Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29/03/2023, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
PO_23509-23510.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PO_23509-23510.xls
Resource
win10v2004-20230220-en
General
-
Target
PO_23509-23510.xls
-
Size
1.0MB
-
MD5
3ff60872925b136a4a02f9646b605df3
-
SHA1
9d2eec41446241b5dd654fad00062b92b0e8f340
-
SHA256
64832b9f03d64470940e7481e9adfb6fa728d8a822cc7c649f8e32eafa18125b
-
SHA512
9d6890cf25cdd1a67edffff1c4ee6605160e24aa8a3fb76a0add988f7fc2b8caa61b2062e333310eef0e1fc358af734974b1badd5072171dd4074048579c1388
-
SSDEEP
24576:jLKnSSMMednEoakAmmjmRakAmmjmu+MXUkfOt2222222222222222222222K27P:jLKRMLaaoeaao9+MXiB
Malware Config
Extracted
remcos
SixthClients
top.not2beabused01.xyz:1558
sub.not2beabused02.xyz:1558
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
appsync.exe
-
copy_folder
Appsync
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Appsync
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Appsync-TYGH55
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Appsync
-
take_screenshot_option
true
-
take_screenshot_time
55
-
take_screenshot_title
mail;webmail;crypto;btc;ethereum;bitcoin;eth;outlook;foxmail;bank;email;compose;
Extracted
warzonerat
top.not2beabused01.xyz:1668
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dfsghjs\\iurdsfhgj.exe," reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dfsghjs\\uytedew.exe," reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dfsghjs\\uytresdfgh.exe," reg.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/780-129-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/780-134-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/780-209-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/832-130-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/832-133-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/832-141-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
resource yara_rule behavioral1/memory/832-130-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/780-129-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/844-128-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/844-131-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/832-133-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/780-134-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/832-141-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/780-209-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft -
Warzone RAT payload 3 IoCs
resource yara_rule behavioral1/memory/848-176-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/848-180-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/848-183-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1920 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
pid Process 1592 vbc.exe 1948 tqchnnl.exe 700 tqchnnl.exe 832 tqchnnl.exe 780 tqchnnl.exe 844 tqchnnl.exe 112 fmwrz.exe 1364 ghibzkdm.exe 1508 datrem.exe 848 ghibzkdm.exe 1116 datorg.exe 1524 datxld.exe -
Loads dropped DLL 20 IoCs
pid Process 1920 EQNEDT32.EXE 1592 vbc.exe 1592 vbc.exe 1948 tqchnnl.exe 700 tqchnnl.exe 700 tqchnnl.exe 700 tqchnnl.exe 700 tqchnnl.exe 700 tqchnnl.exe 112 fmwrz.exe 112 fmwrz.exe 1364 ghibzkdm.exe 700 tqchnnl.exe 700 tqchnnl.exe 848 ghibzkdm.exe 848 ghibzkdm.exe 848 ghibzkdm.exe 848 ghibzkdm.exe 848 ghibzkdm.exe 848 ghibzkdm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts tqchnnl.exe -
