66bebdfdf9a2a94b1e8f483fdf108ab308129a6eb8dfd56a8bc77bc
-
SHA512
342281df3e8823dbca8231335c17d76fbc4d0ba35a97c2d777d11c9ca33b86e689ef54c86aebbbec50a6f499b7232c4d56406f0471cce666a74203bfe95e710e
-
SSDEEP
786432:Zbe52lsoZacQr5el64WTdDUCpGnSlyXMs8AdIqCmF3kdPEcOKbBhscBpw4yTie6d:ZbpHZac09DtpI7XMvmIqoPppw4yees
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
-
Registers COM server for autorun 1 TTPs 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks for any installed AV software in registry 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows.10.codec.pack.v2.2.0.setup.exe"C:\Users\Admin\AppData\Local\Temp\windows.10.codec.pack.v2.2.0.setup.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Foundation\ByteStreamHandlers\.avi" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Foundation\ByteStreamHandlers\.m4a" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Foundation\ByteStreamHandlers\.m4v" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Foundation\ByteStreamHandlers\.mp4" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Foundation\ByteStreamHandlers\.mp4v" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Microsoft\Windows Media Foundation\ByteStreamHandlers\.avi" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Microsoft\Windows Media Foundation\ByteStreamHandlers\.m4a" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Microsoft\Windows Media Foundation\ByteStreamHandlers\.m4v" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Microsoft\Windows Media Foundation\ByteStreamHandlers\.mp4" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exe"C:\Windows\system32\Codecs\SetACL.exe" "MACHINE\SOFTWARE\Microsoft\Windows Media Foundation\ByteStreamHandlers\.mp4v" /registry /grant S-1-5-32-544 /full /r:cont_obj /sid /silent2⤵
- Executes dropped EXE
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\ffdshow.ax2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\avi.x64.dll2⤵
- Registers COM server for autorun
- Modifies registry class
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\dxr.x64.dll2⤵
- Registers COM server for autorun
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\mkx.x64.dll2⤵
- Registers COM server for autorun
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\mp4.x64.dll2⤵
- Registers COM server for autorun
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\ogm.x64.dll2⤵
- Registers COM server for autorun
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\ts.x64.dll2⤵
- Registers COM server for autorun
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\splitter.x64.ax2⤵
- Registers COM server for autorun
- Modifies registry class
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\VSFilter.dll2⤵
- Registers COM server for autorun
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\cdxareader.ax2⤵
- Registers COM server for autorun
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\LAVSplitter.ax2⤵
- Registers COM server for autorun
- Modifies registry class
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\LAVVideo.ax2⤵
- Registers COM server for autorun
- Modifies registry class
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\LAVAudio.ax2⤵
- Registers COM server for autorun
- Modifies registry class
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\\Regasm.exe" "C:\Windows\SysWOW64\IcarosPropertyHandler.dll" /silent /codebase2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Regasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\Regasm.exe" "C:\Windows\system32\IcarosPropertyHandler.dll" /silent /codebase2⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\IcarosThumbnailProvider.dll2⤵
-
