Analysis
-
max time kernel
151s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2023 05:52
Static task
static1
Behavioral task
behavioral1
Sample
winzip27-p003.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
winzip27-p003.exe
Resource
win10v2004-20230220-en
General
-
Target
winzip27-p003.exe
-
Size
2.8MB
-
MD5
4ab9bed90bedaace02bb997063a81a2a
-
SHA1
5778d4dbf5bcf1fd52717c4709de6a3bf9e2c127
-
SHA256
78e4bbd109f8fa1a87b91769320650acd17bd09b623e4557fb9832ba1a0702d6
-
SHA512
0463a63dea0b4c81b1f38ca7eb31aad1935e7f1ebcfa7b9878ee62df50e68b2e4695c49a7a2afd14f926ceecd136e90c26a947df8a0c66c669c2f3dd779f9c00
-
SSDEEP
49152:38csPJkaaLdj1vptksRov0amNesLcYqQJawYLonZkyo7I9+upXrWXld:3TC+HBj1BtksRW0XNPywYLonqyo7I9+h
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation winzip27-p003.exe -
Executes dropped EXE 14 IoCs
pid Process 1880 winzip27-p003.exe 4704 CloseFAH.exe 2696 WzPreviewer64.exe 4344 WzPreloader.exe 4192 winzip64.exe 180 WzCABCacheSyncHelper64.exe 4560 WzUpdater.exe 2208 FAHConsole.exe 2720 FAHWindow64.exe 2620 adxregistrator.exe 3656 adxregistrator.exe 4212 WzBGTComServer64.exe 2564 WZUpdateNotifier.exe 5004 WzBGTools64.exe -
Loads dropped DLL 64 IoCs
pid Process 3172 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 4192 winzip64.exe 4192 winzip64.exe 4192 winzip64.exe 4192 winzip64.exe 4192 winzip64.exe 4192 winzip64.exe 180 WzCABCacheSyncHelper64.exe 180 WzCABCacheSyncHelper64.exe 180 WzCABCacheSyncHelper64.exe 180 WzCABCacheSyncHelper64.exe 180 WzCABCacheSyncHelper64.exe -
Modifies system executable filetype association 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip\ = "{E0D79304-84BE-11CE-9641-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\lnkfile\shellex\DragDropHandlers\WinZip msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WinZip msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WinZip\ = "{E0D79305-84BE-11CE-9641-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip winzip64.exe Key created \REGISTRY\MACHINE\Software\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip\ = "{E0D79304-84BE-11CE-9641-444553540000}" winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WinZip winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WinZip\ = "{E0D79305-84BE-11CE-9641-444553540000}" winzip64.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\CodeBase = "file:///C:/Program Files/WinZip/WinZipExpressForOffice.DLL" adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79304-84BE-11CE-9641-444553540000}\InProcServer32 winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\WZSHLS64.DLL" winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" winzip64.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0 adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\CodeBase = "file:///C:/Program Files/WinZip/WinZipExpressForOffice.DLL" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\Assembly = "WinZipExpressForOffice, Version=3.5.15230.0, Culture=neutral, PublicKeyToken=86e07f6d9d2175ee" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\RuntimeVersion = "v4.0.30319" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\RuntimeVersion = "v4.0.30319" adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32 winzip64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\Assembly = "WinZipExpressForOffice, Version=3.5.15230.0, Culture=neutral, PublicKeyToken=86e07f6d9d2175ee" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ = "mscoree.dll" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ = "mscoree.dll" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, PublicKeyToken=86E07F6D9D2175EE" adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79307-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0 adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" winzip64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ = "mscoree.dll" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\RuntimeVersion = "v4.0.30319" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\CodeBase = "file:///C:/Program Files/WinZip/WinZipExpressForOffice.DLL" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32 winzip64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\CodeBase = "file:///C:/Program Files/WinZip/WinZipExpressForOffice.DLL" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, Version=3.5.15230.0, Culture=neutral, PublicKeyToken=86e07f6d9d2175ee" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, Version=3.5.15230.0, Culture=neutral, PublicKeyToken=86e07f6d9d2175ee" adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D7930A-84BE-11CE-9641-444553540002}\LocalServer32 WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79304-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\RuntimeVersion = "v4.0.30319" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ = "C:\\Program Files\\WinZip\\adxloader64.WinZipExpressForOffice.dll" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D7930A-84BE-11CE-9641-444553540002}\LocalServer32\ThreadingModel = "Apartment" WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79304-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9CA9DBE8-C0B1-42c9-B6C7-856BE5756855}\LocalServer32 WzBGTComServer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79307-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79307-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\wzshls64.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, Version=3.5.15230.0, Culture=neutral, PublicKeyToken=86e07f6d9d2175ee" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Apartment" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9CC15BB9-FB90-4D43-BE2D-8FC05F1A454C}\InProcServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79307-84BE-11CE-9641-444553540000}\InProcServer32 winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\RuntimeVersion = "v4.0.30319" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, PublicKeyToken=86E07F6D9D2175EE" adxregistrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0 adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9CA9DBE8-C0B1-42c9-B6C7-856BE5756855}\LocalServer32\ = "\"C:\\Program Files\\WinZip\\WzBGTComServer64.exe\"" WzBGTComServer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79307-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\WZSHLS64.DLL" winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79307-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79304-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\wzshls64.