Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2023, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
osu!install.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
osu!install.exe
Resource
win10v2004-20230221-en
General
-
Target
osu!install.exe
-
Size
4.3MB
-
MD5
321cf9cb89893c3f78f49c0e19718d08
-
SHA1
59228593ccbe311dba685af04eb961c87acff981
-
SHA256
f0b2a03e625517cab9f760e2b6b8ff56ad5aacd1249becb2872bc22fa8817426
-
SHA512
a25562da867ccb48df6ba42b91a93f8190d77dfb1ec18637afface0cd3dfd6427a2df7a2b7c64157079a619d173d8726b0ae3b8e65d08eb08bdf0d85a438ef44
-
SSDEEP
49152:kSicrIcF+DhSfDG6zsIGzUwES6pcAsf+hZtXvA+xrQRLYSDnwxRxpDOhB:kh9Dh56w4wES62R0xRxpDOhB
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation osu!.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation osu!install.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation osu!.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation osu!.exe -
Executes dropped EXE 4 IoCs
pid Process 4556 osu!.exe 4800 osu!.exe 4136 osu!.exe 2092 osu!.exe -
Loads dropped DLL 18 IoCs
pid Process 4800 osu!.exe 4800 osu!.exe 4800 osu!.exe 4800 osu!.exe 4800 osu!.exe 4800 osu!.exe 4800 osu!.exe 4800 osu!.exe 4800 osu!.exe 2092 osu!.exe 2092 osu!.exe 2092 osu!.exe 2092 osu!.exe 2092 osu!.exe 2092 osu!.exe 2092 osu!.exe 2092 osu!.exe 2092 osu!.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 4800 osu!.exe 4800 osu!.exe 4800 osu!.exe 2092 osu!.exe 2092 osu!.exe 2092 osu!.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{00FAC743-7521-4239-B954-2E94C3327055} svchost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{AE7A2E24-51D3-4112-8832-C49B72F85B44} svchost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{CE49925A-809C-477D-B2AC-5A9A1D06632C} svchost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{28CB0EF7-DB70-45EE-AFF2-CE09A40C364E} svchost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{2F94BC2E-1E4D-4DC8-B26A-3AA151DF7202} svchost.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd osu!install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 osu!install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e osu!install.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B osu!.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 osu!.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E osu!install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd osu!install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e osu!install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd osu!install.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4800 osu!.exe 2092 osu!.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 4336 osu!install.exe Token: SeDebugPrivilege 4556 osu!.exe Token: SeDebugPrivilege 4800 osu!.exe Token: SeDebugPrivilege 4136 osu!.exe Token: SeDebugPrivilege 2092 osu!.exe Token: SeDebugPrivilege 4532 taskmgr.exe Token: SeSystemProfilePrivilege 4532 taskmgr.exe Token: SeCreateGlobalPrivilege 4532 taskmgr.exe Token: 33 4532 taskmgr.exe Token: SeIncBasePriorityPrivilege 4532 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 4556 osu!.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