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\maoie = "C:\\Users\\Admin\\AppData\\Roaming\\dnetoln\\qiyvhavtewgo.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ghibzkdm.exe\" C:\\Users\\Admin\\AppData\\Lo" ghibzkdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\odsnqyon = "C:\\Users\\Admin\\AppData\\Roaming\\ukyerc\\irsqhssjjf.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\tqchnnl.exe\" C:\\Users\\Admin\\AppData\\Local\\" tqchnnl.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1948 set thread context of 700 1948 tqchnnl.exe 33 PID 700 set thread context of 832 700 tqchnnl.exe 35 PID 700 set thread context of 780 700 tqchnnl.exe 36 PID 700 set thread context of 844 700 tqchnnl.exe 37 PID 1364 set thread context of 848 1364 ghibzkdm.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 1920 EQNEDT32.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE -
Runs ping.exe 1 TTPs 9 IoCs
pid Process 2304 PING.EXE 2716 PING.EXE 2752 PING.EXE 2832 PING.EXE 1112 PING.EXE 1780 PING.EXE 2232 PING.EXE 960 PING.EXE 2172 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1296 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 832 tqchnnl.exe 832 tqchnnl.exe 1508 datrem.exe 1116 datorg.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1116 datorg.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe 1508 datrem.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1948 tqchnnl.exe 700 tqchnnl.exe 700 tqchnnl.exe 700 tqchnnl.exe 1364 ghibzkdm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 844 tqchnnl.exe Token: SeDebugPrivilege 1508 datrem.exe Token: SeDebugPrivilege 1116 datorg.exe Token: SeDebugPrivilege 1524 datxld.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1296 EXCEL.EXE 1296 EXCEL.EXE 1296 EXCEL.EXE 700 tqchnnl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1592 1920 EQNEDT32.EXE 31 PID 1920 wrote to memory of 1592 1920 EQNEDT32.EXE 31 PID 1920 wrote to memory of 1592 1920 EQNEDT32.EXE 31 PID 1920 wrote to memory of 1592 1920 EQNEDT32.EXE 31 PID 1592 wrote to memory of 1948 1592 vbc.exe 32 PID 1592 wrote to memory of 1948 1592 vbc.exe 32 PID 1592 wrote to memory of 1948 1592 vbc.exe 32 PID 1592 wrote to memory of 1948 1592 vbc.exe 32 PID 1948 wrote to memory of 700 1948 tqchnnl.exe 33 PID 1948 wrote to memory of 700 1948 tqchnnl.exe 33 PID 1948 wrote to memory of 700 1948 tqchnnl.exe 33 PID 1948 wrote to memory of 700 1948 tqchnnl.exe 33 PID 1948 wrote to memory of 700 1948 tqchnnl.exe 33 PID 700 wrote to memory of 832 700 tqchnnl.exe 35 PID 700 wrote to memory of 832 700 tqchnnl.exe 35 PID 700 wrote to memory of 832 700 tqchnnl.exe 35 PID 700 wrote to memory of 832 700 tqchnnl.exe 35 PID 700 wrote to memory of 780 700 tqchnnl.exe 36 PID 700 wrote to memory of 780 700 tqchnnl.exe 36 PID 700 wrote to memory of 780 700 tqchnnl.exe 36 PID 700 wrote to memory of 780 700 tqchnnl.exe 36 PID 700 wrote to memory of 844 700 tqchnnl.exe 37 PID 700 wrote to memory of 844 700 tqchnnl.exe 37 PID 700 wrote to memory of 844 700 tqchnnl.exe 37 PID 700 wrote to memory of 844 700 tqchnnl.exe 37 PID 700 wrote to memory of 112 700 tqchnnl.exe 38 PID 700 wrote to memory of 112 700 tqchnnl.exe 38 PID 700 wrote to memory of 112 700 tqchnnl.exe 38 PID 700 wrote to memory of 112 700 tqchnnl.exe 38 PID 112 wrote to memory of 1364 112 fmwrz.exe 40 PID 112 wrote to memory of 1364 112 fmwrz.exe 40 PID 112 wrote to memory of 1364 112 fmwrz.exe 40 PID 112 wrote to memory of 1364 112 fmwrz.exe 40 PID 700 wrote to memory of 1508 700 tqchnnl.exe 39 PID 700 wrote to memory of 1508 700 tqchnnl.exe 39 PID 700 wrote to memory of 1508 700 tqchnnl.exe 39 PID 700 wrote to memory of 1508 700 tqchnnl.exe 39 PID 1364 wrote to memory of 848 1364 ghibzkdm.exe 41 PID 1364 wrote to memory of 848 1364 ghibzkdm.exe 41 PID 1364 wrote to memory of 848 1364 ghibzkdm.exe 41 PID 1364 wrote to memory of 848 1364 ghibzkdm.exe 41 PID 1364 wrote to memory of 848 1364 ghibzkdm.exe 41 PID 700 wrote to memory of 1116 700 tqchnnl.exe 43 PID 700 wrote to memory of 1116 700 tqchnnl.exe 43 PID 700 wrote to memory of 1116 700 tqchnnl.exe 43 PID 700 wrote to memory of 1116 700 tqchnnl.exe 43 PID 700 wrote to memory of 1524 700 tqchnnl.exe 44 PID 700 wrote to memory of 1524 700 tqchnnl.exe 44 