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Both" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Both" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Apartment" adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9CC15BB9-FB90-4D43-BE2D-8FC05F1A454C}\InProcServer32 MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9CC15BB9-FB90-4D43-BE2D-8FC05F1A454C}\InProcServer32\InprocServer32 = 3500300039004600420044003200300039003000340046003400340030004300350038004100320041003700000034006b00480038004800730024006a0049003d00270045006600280049007a00500069005a004700450043004400430036003e004d0035004b0044005900530055006e0066002800480041002a004c005b00780065005800290079002400660031002c004200460079004000580039002d00410045007d0026004d003500500025005900500072006f006700720061006d005f0044006100740061003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\WZSHLS64.DLL" winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{784C04A3-2E5A-4E7C-A7F7-7D97E27859AD}\LocalServer32\ = "C:\\Program Files\\WinZip\\winzip64.exe" winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Both" adxregistrator.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinZip UN = "\"C:\\Program Files\\WinZip\\WZUpdateNotifier.exe\" -show" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinZip FAH = "C:\\Program Files\\WinZip\\FAHConsole.exe" msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winzip64.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: winzip27-p003.exe File opened (read-only) \??\Q: winzip27-p003.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: winzip27-p003.exe File opened (read-only) \??\Z: winzip27-p003.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: winzip27-p003.exe File opened (read-only) \??\I: winzip27-p003.exe File opened (read-only) \??\O: winzip27-p003.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: winzip27-p003.exe File opened (read-only) \??\H: winzip27-p003.exe File opened (read-only) \??\S: winzip27-p003.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: winzip27-p003.exe File opened (read-only) \??\G: winzip27-p003.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: winzip27-p003.exe File opened (read-only) \??\W: winzip27-p003.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: winzip27-p003.exe File opened (read-only) \??\M: winzip27-p003.exe File opened (read-only) \??\T: winzip27-p003.exe File opened (read-only) \??\U: winzip27-p003.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: winzip27-p003.exe File opened (read-only) \??\R: winzip27-p003.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: winzip27-p003.exe File opened (read-only) \??\Y: winzip27-p003.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: winzip27-p003.exe File opened (read-only) \??\V: winzip27-p003.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8 winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62 winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8 winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_9B2AD33CBA8FC50DD8D8B0635B46183D winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_9B2AD33CBA8FC50DD8D8B0635B46183D winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62 winzip64.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WinZip\WzWXFgdrv64.dll msiexec.exe File created C:\Program Files\WinZip\WzWXFxmpp64.dll msiexec.exe File created C:\Program Files\WinZip\en-US\MYE-MAIL.WJF msiexec.exe File created C:\Program Files\WinZip\WinZip64.visualelementsmanifest.xml msiexec.exe File created C:\Program Files\WinZip\en-US\BoxService.resources.dll msiexec.exe File created C:\Program Files\WinZip\WXFD2P.dll msiexec.exe File created C:\Program Files\WinZip\en-US\wzimgv64.dll.mui msiexec.exe File created C:\Program Files\WinZip\WzPreviewer64.exe msiexec.exe File created C:\Program Files\WinZip\WzPrvHand64.dll msiexec.exe File created C:\Program Files\WinZip\WzUpdater.exe.config msiexec.exe File created C:\Program Files\WinZip\wzshlex1.dll msiexec.exe File created C:\Program Files\WinZip\en-US\WzWXFd2p64.dll.mui msiexec.exe File created C:\Program Files\WinZip\DupFFStub.exe msiexec.exe File created C:\Program Files\WinZip\en-US\DupFFStub.resources.dll msiexec.exe File created C:\Program Files\WinZip\FAHConsole.exe msiexec.exe File created C:\Program Files\WinZip\WzWXFlh64.dll msiexec.exe File created C:\Program Files\WinZip\WXFWMRK.dll msiexec.exe File created C:\Program Files\WinZip\CloudMeService.dll msiexec.exe File created C:\Program Files\WinZip\WzWXFcmbpdf64.dll msiexec.exe File created C:\Program Files\WinZip\IMService.dll msiexec.exe File created C:\Program Files\WinZip\WzWXFog64.dll msiexec.exe File created C:\Program Files\WinZip\en-US\SplashScreen.MHT msiexec.exe File created C:\Program Files\WinZip\en-US\WzS4DELManager64.dll.mui msiexec.exe File created C:\Program Files\WinZip\RecipientClient.dll msiexec.exe File created C:\Program Files\WinZip\WzMsg.exe msiexec.exe File created C:\Program Files\WinZip\en-US\WzWXFcmbpdf64.dll.mui msiexec.exe File created C:\Program Files\WinZip\LocalService.dll msiexec.exe File created C:\Program Files\WinZip\WzWXFp2d64.dll msiexec.exe File created C:\Program Files\WinZip\en-US\WzPrvHand64.dll.mui msiexec.exe File created C:\Program Files\WinZip\WzProdAdv.dll msiexec.exe File created C:\Program Files\WinZip\WzSyncHelper64.exe msiexec.exe File created C:\Program Files\WinZip\en-US\WzWFR64.dll.mui msiexec.exe File opened for modification C:\Program Files\WinZip\{F1869396-0E7B-4C45-A6A1-AD24CAD220C8}.bgt MsiExec.exe File created C:\Program Files\WinZip\RecipientService.dll msiexec.exe File created C:\Program Files\WinZip\WzBGTWin10Notification.dll msiexec.exe File created C:\Program Files\WinZip\en-US\WzWXFrmpd64.dll.mui msiexec.exe File created C:\Program Files\WinZip\WzDIRXHelper64.dll msiexec.exe File created C:\Program Files\WinZip\en-US\GoogleDriveService.resources.dll msiexec.exe File created C:\Program Files\WinZip\en-US\IMClient.resources.dll msiexec.exe File created C:\Program Files\WinZip\OneDriveService.dll msiexec.exe File created C:\Program Files\WinZip\en-US\WzS4DELWin10Notification.resources.dll msiexec.exe File created C:\Program Files\WinZip\SugarSyncService.dll msiexec.exe File created C:\Program Files\WinZip\WZUpdateNotifier.exe msiexec.exe File created