pid Process 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2220 OpenWith.exe 1956 OpenWith.exe 2692 OpenWith.exe 244 OpenWith.exe 1384 OpenWith.exe 5084 OpenWith.exe 3664 OpenWith.exe 3508 OpenWith.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4336 wrote to memory of 4556 4336 osu!install.exe 93 PID 4336 wrote to memory of 4556 4336 osu!install.exe 93 PID 4336 wrote to memory of 4556 4336 osu!install.exe 93 PID 4556 wrote to memory of 4800 4556 osu!.exe 101 PID 4556 wrote to memory of 4800 4556 osu!.exe 101 PID 4556 wrote to memory of 4800 4556 osu!.exe 101 PID 4800 wrote to memory of 4136 4800 osu!.exe 113 PID 4800 wrote to memory of 4136 4800 osu!.exe 113 PID 4800 wrote to memory of 4136 4800 osu!.exe 113 PID 4136 wrote to memory of 2092 4136 osu!.exe 115 PID 4136 wrote to memory of 2092 4136 osu!.exe 115 PID 4136 wrote to memory of 2092 4136 osu!.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\osu!install.exe"C:\Users\Admin\AppData\Local\Temp\osu!install.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\osu!\osu!.exe"C:\Users\Admin\AppData\Local\osu!\osu!.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\osu!\osu!.exe"C:\Users\Admin\AppData\Local\osu!\osu!.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\osu!\osu!.exe"C:\Users\Admin\AppData\Local\osu!\osu!.exe" -repair4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\osu!\osu!.exe"C:\Users\Admin\AppData\Local\osu!\osu!.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
-
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:2300
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:1136
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:2956
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2692
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:244
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:4248
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:5084
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4532
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:4980
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:4920
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:2668
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize765B
MD5cc1dfcf33cec09cf4b02162f29a2c9ea
SHA1a2d9977e00e49dac782209a10e16893a87c5f8a3
SHA25657831e2f282ae5cf0af7250482eb273f084d2f9eded56adbb5ccdb201b8df8e3
SHA512c241bde31bff14294e460769043108f526999891163dba0498b835f3fa63dc35034fc37b35ab8c43bb7b39816b1ca69fd5abd7469735d038da13f4bea1876a89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926
Filesize637B
MD5f6b81037865b527245d8e678b1409f8b
SHA1433045640fd295c2503b575c9ede7406d2e7f42a
SHA256da1579ac52643b907ce3e97b8c7b3d96dc44dd21fddbf4691223a8678d73d51c
SHA512fb57a69f086d563d59c45936a98df7629e134302d25bf47f9a0fe88d7e27618069ffa5121944a853324596da701ed688c062b023a04aabebffb0014de41327cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize1KB
MD5e2b38e80a0b051bf6a94370a1be65b43
SHA19b6203ec15376f74fe0e73bd81f1cd2c86341163
SHA256cc3abffacfa492e6de85519380a95050e139794ae09b05e45f3c116199e7375d
SHA512f5ac4fd53a4ee6bc7b934e632fc11899b0bf9cc791d307067969a2a1a342d80fc90f90caea5863fdeb3c562e7cf220e10e1c70c92cf9bf27cb6ab0bbccf53ab1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize484B
MD5b62d1818f97c21fe40dd0165c4e36c65
SHA12145363fc2c482a032c356c1eb280bc05962fe2c
SHA256716b455ddaa8d3a2b804161d82cfacf56e3879d98a61a4fcd2565618fd8a5dfc
SHA512ea3e7743999f29e66ef5c90e24d82be7b05f426d3b309c6866d44b2bc7bc8c1d79373f43503a108eeff974f488b59562d0df2865cd92a777ab2cdf7d481ad101
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926
Filesize488B
MD5605336e4bfff31c9315441c9ba91dce9
SHA13e9b94ae4ccebfa82aba1a0000ca6376bb7ddade
SHA2568a1a37b90f6355e354bde79e2d5bdc0383fe675e79630d380f272e00ffc6198a
SHA512eb87aeb82a4c4eefeb802eba63a6a118bfa3baca424105410dc618970ef481d9af3225586f1e62b0e765bb337acd449f5e2cdef19c204cc4072790391043c8bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize482B