PID 700 wrote to memory of 1524 700 tqchnnl.exe 44 PID 700 wrote to memory of 1524 700 tqchnnl.exe 44 PID 1524 wrote to memory of 1832 1524 datxld.exe 46 PID 1524 wrote to memory of 1832 1524 datxld.exe 46 PID 1524 wrote to memory of 1832 1524 datxld.exe 46 PID 1524 wrote to memory of 1832 1524 datxld.exe 46 PID 1832 wrote to memory of 1112 1832 cmd.exe 47 PID 1832 wrote to memory of 1112 1832 cmd.exe 47 PID 1832 wrote to memory of 1112 1832 cmd.exe 47 PID 1832 wrote to memory of 1112 1832 cmd.exe 47 PID 1116 wrote to memory of 1100 1116 datorg.exe 48 PID 1116 wrote to memory of 1100 1116 datorg.exe 48 PID 1116 wrote to memory of 1100 1116 datorg.exe 48 PID 1116 wrote to memory of 1100 1116 datorg.exe 48 PID 1100 wrote to memory of 1780 1100 cmd.exe 50 PID 1100 wrote to memory of 1780 1100 cmd.exe 50 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ghibzkdm.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PO_23509-23510.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1296
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe"C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe" C:\Users\Admin\AppData\Local\Temp\smpprgdmyr.v3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe"C:\Users\Admin\AppData\Local\Temp\tqchnnl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exeC:\Users\Admin\AppData\Local\Temp\tqchnnl.exe /stext "C:\Users\Admin\AppData\Local\Temp\mlxx"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:832
-
-
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exeC:\Users\Admin\AppData\Local\Temp\tqchnnl.exe /stext "C:\Users\Admin\AppData\Local\Temp\wfcqmon"5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:780
-
-
C:\Users\Admin\AppData\Local\Temp\tqchnnl.exeC:\Users\Admin\AppData\Local\Temp\tqchnnl.exe /stext "C:\Users\Admin\AppData\Local\Temp\hhpinhyjya"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:844
-
-
C:\Users\Admin\AppData\Local\Temp\fmwrz.exe"C:\Users\Admin\AppData\Local\Temp\fmwrz.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe"C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe" C:\Users\Admin\AppData\Local\Temp\xaaktctbkvc.h6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe"C:\Users\Admin\AppData\Local\Temp\ghibzkdm.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:848
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\datrem.exe"C:\Users\Admin\AppData\Local\Temp\datrem.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 37 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe,"6⤵PID:436
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 377⤵
- Runs ping.exe
PID:960
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe,"7⤵
- Modifies WinLogon for persistence
PID:2480
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 48 > nul && copy "C:\Users\Admin\AppData\Local\Temp\datrem.exe" "C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe" && ping 127.0.0.1 -n 48 > nul && "C:\Users\Admin\AppData\Roaming\dfsghjs\uytresdfgh.exe"6⤵PID:2276
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 487⤵
- Runs ping.exe
PID:2304
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 487⤵
- Runs ping.exe
PID:2832
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\datorg.exe"C:\Users\Admin\AppData\Local\Temp\datorg.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 35 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe,"6⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 357⤵
- Runs ping.exe
PID:1780
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe,"7⤵
- Modifies WinLogon for persistence
PID:2376
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 44 > nul && copy "C:\Users\Admin\AppData\Local\Temp\datorg.exe" "C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe" && ping 127.0.0.1 -n 44 > nul && "C:\Users\Admin\AppData\Roaming\dfsghjs\iurdsfhgj.exe"6⤵PID:2204