C:\Program Files\WinZip\en-US\RecipientDirectoryDialog.resources.dll msiexec.exe File created C:\Program Files\WinZip\en-US\WzWXFsgnpdf64.dll.mui msiexec.exe File created C:\Program Files\WinZip\GoogleDriveService.dll msiexec.exe File created C:\Program Files\WinZip\WebAuthBroker.exe msiexec.exe File opened for modification C:\Program Files\WinZip\{B0EF9A73-A12A-4543-A9B5-505FBCE2E4DE}.bgt MsiExec.exe File created C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe.config msiexec.exe File created C:\Program Files\WinZip\en-US\WzWXFphrs64.dll.mui msiexec.exe File created C:\Program Files\WinZip\WzWXFlpd64.dll msiexec.exe File created C:\Program Files\WinZip\en-US\MediaFireService.resources.dll msiexec.exe File created C:\Program Files\WinZip\en-US\CloudStoragePicker.resources.dll msiexec.exe File created C:\Program Files\WinZip\WzWXFlc64.dll msiexec.exe File created C:\Program Files\WinZip\en-US\LIBPICS.WJF msiexec.exe File created C:\Program Files\WinZip\en-US\WzSharedServices64.dll.mui msiexec.exe File created C:\Program Files\WinZip\WXFCMBPDF.dll msiexec.exe File created C:\Program Files\WinZip\WzWXFttim64.dll msiexec.exe File created C:\Program Files\WinZip\IMClient.dll msiexec.exe File created C:\Program Files\WinZip\WzSUWC.dll msiexec.exe File created C:\Program Files\WinZip\wzshls64.dll msiexec.exe File created C:\Program Files\WinZip\WzZEC64.dll msiexec.exe File created C:\Program Files\WinZip\WzComAddrBook64.dll msiexec.exe File created C:\Program Files\WinZip\en-US\LocalPortableDeviceService.resources.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\SbkupStub64_ShortCut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIDF18.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\WinZip64_Shortcut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\DupFFStub64_Shortcut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\ImgUtil64_Shortcut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\e57bebc.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF72B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF8D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1A38.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC4EF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF051.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\WinZip64_Shortcut_MenuGroup.exe msiexec.exe File created C:\Windows\Installer\e57bec3.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID376.tmp msiexec.exe File opened for modification C:\Windows\WIN.INI winzip64.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\PdfUtil64_Shortcut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\Sbkup64_ShortCut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF081.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF847.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF8FA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID60.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI111F.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\Sbkup64_ShortCut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\MSID4E2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2E4D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI23F3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID424.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\ImgUtilStub64_Shortcut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI2BF7.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{CD95F661-A5C4-44F5-A6AA-ECDD91C24143} msiexec.exe File opened for modification C:\Windows\Installer\MSIF93B.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\SafeShareStub64_Shortcut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC93B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC46F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICD16.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID308.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\ImgUtilStub64_Shortcut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\SafeShare64_ShortCut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC40E.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\PdfUtilStub64_Shortcut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC7D0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF6FA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF86A.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\SbkupStub64_ShortCut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1B47.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2C84.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC18B.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\PdfUtilStub64_Shortcut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\Sbkup64_ShortCut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1B36.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2B58.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID279.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\PdfUtilStub64_Shortcut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\MSID18D.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\PdfUtil64_Shortcut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24143}\WinZip64_Shortcut_Preloader.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC8BD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICD46.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF869.tmp msiexec.exe File opened for modification C:\Windows\win.ini winzip64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009865abc95f2d4b980000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009865abc90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809009865abc9000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1524 schtasks.exe 2904 schtasks.exe 544 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "0" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "111" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "1870" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1224" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "124" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "51" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "111" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1167" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "1193" winzip27-p003.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "51" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "111" winzip27-p003.