MD580bf347da39513e34b431bbbfa3342c7
SHA1337554f7adb9df1eae09d149c99f901affc15745
SHA25654a7eca0e751b492be87ebc49088ca76413285c82ff576eb449cf0007dfd4257
SHA5125ac5d8fb31db22f15ad0745c71004e2bcb36f68d20ae8b47c7aae1c645ef21df6f8b3afb63e9613c7052ad4034729876e928afdc281c4ffbfa1aabefc0d4e8ed
-
Filesize
1KB
MD5d7851eb8e6db261d609ce656b3c44dc6
SHA162f1d2b78d143a336fe6779a17b6400f95dadb2a
SHA256079dc4c2a07c1e17851a6bfc41130e0771c6b8063a2f6dcc807f9b525e1ced72
SHA5121bb23aba0d00f7bfaee06b0e9fdd9d1d54a454d62308a88cd964728c568c7ec5a91a68817d4b5c93e3e3c5ad4232106af44eb1eee94679aa51396c1872af1037
-
Filesize
256B
MD52d5bdf782b41f2746f0a40d8f268800b
SHA160db8f6e98cb5e9d66f1bec5ab1b1ba069cdf925
SHA256974f24e5d4c167dfed059fd83ea8b0d39434dbe5087957bcb6f9cc16ce1df114
SHA512c0ceda2c2ff8e651560b19e78d3283890d5be34d34be2b651fa21a6a418aeb8b5b63bf16b31fd99b49898ccc0d9367b383b56d2743b9efae96ddbb5dcb23e80c
-
Filesize
325B
MD5eefe2e846b5ff898abe04d136517aeb2
SHA1a7af1893c60da7469d829a77b766adaf09ca7cae
SHA256d02d1be12e01b2522ce3309d15b6c9985297055b78353c422b5fb1407ab1871e
SHA5125e5da773a4f73d1e5e6efbcc1c88ea5b2f571e67b389634e89c44212862685978f7b28eda3dd734da9b351915fce4c5ca31ac11e64091db510b0fa64eb23ee1e
-
Filesize
583B
MD5370c49bae4cd9187c4b5962ee5508321
SHA1b0626db33ea9cffe996dc138921e3388e24f4669
SHA256ae31392404c36c988228ed8e13a1097eed4b462bb00a515625b959684450b739
SHA512f1e790fb71dc563991c29f7a76dd85c44e073f1c81423e6a78c4c7dde7d8adf4104b44a4bcdc1e58f5b852c39509d169868dcdc64f23604eb8504376c029ad4a
-
Filesize
90B
MD5e1f83b3b90f8eedff90f8139528bd8af
SHA1e63064726c9ed09795a32764270f8f3457b498eb
SHA256a08b28e76a38d950b680d00726b46b320e85447d6f89d062df837d57750f7df1
SHA512dbae8f340766ebab4f34136872a9ca3c0e8907698b7e66362c4d4289c53806a04e0c118ef184b7c583839d0ea411442dca021aa4146c59eb5b6b39e8bb81b98a
-
Filesize
415B
MD593bf0d98811aec09ba2f0c90253609c9
SHA10797368bd23bcaeb452178c10d3fe3da81cb4151
SHA25609878a3d393942adc45de732c1a5347dec1d87a4973467a590f12213984368cf
SHA512e3813a1e8df934a7c7e0d8c54beead3729650b6413020750ad942989ee798373a8914c131fa3a2424802975d4ba2b57cb92c32b2e708161ea5a201288f8388c4
-
Filesize
673B
MD52eeaea697b5f4ba5e7d7f35c29bf1e9e
SHA10c0a4f766757fc07a1774cefbd76621de8da4521
SHA25608233c204a56d055a84913d3b4c369c3452b5bdd5e932f0b19c3c45d0c956ed3
SHA512a9d3720cabe334e74876a183633ba31eeecd1ce5b4d6de52bbffcfd4b535e691312c292fda26dbd6fef299f21e7bdcdc9ce86d8e6526bf2f27adcae8affed3e1
-
Filesize
370B
MD5b28f1f9adc00c0998d8688105d20db38
SHA1a914f9108ec267176cc391a504f65db8d066a490
SHA25640e11ade7da8cf56654e186717d04925a799d4c12301b634e02896b5ed056fdd
SHA51282f754a1d1b4cee18c298d1a0b484c4b56d3a4760adeba331d9677232f0c1c94b19843fe3c45784b20e186d57c0789889fdb67b1329e726a8a723416372a277c
-
Filesize
1KB
MD5110008991fe5c332211d67961ab257b3
SHA1d75af975efdf2685dbfade2043250e55a4a4c07a
SHA2564f21a196e8dcebf4f328b1d956730a72a0df3ac96f681224ad45f810b79db130
SHA512eb300246250ea0efbbb0921a20047e27a60ed04fd9ae769bfed49bf4ad792cbbc599fa2a9cbe627a3233871033f364d5da4678785c7c68f32820d52385fce8a0
-
Filesize
3KB
MD565b762df64183db60ec00c6bcd714998
SHA12b4729f169cac823c32cb1eef0ed23eb7f54e16a
SHA2569c9a993d8f043773bfca78886992a10eb154607977f457edc9c57308ed4700e6
SHA5129d2adfd2c7d507524d8248594822b91baca6385d8e9696323443866dddfbb017e65e21aab0d308a946aeb51f2263b5612f94b9a4df5af14f7119dbb14927f5e5
-
Filesize
4KB
MD5ee7480e9e1f1d709314548e17240235c
SHA171166012d4f1c95465d966fcf8a0111c868b083c
SHA2567d405c79a02af067731a6e1677b0c89cdd41f14c2101f53e40058346d4f417db