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 447⤵
- Runs ping.exe
PID:2232
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 447⤵
- Runs ping.exe
PID:2716
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\datxld.exe"C:\Users\Admin\AppData\Local\Temp\datxld.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 37 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe,"6⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 377⤵
- Runs ping.exe
PID:1112
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe,"7⤵
- Modifies WinLogon for persistence
PID:2408
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 45 > nul && copy "C:\Users\Admin\AppData\Local\Temp\datxld.exe" "C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe" && ping 127.0.0.1 -n 45 > nul && "C:\Users\Admin\AppData\Roaming\dfsghjs\uytedew.exe"6⤵PID:2144
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 457⤵
- Runs ping.exe
PID:2172
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 457⤵
- Runs ping.exe
PID:2752
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD55c65827565e89d5357d6f81294701c19
SHA1600aa1899bdc58d12671774e84033366dc931c04
SHA256dec6f35ceb48260f3ba4e6487c48d3f97b274f2eff29cab00c2c7e677eef4b4f
SHA512052c177c606d30f4f3b658f60bb3643fffec498cc8fa931b4380aa6b93ac20fa9ef4600645740e99ba2f6d43e333fe783378d14395132819d6fb44787aad196a
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
218KB
MD5a3a47448f45b0374c3cde59e1a7bfb0d
SHA1e00b404f1a143c99e1cf095ef27678022539be43
SHA2569b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
SHA512cc70d6c4829a13a7b5819c6924d0309beb083131c59d8cb3e81f13b1bc38d02413f48447064b7f5948bdb2d162c450863c9bc0c47f51735375264d31bbc48dd4
-
Filesize
218KB
MD5a3a47448f45b0374c3cde59e1a7bfb0d
SHA1e00b404f1a143c99e1cf095ef27678022539be43
SHA2569b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
SHA512cc70d6c4829a13a7b5819c6924d0309beb083131c59d8cb3e81f13b1bc38d02413f48447064b7f5948bdb2d162c450863c9bc0c47f51735375264d31bbc48dd4
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
7KB
MD58bba552e868d530af56dadd00d38ce78
SHA1e8f76dd15c91b3c42d42ce83a06c299d900cedf6
SHA256dd99bf95cbfb93c236cdfe239dddce5aa54f6355a50a7b2ed7606afd00958b9b
SHA512ff8fe38ed26720865f57fa69a9dd3806109cb688ea22e38ff44ca05f6a7d95795705ac2ccff1e7eb964696a0a0843b370fe76c96373a580ef66ada63054ce35f
-
Filesize
161KB
MD512c7d6f0b173d7d369ae8bf93dd1c384
SHA1bcb512d7fe890bb980206788d15c494ca02ede8a
SHA256ae4add2b61f783f6d4faa3216ff68960302f76230ef0a371edf6778188bf86f3
SHA51253e8b9337544218ab38f319d34752161ad974db1b370dae10786695554d0541dc21209e48c819b5e9e48f339e0afa843d750e8e5105e5abf18aa84e7bb3c24be
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
496KB
MD5b8e0694c7d8f49c6bab7b2f38a068cc7
SHA1b19f8174f08d3e844b5ae2e74cb6eb7a7e6f7923
SHA2566a0e2c58b2be31c768cd2dd0236ebef7d8ef9839c6398931f6f9b9a20b62dd4c
SHA512ead2ee5aeec1a2df1d244b8b5502bc0e84e85c5024602fb9cc4e3b09f687e9af77c2427d6e59661319217306494d50ea77d623b18e586baebeecc7b72a05c14f
-
Filesize
7KB
MD5bab85673afd9040f8fffe381439cf5cc
SHA18d13dfa7f0047acb464e3ed534580c60bdabed6b
SHA25676aee090b77973c9e217601cd168c181c0e4639b2073a0f52db7eb5c32fa77c2
SHA512df2694645b1ed4d2e9b2ffb901cb0d0af8ac192665c81214bbc8157fab7b6b5fe7203d8f6ebdbe070796ff6185c3535efed97a515f7ed413c0f7f689d1b0f16c
-
Filesize
230B
MD530e591976ab99e870396155ddb245180
SHA1d988f16a9277bdf80197d0c7ead428cd949dd091
SHA25677a2d4cd56481ba46cb2fb0110ef5013d0a7fe62e6aa26ccafc2dbb08dccaac7
SHA51209eac3f128f69444d6beb662e0b7d8daed4bc3426b800daea64038c9bad072b7766b7a8cf3668f4403447c5768ace49b1a51e5cd79644ee69ab07d571af92cbb
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
500KB
MD54da41093eb4cce80c18d1e6a2391ba80
SHA1c6e1338fb7c3ffc9d39d5362722110e8482216ea
SHA256f628532a482840b66c9fdf0ed09de86b63418e1f2cc3bbff139f54482f895d43