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\WebAuthBroker.exe = "10000" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\winzip64.exe = "8000" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "0" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "814" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1870" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1193" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "1224" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" winzip27-p003.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DOMStorage\corel.com winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "124" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "814" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1870" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "51" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1167" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "1167" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1224" winzip27-p003.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MsiExec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\NumberOfSubdomains = "1" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "124" winzip27-p003.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "814" winzip27-p003.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1193" winzip27-p003.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.LHA = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\wzshlext\CommentCheckFixed = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\DefaultTypeZipX = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\RecycleBin = "1" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFnas\Default WzCABCacheSyncHelper64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\Common\Email\Share winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\ListView\FullRowSelect = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\Splitter\Enabled = "1" winzip64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFssync\Default\MaxUploadSizeMB = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\Splitter\HideAction = "475" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.VMDK = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\wzshlext\DropDialogWinzip = "1" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzAddropocts WzCABCacheSyncHelper64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.XXE = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\programs\viewer = "C:\\Windows\\NOTEPAD.EXE" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\SpanDefault = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\MaxTransformThreads = "6" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\Statistics\Collect = "1" winzip64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns\WinZipExpressForOffice.AddinModule\LoadBehavior = "3" adxregistrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.UU = "1" winzip64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Word\AddIns\WinZipExpressForOffice.AddinModule\LoadBehavior = "3" adxregistrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Corel\PCU winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.TBZ2 = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\DefaultCompressionMethod = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\Setup = "0" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFoned winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\Splitter\FilesPaneTreeView = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFd2p WzCABCacheSyncHelper64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFttim WzCABCacheSyncHelper64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\PowerPoint adxregistrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\Splitter\ListPane = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\Common\Email\Services\ = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><mailservices default=\"Gmail\"><mailservice name=\"Gmail\" login=\"yes\" help=\"yes\" encryption=\"tls\"><smtp server=\"smtp.gmail.com\" port=\"587\"/><domains>gmail.com</domains></mailservice><mailservice name=\"Hotmail\" login=\"yes\" help=\"no\" encryption=\"tls\"><smtp server=\"smtp.office365.com\" port=\"587\"/><domains>hotmail.*;live.*;msnhotmail.com</domains></mailservice><mailservice name=\"Yahoo!\" login=\"yes\" help=\"yes\" encryption=\"none\"><smtp server=\"plus.smtp.mail.yahoo.com\" port=\"465\"/><domains>yahoo.com;sbcglobal.com</domains></mailservice><mailservice name=\"Outlook.com\" login=\"yes\" help=\"yes\" encryption=\"tls\"><smtp server=\"smtp.office365.com\" port=\"587\"/><domains>outlook.com;*.onmicrosoft.com</domains></mailservice></mailservices>" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\Common\Email\Share\WinZip winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Corel\PCU\HFNCv2 = "6201C35E5273" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\CheckOutIconOnly = "1" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFssync winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\wzshlext\CommentCheckRemovable = "1" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\mru\archives winzip64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" adxregistrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFoned\Default\WritableRootFolder = "\\" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFzshare winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\Common\Email\Services winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFivrs WzCABCacheSyncHelper64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Word\AddIns adxregistrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.ISO = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\Wizard = "0" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFgdrv winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\ShowTips = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\LastDPI = "100" winzip64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" adxregistrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.ZIP = "1" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\programs winzip64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\DefaultMaxParallel = "2" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFp2d WzCABCacheSyncHelper64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFphrs WzCABCacheSyncHelper64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\PowerPoint\AddIns\WinZipExpressForOffice.AddinModule adxregistrator.