SHA51205bf29d3c1dfa9e67660e19a9399b2b8a133163d5f7089bc1a7e912e5b6fec8594937c02be1168381ee7e9f8b575ab8a752d5d684c11659ced40b336ca4927e6
-
Filesize
325B
MD546496d4e2efb8c8293bdd43401ce4dc1
SHA18a2b0935d98f9ec00ad36e652970fa29dc244fc8
SHA256b275ce57ffe277cd210e0922d9646199966d5b316ca01f72d148454800737df4
SHA5126b43c63376b516f1f9030e98f45a8d4a6ad7b3fc8ab105e371ac66eeda431d16dab68480500fdc9581858ef7ee12e701f95eabd1b160c7d229ada560e044c371
-
Filesize
583B
MD59c709d7504bfc1ffc8863e054812193e
SHA170a7e7a086451b1bbbf3382424fcfe16e0497adb
SHA256b7df01be4b4a23a3bfb16796d9d9c02553d2570d10cfd58e3b9409a6d3d51ccf
SHA5129c09e3c3c04827f3a34fa1cbb6dea9a6e0230e2800b327828c2ef6d582e3b09a128079383e75d4dddd1d2487237bcb80edbe2dbeba17590b481fd25765ed9f76
-
Filesize
673B
MD52eeaea697b5f4ba5e7d7f35c29bf1e9e
SHA10c0a4f766757fc07a1774cefbd76621de8da4521
SHA25608233c204a56d055a84913d3b4c369c3452b5bdd5e932f0b19c3c45d0c956ed3
SHA512a9d3720cabe334e74876a183633ba31eeecd1ce5b4d6de52bbffcfd4b535e691312c292fda26dbd6fef299f21e7bdcdc9ce86d8e6526bf2f27adcae8affed3e1
-
Filesize
6KB
MD54eabc5402e1033fa1a10df05cee5037b
SHA15b9fa173df7f5c8044378fcc06ca772a3dd48c66
SHA256f60c27aa0190ee472538d27f876d38eeba6e535b71dc8fee5318b22928a183fb
SHA512604965405e025f6ead8d87109b0fc817cbd2ac46172966cd1ae12b1b201f952d1a3e4f06b5352a33d931ca361054b5d02994294fa902e839a55d9133b03ca270
-
Filesize
583B
MD59c709d7504bfc1ffc8863e054812193e
SHA170a7e7a086451b1bbbf3382424fcfe16e0497adb
SHA256b7df01be4b4a23a3bfb16796d9d9c02553d2570d10cfd58e3b9409a6d3d51ccf
SHA5129c09e3c3c04827f3a34fa1cbb6dea9a6e0230e2800b327828c2ef6d582e3b09a128079383e75d4dddd1d2487237bcb80edbe2dbeba17590b481fd25765ed9f76
-
Filesize
456KB
MD582d4ee89f4a39c764fa6297a95ebb10e
SHA187b1f581ad017bf62604d8071a23fde8b81550e1
SHA2561081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d
SHA512904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382
-
Filesize
456KB
MD582d4ee89f4a39c764fa6297a95ebb10e
SHA187b1f581ad017bf62604d8071a23fde8b81550e1
SHA2561081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d
SHA512904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382
-
Filesize
456KB
MD582d4ee89f4a39c764fa6297a95ebb10e
SHA187b1f581ad017bf62604d8071a23fde8b81550e1
SHA2561081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d
SHA512904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382
-
Filesize
456KB
MD582d4ee89f4a39c764fa6297a95ebb10e
SHA187b1f581ad017bf62604d8071a23fde8b81550e1
SHA2561081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d
SHA512904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382
-
Filesize
456KB
MD582d4ee89f4a39c764fa6297a95ebb10e
SHA187b1f581ad017bf62604d8071a23fde8b81550e1
SHA2561081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d
SHA512904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382
-
Filesize
456KB
MD582d4ee89f4a39c764fa6297a95ebb10e
SHA187b1f581ad017bf62604d8071a23fde8b81550e1
SHA2561081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d
SHA512904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382
-
Filesize
4.2MB
MD5b4d949571134fc3ec6c28f1af7a75e49
SHA107eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA256b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
SHA5127abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
-
Filesize
4.2MB
MD5b4d949571134fc3ec6c28f1af7a75e49
SHA107eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA256b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
SHA5127abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
-
Filesize
4.2MB
MD5b4d949571134fc3ec6c28f1af7a75e49