C:\Windows\SysWOW64\Codecs\TrayMenu.exeC:\Windows\SysWOW64\Codecs\TrayMenu.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-32-544;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\MediaSources\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectShow\Preferred -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\MediaSources\DoNotUse -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Foundation\ByteStreamHandlers\.avi" -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Foundation\ByteStreamHandlers\.avi" -ot reg -actn ace -ace n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y;p:full -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Foundation\ByteStreamHandlers\.avi" -ot reg -actn ace -ace n:S-1-5-32-544;s:y;p:read -silent2⤵
-
C:\Windows\SysWOW64\Codecs\SetACL.exeC:\Windows\system32\Codecs\SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Foundation\ByteStreamHandlers\.m4a" -ot reg -actn setowner -ownr n:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464;s:y -silent2⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
14KB
MD52a03c4a7ac5ee5e0e0a683949f70971b
SHA13bd9877caaea4804c0400420494ad1143179dcec
SHA256d4f0042d8e7622b7e14395e926dd02edab3cdc77e82d88108b67a4d2cee9229b
SHA5121942cdb522859f8dba46824786e361794a62e6201279201e1e0e2e07499fb6252933c5661782fccd77291c3650cafb2a7a08eee5431c8238f0da44840ee4c476
-
Filesize
11KB
MD56f5257c0b8c0ef4d440f4f4fce85fb1b
SHA1b6ac111dfb0d1fc75ad09c56bde7830232395785
SHA256b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
SHA512a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
-
Filesize
4KB
MD58ef0e4eb7c89cdd2b552de746f5e2a53
SHA1820f681e7cec409a02b194a487d1c8af1038acf0
SHA25641293b9f6588e0fbdc8fcf2a9bd8e2b244cd5ff038fc13033378da337219c9dc
SHA512a68533e8a19637d0d44219549b24baba0dc4824424842f125600fda3edcafc4bb6bb340d57a00815f262d82373b440d58d6e4e5b2ceb29bb3f6bc4cbde66c3c5
-
Filesize
4KB
MD58ef0e4eb7c89cdd2b552de746f5e2a53
SHA1820f681e7cec409a02b194a487d1c8af1038acf0
SHA25641293b9f6588e0fbdc8fcf2a9bd8e2b244cd5ff038fc13033378da337219c9dc
SHA512a68533e8a19637d0d44219549b24baba0dc4824424842f125600fda3edcafc4bb6bb340d57a00815f262d82373b440d58d6e4e5b2ceb29bb3f6bc4cbde66c3c5
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
6KB
MD5c129bc26a26be6f5816a03520bb37833
SHA118100042155f948301701744b131c516bf26ddb8
SHA256d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
SHA512dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
-
Filesize
30KB
MD51bc3c1608ac94cf3fb4575dc96610fe0
SHA102a953629b0e272d8a9bbf5dacbb03402853bc8a
SHA25664f426601f824c9ec361755cb157d5f80499b8bbf4a29455bfca1fb65f2aae5c
SHA51263881bcdf359f22de1a7582d943ec241ab2fe32fd68e202befd940c4e2ee86092797bc2de4514685d122235465fcc992cb0b5c1b9899869f9ca5840bcd8bec05
-
Filesize
30KB
MD51bc3c1608ac94cf3fb4575dc96610fe0
SHA102a953629b0e272d8a9bbf5dacbb03402853bc8a
SHA25664f426601f824c9ec361755cb157d5f80499b8bbf4a29455bfca1fb65f2aae5c
SHA51263881bcdf359f22de1a7582d943ec241ab2fe32fd68e202befd940c4e2ee86092797bc2de4514685d122235465fcc992cb0b5c1b9899869f9ca5840bcd8bec05
-
Filesize
30KB
MD51bc3c1608ac94cf3fb4575dc96610fe0
SHA102a953629b0e272d8a9bbf5dacbb03402853bc8a
SHA25664f426601f824c9ec361755cb157d5f80499b8bbf4a29455bfca1fb65f2aae5c
SHA51263881bcdf359f22de1a7582d943ec241ab2fe32fd68e202befd940c4e2ee86092797bc2de4514685d122235465fcc992cb0b5c1b9899869f9ca5840bcd8bec05
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
Filesize
556KB
MD51d2af4d7b2a745f0b28498d0db49eb8a
SHA1d353180a668d53185aec0012a832e80a04e6a2e7
SHA256139cdf232bf6b710079f65b52a2ba9d5f5f33b6799fbdf441677902e757e76b5
SHA51299428e594d212166a73007c6441c5aae1c5aace5487a1d06db7511adb1eb82b76e7be360804a5147a4df838839abb1de0944eb46bb30a90dbacc14d772312813
-
-
-
-
-
Filesize
100KB
-
-
Filesize
260KB
-
Filesize
504KB
-
Filesize
676KB
-
Filesize
12KB
-
Filesize
92KB
-
Filesize
12KB
-
Filesize
272KB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
432KB
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
676KB
-
Filesize
504KB
-
-
-
Filesize
8KB
-
-
-
-
-
-
-
-
-
Filesize
72KB
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Filesize
64KB
-
-
-
-
-
-
-
-
-
-
-
Filesize
100KB
-
-
-
-
-