SHA51243ea46aeeda700e7b7e1f1f3fdede845e8d5723204d854e5452f9af785a20a9a915e1d9e4f44162777f2e5f569eda06904548114667ae05a285a980cb426dcd3
-
Filesize
500KB
MD54da41093eb4cce80c18d1e6a2391ba80
SHA1c6e1338fb7c3ffc9d39d5362722110e8482216ea
SHA256f628532a482840b66c9fdf0ed09de86b63418e1f2cc3bbff139f54482f895d43
SHA51243ea46aeeda700e7b7e1f1f3fdede845e8d5723204d854e5452f9af785a20a9a915e1d9e4f44162777f2e5f569eda06904548114667ae05a285a980cb426dcd3
-
Filesize
500KB
MD54da41093eb4cce80c18d1e6a2391ba80
SHA1c6e1338fb7c3ffc9d39d5362722110e8482216ea
SHA256f628532a482840b66c9fdf0ed09de86b63418e1f2cc3bbff139f54482f895d43
SHA51243ea46aeeda700e7b7e1f1f3fdede845e8d5723204d854e5452f9af785a20a9a915e1d9e4f44162777f2e5f569eda06904548114667ae05a285a980cb426dcd3
-
Filesize
1.1MB
MD58b0e574f3db376044a84cb315777dd80
SHA195a9baee9753204301faba46444cde42f724c1d6
SHA256adbe453aa3a0209fc356b1fd2ceaad057f5ff3a82fa54b0b0cf49d2c4788d263
SHA512d95d77fcd16d26c84e80697b109b9fbab2f8a7eb8ef3f10f463319ff193647e280ddc061506645c449a6c365aa5856e178fa4791242c5638be6f469a4b93b7ea
-
Filesize
1.5MB
MD596ab89f81c025afe746d86333ce945f7
SHA1d88cf814dbf9236c51b6a2914212765d289b2e8b
SHA256c8a73b8edabb6fb2597a642abb53b5a33aca53cf494a8b9b35a2dd020744d27b
SHA512f9a68e6f174c022fc67c58cd6f172f633111af38765b81e6b578dae89f90cbc18c3d77c47dff4d3e166f59b5574fff30316991275c31aaedb91feec83ea6930d
-
Filesize
1.1MB
MD54cfc1701fe7974c640796586a7130f70
SHA1329f3b2b6d4c29c785085178e7ff9c1813839d84
SHA2561100225cfbdf3ac536e1cc3bc6e77a4ba01a5b2fc582655a3b67c23183c2048c
SHA5120a280c11af661d006c3041d7819e9b4b3b3541ce0ed4fa54fc06180fa5132722a39c91c6bb334d282e6afea455ebb647bad02bace182f561aead3de468bf68ed
-
Filesize
218KB
MD5a3a47448f45b0374c3cde59e1a7bfb0d
SHA1e00b404f1a143c99e1cf095ef27678022539be43
SHA2569b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
SHA512cc70d6c4829a13a7b5819c6924d0309beb083131c59d8cb3e81f13b1bc38d02413f48447064b7f5948bdb2d162c450863c9bc0c47f51735375264d31bbc48dd4
-
Filesize
326KB
MD5ef12ab9d0b231b8f898067b2114b1bc0
SHA16d90f27b2105945f9bb77039e8b892070a5f9442
SHA2562b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7
SHA5122aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
34KB
MD5fb4d8f685c26d5958cb092ef90cc8e7f
SHA1accfc973351957db7fe4584e24c3989b5df8d3b9
SHA256b78e622cab41dcf6e311a6d53dc1325d6e1851526baf036f9cbd5168000b8901
SHA51289878fa3efba0cb880d8973085b69eea0733260fc7fe6d3b276b33259cf99243363010d7dd753b98d629271834e2cf310bec514db0e1ea8a50d1aba3d200f4e3
-
Filesize
133KB
MD575f8cc548cabf0cc800c25047e4d3124
SHA1602676768f9faecd35b48c38a0632781dfbde10c
SHA256fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0
SHA512ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f
-
Filesize
429KB
MD5109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
Filesize
1.2MB
MD5d7858e8449004e21b01d468e9fd04b82
SHA19524352071ede21c167e7e4f106e9526dc23ef4e
SHA25678758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db
SHA5121e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440
-
Filesize
141KB
MD5471c983513694ac3002590345f2be0da
SHA16612b9af4ff6830fa9b7d4193078434ef72f775b
SHA256bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f
SHA512a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
34KB
MD578d3f22fed32bf75725573cf8df7d666
SHA12e0c049c4b58a7db1259bfa7023473ebe6785025
SHA2564a6d211f626c08754049b36707cbb5316d4f8fc5a3e4cfbf28616ed1c39f66c0
SHA512bf01b209f4d3ba488a798a65a9d346bba04343d5a694619c350a3eff660a507c28fc63bf0464668118b26777945f1d0216659798baabaabb1d77d535cb02668c
-
Filesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
Filesize
500KB
MD54da41093eb4cce80c18d1e6a2391ba80
SHA1c6e1338fb7c3ffc9d39d5362722110e8482216ea
SHA256f628532a482840b66c9fdf0ed09de86b63418e1f2cc3bbff139f54482f895d43
SHA51243ea46aeeda700e7b7e1f1f3fdede845e8d5723204d854e5452f9af785a20a9a915e1d9e4f44162777f2e5f569eda06904548114667ae05a285a980cb426dcd3