SHA107eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA256b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
SHA5127abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
-
Filesize
4.2MB
MD5b4d949571134fc3ec6c28f1af7a75e49
SHA107eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA256b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
SHA5127abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
-
Filesize
4.2MB
MD5b4d949571134fc3ec6c28f1af7a75e49
SHA107eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA256b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
SHA5127abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
-
Filesize
4.2MB
MD5b4d949571134fc3ec6c28f1af7a75e49
SHA107eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA256b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
SHA5127abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
-
Filesize
5.5MB
MD5284c1dc8a524e46fbe7a7cf846d3d9b1
SHA1cc58fdaf66e03e83976c0837132aa9100b71ae88
SHA256bc91c462026efafaea524ff909e8b676caf63def1770de7fae48e9c64dc1e91f
SHA512d1084b3d93e08b25599339cdb2bc869c870edcedeecae8d3b28e316343980cb1b1d88aeeea61ed3267368d74b329c0b8861a02603845e75593ac4f074cb27a66
-
Filesize
4.2MB
MD5b66478cc0f9ec50810489a039ced642b
SHA1992ede70f0fee5cb323b4b810cc960bf2531875e
SHA256e512fe71775f767285cfb3310d8f1ac042639ab3d1a02ca3675b82cfd3cbc702
SHA512ed07e71fd6bc2bd9f2ada8b8d6aa80662d6ffadce7d692f078e9ccd8ada2ba47b0e25967809f567fb93ffc96271037f010a0038bb78301812a75e30eee9b2645
-
Filesize
4.2MB
MD5b66478cc0f9ec50810489a039ced642b
SHA1992ede70f0fee5cb323b4b810cc960bf2531875e
SHA256e512fe71775f767285cfb3310d8f1ac042639ab3d1a02ca3675b82cfd3cbc702
SHA512ed07e71fd6bc2bd9f2ada8b8d6aa80662d6ffadce7d692f078e9ccd8ada2ba47b0e25967809f567fb93ffc96271037f010a0038bb78301812a75e30eee9b2645
-
Filesize
711KB
MD5c00b30289cc427caff97af5aa3d43e03
SHA18e70885a62b0fe510422c2367b1f6de489b67e6c
SHA256b155e2bfce3adbbc45d01ec991160ab4fab7e8d33a0ab835463da860d3693867
SHA5123a70161a5adaba0101f2d2ca1522b1e71d04079ad15cc87a030b00c14b45df9545d5cba55101e25d9bd101769edb87a8e4d893125780e86fa2551290ab720860
-
Filesize
711KB
MD5c00b30289cc427caff97af5aa3d43e03
SHA18e70885a62b0fe510422c2367b1f6de489b67e6c
SHA256b155e2bfce3adbbc45d01ec991160ab4fab7e8d33a0ab835463da860d3693867
SHA5123a70161a5adaba0101f2d2ca1522b1e71d04079ad15cc87a030b00c14b45df9545d5cba55101e25d9bd101769edb87a8e4d893125780e86fa2551290ab720860
-
Filesize
77KB
MD547c83b958951331ba409d6b80316250c
SHA1ce14566676a27a0899079781a41888a2f1303127
SHA256e51523f179a8ab8101eaa3e587c5e1dfe6c19636ecfa582896833f06d2e79064
SHA51258408238279126e2b478a2f7cda513e5b5908140cc615f271e2baea7a2fe59046f51040406adb86194cc168ff4bc9ea2ca92834b9d90116f9ceb2384a4325896
-
Filesize
77KB
MD547c83b958951331ba409d6b80316250c
SHA1ce14566676a27a0899079781a41888a2f1303127
SHA256e51523f179a8ab8101eaa3e587c5e1dfe6c19636ecfa582896833f06d2e79064
SHA51258408238279126e2b478a2f7cda513e5b5908140cc615f271e2baea7a2fe59046f51040406adb86194cc168ff4bc9ea2ca92834b9d90116f9ceb2384a4325896
-
Filesize
125KB
MD57623474a8b9bec1e3ffca813cdf93bc3
SHA14a1c0ecf8cbed18d0472136a7096ee8c3c2fa774
SHA25667766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3
SHA512b7e7205e48eade918d63b483fb500867cc8196496fe9136f0177481d654a67af8319b6823fb04787e4bd6ee46c031c2b6fea57f0bf12b8a58cf8e0003834bd7b
-
Filesize
125KB
MD57623474a8b9bec1e3ffca813cdf93bc3
SHA14a1c0ecf8cbed18d0472136a7096ee8c3c2fa774
SHA25667766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3
SHA512b7e7205e48eade918d63b483fb500867cc8196496fe9136f0177481d654a67af8319b6823fb04787e4bd6ee46c031c2b6fea57f0bf12b8a58cf8e0003834bd7b
-
Filesize
125KB
MD57623474a8b9bec1e3ffca813cdf93bc3
SHA14a1c0ecf8cbed18d0472136a7096ee8c3c2fa774
SHA25667766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3
SHA512b7e7205e48eade918d63b483fb500867cc8196496fe9136f0177481d654a67af8319b6823fb04787e4bd6ee46c031c2b6fea57f0bf12b8a58cf8e0003834bd7b
-
Filesize
125KB
MD57623474a8b9bec1e3ffca813cdf93bc3
SHA14a1c0ecf8cbed18d0472136a7096ee8c3c2fa774
SHA25667766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3
SHA512b7e7205e48eade918d63b483fb500867cc8196496fe9136f0177481d654a67af8319b6823fb04787e4bd6ee46c031c2b6fea57f0bf12b8a58cf8e0003834bd7b
-
Filesize
50KB
MD53ad3c0fd4dca001a2f9e707b74544919
SHA1c6176415ecd3e8f38f976e4234325452fe1fd2a0
SHA25681111a1cb6f8f362cf232e21098c563fe1409160300f2a254f2a1762e5d4db04
SHA512436dac92e4a60dfc02c8c7a7ae496df7199c3fd15ef668bff2565f428f25be9c3ae1d0e120d64767eda1a9d4afa2e8bfeb6d047745440c3fce854080c44f42c5
-
Filesize
50KB
MD53ad3c0fd4dca001a2f9e707b74544919
SHA1c6176415ecd3e8f38f976e4234325452fe1fd2a0
SHA25681111a1cb6f8f362cf232e21098c563fe1409160300f2a254f2a1762e5d4db04
SHA512436dac92e4a60dfc02c8c7a7ae496df7199c3fd15ef668bff2565f428f25be9c3ae1d0e120d64767eda1a9d4afa2e8bfeb6d047745440c3fce854080c44f42c5
-
Filesize
50KB
MD53ad3c0fd4dca001a2f9e707b74544919
SHA1c6176415ecd3e8f38f976e4234325452fe1fd2a0
SHA25681111a1cb6f8f362cf232e21098c563fe1409160300f2a254f2a1762e5d4db04
SHA512436dac92e4a60dfc02c8c7a7ae496df7199c3fd15ef668bff2565f428f25be9c3ae1d0e120d64767eda1a9d4afa2e8bfeb6d047745440c3fce854080c44f42c5
-
Filesize
50KB
MD53ad3c0fd4dca001a2f9e707b74544919
SHA1c6176415ecd3e8f38f976e4234325452fe1fd2a0
SHA25681111a1cb6f8f362cf232e21098c563fe1409160300f2a254f2a1762e5d4db04
SHA512436dac92e4a60dfc02c8c7a7ae496df7199c3fd15ef668bff2565f428f25be9c3ae1d0e120d64767eda1a9d4afa2e8bfeb6d047745440c3fce854080c44f42c5
-
Filesize
3.3MB
MD5c5b362bce86bb0ad3149c4540201331d
SHA191bc4989345a4e26f06c0c781a21a27d4ee9bacd
SHA256efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
SHA51282fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
-
Filesize
3.3MB
MD5c5b362bce86bb0ad3149c4540201331d
SHA191bc4989345a4e26f06c0c781a21a27d4ee9bacd
SHA256efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
SHA51282fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
-
Filesize
146KB
MD59f7f22cef980ec272a9b73bf317500e4
SHA1ae11d7cdfa84a242e31efd6f03b0ef764d5f900c
SHA256041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072
SHA51219e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc
-
Filesize
146KB
MD59f7f22cef980ec272a9b73bf317500e4
SHA1ae11d7cdfa84a242e31efd6f03b0ef764d5f900c
SHA256041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072
SHA51219e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc
-
Filesize
146KB
MD59f7f22cef980ec272a9b73bf317500e4
SHA1ae11d7cdfa84a242e31efd6f03b0ef764d5f900c
SHA256041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072
SHA51219e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc
-
Filesize
146KB
MD59f7f22cef980ec272a9b73bf317500e4
SHA1ae11d7cdfa84a242e31efd6f03b0ef764d5f900c
SHA256041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072
SHA51219e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc
-
Filesize
3.2MB
MD5a4dfddff62d1e917ebb0688cf8d96be7
SHA19376bfa069a72da76733cc72cf90386920815142
SHA256cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f
SHA51297de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3
-
Filesize
3.2MB
MD5a4dfddff62d1e917ebb0688cf8d96be7
SHA19376bfa069a72da76733cc72cf90386920815142
SHA256cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f
SHA51297de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3
-
Filesize
3.2MB
MD5a4dfddff62d1e917ebb0688cf8d96be7
SHA19376bfa069a72da76733cc72cf90386920815142
SHA256cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f
SHA51297de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3
-
Filesize
3.2MB
MD5a4dfddff62d1e917ebb0688cf8d96be7
SHA19376bfa069a72da76733cc72cf90386920815142
SHA256cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f
SHA51297de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3
-
Filesize
4KB
MD56de6ecd5a058d57bb77974b89aadf8da
SHA1a2d9fe6ec97652739a4976e29d1d72b03cef9634
SHA256643cb0536f169a082f21ccb199d125cdc32bc92b3a225eb3fda3f65fce1c7ef0
SHA51201cc63242227b07452bbf71e2af77c912c472ef1cf5ab188d79f2bb9f85b6e91894175bddf5b1af7e700af5d23e5df4ce839a955194f2463596dcc1edc8f8e61
-
Filesize
878B
MD545c2857fad245dbb739284678d754377
SHA1d1dddd9b02fff6a2af3f9f437517cfd603228a14
SHA256d6dcc8b899948a99dae322cc6af6eb6d0e17ba66c2b03c75a8ff58f937df2226
SHA5124042e26c77d830d9ffa35337fc88855d8bd343b258abda769106db77463087aaa0c8f42f82133b6443e2987a29eb0374190800ef2a730507cd1fbe6e078394d3
-
Filesize
856B
MD53dc331887fe167cede3b4148e8e69fe4
SHA17d3b8a6b89527fe04d92c146ce63da95430b7795
SHA2563135552d1a8ecbcd9cf5c35ad62890231311bf3f05e3e2d22fb462e7ff4726d6
SHA51262f73e82abd38a825468c88e752f917e5a8c91a5cf9452a2878263c2353119824fac85f25388d3737789ab64b32ced9074426a363f90b1523b8bf10f33a24cd8
-
Filesize
856B
MD53dc331887fe167cede3b4148e8e69fe4
SHA17d3b8a6b89527fe04d92c146ce63da95430b7795
SHA2563135552d1a8ecbcd9cf5c35ad62890231311bf3f05e3e2d22fb462e7ff4726d6
SHA51262f73e82abd38a825468c88e752f917e5a8c91a5cf9452a2878263c2353119824fac85f25388d3737789ab64b32ced9074426a363f90b1523b8bf10f33a24cd8
-
Filesize
4.3MB
MD5321cf9cb89893c3f78f49c0e19718d08
SHA159228593ccbe311dba685af04eb961c87acff981
SHA256f0b2a03e625517cab9f760e2b6b8ff56ad5aacd1249becb2872bc22fa8817426
SHA512a25562da867ccb48df6ba42b91a93f8190d77dfb1ec18637afface0cd3dfd6427a2df7a2b7c64157079a619d173d8726b0ae3b8e65d08eb08bdf0d85a438ef44
-
Filesize
4.3MB
MD5321cf9cb89893c3f78f49c0e19718d08
SHA159228593ccbe311dba685af04eb961c87acff981
SHA256f0b2a03e625517cab9f760e2b6b8ff56ad5aacd1249becb2872bc22fa8817426
SHA512a25562da867ccb48df6ba42b91a93f8190d77dfb1ec18637afface0cd3dfd6427a2df7a2b7c64157079a619d173d8726b0ae3b8e65d08eb08bdf0d85a438ef44
-
Filesize
4.3MB
MD5321cf9cb89893c3f78f49c0e19718d08
SHA159228593ccbe311dba685af04eb961c87acff981
SHA256f0b2a03e625517cab9f760e2b6b8ff56ad5aacd1249becb2872bc22fa8817426
SHA512a25562da867ccb48df6ba42b91a93f8190d77dfb1ec18637afface0cd3dfd6427a2df7a2b7c64157079a619d173d8726b0ae3b8e65d08eb08bdf0d85a438ef44
-
Filesize
4.3MB
MD5321cf9cb89893c3f78f49c0e19718d08
SHA159228593ccbe311dba685af04eb961c87acff981
SHA256f0b2a03e625517cab9f760e2b6b8ff56ad5aacd1249becb2872bc22fa8817426
SHA512a25562da867ccb48df6ba42b91a93f8190d77dfb1ec18637afface0cd3dfd6427a2df7a2b7c64157079a619d173d8726b0ae3b8e65d08eb08bdf0d85a438ef44
-
Filesize
4.3MB
MD5321cf9cb89893c3f78f49c0e19718d08
SHA159228593ccbe311dba685af04eb961c87acff981
SHA256f0b2a03e625517cab9f760e2b6b8ff56ad5aacd1249becb2872bc22fa8817426
SHA512a25562da867ccb48df6ba42b91a93f8190d77dfb1ec18637afface0cd3dfd6427a2df7a2b7c64157079a619d173d8726b0ae3b8e65d08eb08bdf0d85a438ef44
-
Filesize
4.3MB
MD5321cf9cb89893c3f78f49c0e19718d08
SHA159228593ccbe311dba685af04eb961c87acff981
SHA256f0b2a03e625517cab9f760e2b6b8ff56ad5aacd1249becb2872bc22fa8817426
SHA512a25562da867ccb48df6ba42b91a93f8190d77dfb1ec18637afface0cd3dfd6427a2df7a2b7c64157079a619d173d8726b0ae3b8e65d08eb08bdf0d85a438ef44
-
Filesize
5.5MB
MD5284c1dc8a524e46fbe7a7cf846d3d9b1
SHA1cc58fdaf66e03e83976c0837132aa9100b71ae88
SHA256bc91c462026efafaea524ff909e8b676caf63def1770de7fae48e9c64dc1e91f
SHA512d1084b3d93e08b25599339cdb2bc869c870edcedeecae8d3b28e316343980cb1b1d88aeeea61ed3267368d74b329c0b8861a02603845e75593ac4f074cb27a66
-
Filesize
5.5MB
MD5284c1dc8a524e46fbe7a7cf846d3d9b1
SHA1cc58fdaf66e03e83976c0837132aa9100b71ae88
SHA256bc91c462026efafaea524ff909e8b676caf63def1770de7fae48e9c64dc1e91f
SHA512d1084b3d93e08b25599339cdb2bc869c870edcedeecae8d3b28e316343980cb1b1d88aeeea61ed3267368d74b329c0b8861a02603845e75593ac4f074cb27a66
-
Filesize
5.5MB
MD5284c1dc8a524e46fbe7a7cf846d3d9b1
SHA1cc58fdaf66e03e83976c0837132aa9100b71ae88
SHA256bc91c462026efafaea524ff909e8b676caf63def1770de7fae48e9c64dc1e91f
SHA512d1084b3d93e08b25599339cdb2bc869c870edcedeecae8d3b28e316343980cb1b1d88aeeea61ed3267368d74b329c0b8861a02603845e75593ac4f074cb27a66
-
Filesize
30.4MB
MD54cb98d63f1b2b9dc38e10e9901ec52d8
SHA142c0e8b8e5c7a4113e38a977221f845ef8406722
SHA256ba3467a8db908d81a0729f78fdc5c8f1d1595d3da4e5a9a34be9a16e06da9f87
SHA512d351b9ff851490187b003c675047b6a20a2519df3818bcd18a674d6edab1d211c9661acc98403b562ff3268576ea203b4e0f10e962467b9849b72431c92735a4
-
Filesize
30.4MB
MD54cb98d63f1b2b9dc38e10e9901ec52d8
SHA142c0e8b8e5c7a4113e38a977221f845ef8406722
SHA256ba3467a8db908d81a0729f78fdc5c8f1d1595d3da4e5a9a34be9a16e06da9f87
SHA512d351b9ff851490187b003c675047b6a20a2519df3818bcd18a674d6edab1d211c9661acc98403b562ff3268576ea203b4e0f10e962467b9849b72431c92735a4
-
Filesize
3.7MB
MD5524344f96189d2cc72123312351c6a79
SHA10629eb1003562fe3b59631d74d6c8c77ffa4b25f
SHA256b128940413b25180e0ac22a75bc09b2912a24b93fd4880f10b18d4020b8fc112
SHA512d13bb6ed8247093cd6d7b55cd19fa17ee75bde20a0a2011de04c649da064ccf947ccd0487320ca87f1437717da1711e2a3f33a7158759e620244d7818df3a188
-
Filesize
3.7MB
MD5524344f96189d2cc72123312351c6a79
SHA10629eb1003562fe3b59631d74d6c8c77ffa4b25f
SHA256b128940413b25180e0ac22a75bc09b2912a24b93fd4880f10b18d4020b8fc112
SHA512d13bb6ed8247093cd6d7b55cd19fa17ee75bde20a0a2011de04c649da064ccf947ccd0487320ca87f1437717da1711e2a3f33a7158759e620244d7818df3a188
-
Filesize
24.6MB
MD5450935f9812f0336e7968ec110548de6
SHA152a238343d521106c29b11b71b6546fdbc21ab90
SHA2567c5b5834977a3d6cf853c3db28492399721004e36e8ecc09c0f475d759e4c557
SHA5120f21b22fdba847b8b696fd40f34c26c89fa22e52d0abd342b67530609441fb7ec3ea12ad8badfca410c1f924ee9cfe401bc69ca645bf78371c48803f1d830b72
-
Filesize
24.6MB
MD5450935f9812f0336e7968ec110548de6
SHA152a238343d521106c29b11b71b6546fdbc21ab90
SHA2567c5b5834977a3d6cf853c3db28492399721004e36e8ecc09c0f475d759e4c557
SHA5120f21b22fdba847b8b696fd40f34c26c89fa22e52d0abd342b67530609441fb7ec3ea12ad8badfca410c1f924ee9cfe401bc69ca645bf78371c48803f1d830b72
-
Filesize
75KB
MD500678eb6be3b52d562b66218c93e21a8
SHA1ba583d1520da22f3d3b89196c981279ecda58648
SHA256b18c8437663002e4a4f06c4c1b7bec71fe13e5e6bbb927c68a273de02a5c690f
SHA51258d9ffa0f569ba7b1aaea62b49f5bfa18bf23c54d2487eb9e4da984469236c2d4baabeeeac7e4b71d66b8c30f7fff4890fee5ee25e00369fc4afce053cbeb048
-
Filesize
75KB
MD500678eb6be3b52d562b66218c93e21a8
SHA1ba583d1520da22f3d3b89196c981279ecda58648
SHA256b18c8437663002e4a4f06c4c1b7bec71fe13e5e6bbb927c68a273de02a5c690f
SHA51258d9ffa0f569ba7b1aaea62b49f5bfa18bf23c54d2487eb9e4da984469236c2d4baabeeeac7e4b71d66b8c30f7fff4890fee5ee25e00369fc4afce053cbeb048
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c