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\RibbonState = 3c7369713a637573746f6d554920786d6c6e733a7369713d22687474703a2f2f736368656d61732e6d6963726f736f66742e636f6d2f77696e646f77732f323030392f726962626f6e2f716174223e3c7369713a726962626f6e206d696e696d697a65643d2274727565223e3c7369713a71617420706f736974696f6e3d2230223e3c7369713a736861726564436f6e74726f6c733e3c7369713a636f6e74726f6c206964513d227369713a3435323032222076697369626c653d22747275652220617267756d656e743d223022202f3e3c2f7369713a736861726564436f6e74726f6c733e3c2f7369713a7161743e3c2f7369713a726962626f6e3e3c2f7369713a637573746f6d55493e winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WinIni winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\ExtractSkipOlder = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\ListView\GridLines = "0" winzip64.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.jpg winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.SetupConfig\shell\open winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wzmul msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ZIP\ShellEx\{00021500-0000-0000-c000-000000000046} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D7930A-84BE-11CE-9641-444553540002}\ = "WinZip Preview Handler" WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.AutoplayHandler.1 winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\Implemented Categories adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.TZ WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinZip" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D7930A-84BE-11CE-9641-444553540002}\Icon = "C:\\Program Files\\WinZip\\WzPreviewer64.exe,1" WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.SetupConfig winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C1434\MediaFireCloud = "CloudSvc" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C1434\ImgUtil = "\x06Applets" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\166F59DC4C5A5F446AAACEDD192C1434\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.ZipX\ShellEx\DropHandler\ = "{E0D79306-84BE-11CE-9641-444553540000}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ZIP\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F} WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F} WzPreviewer64.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.WSZ WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C1434\SafeShareFiles = "WinZipSafeShare" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\wzshls64.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\wzshls64.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, PublicKeyToken=86E07F6D9D2175EE" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C1434\FAH = "Complete" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.JobFile\shell\open\command winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, Version=3.5.15230.0, Culture=neutral, PublicKeyToken=86e07f6d9d2175ee" adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bhx msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.TBZ\ = "WinZip" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WinZipExpressForOffice.AddinModule\ = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\ProgId adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.UUE\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F} WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7z msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.15230.0\RuntimeVersion = "v4.0.30319" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C1434\SafeShareStartMenuIcon = "WinZipSafeShare" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.PdfExpress\shell\open winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.PDFExpress\ = "WinZip PDF Express" winzip64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.iso\shell\Open\command\command = 35002100480029006b0078004a00750031003d004400320067004300700056005a0048005d0039004d00610069006e004700550049003c002000220025003100220000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\WinZip.ZIPX msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WzExpForSPExtension\ = "URL:WzExpForSPExtension Protocol" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wmz\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}\ = "{E0D7930A-84BE-11CE-9641-444553540002}" WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.JobFile\shell\edit\ = "&Edit with WinZip" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220} adxregistrator.exe Key created \REGISTRY\MACHINE\Software\Classes\WzExpForSPExtension\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LZS WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.TXZ\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}\ = "{E0D7930A-84BE-11CE-9641-444553540002}" WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9CC15BB9-FB90-4D43-BE2D-8FC05F1A454C}\InProcServer32\ThreadingModel = "Both" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.PDFExpress\Application\ApplicationName = "WinZip PDF Express" winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\WinZip\ShellNew msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uu msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\WinZip msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.TXZ\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F} WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.JobFile\shell\edit winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.AutoplayHandler\CLSID winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C1434\AddressBookEnglishFiles = "AddressBook" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C1434\PreviewerFiles = "Previewer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.JobFile\AppUserModelID = "WinZipComputing.WinZip64" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.UU\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}\ = "{E0D7930A-84BE-11CE-9641-444553540002}" WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ = "C:\\Program Files\\WinZip\\adxloader64.WinZipExpressForOffice.dll" adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.TXZ\ShellEx WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.JobFile\shell\Edit\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip\shell\print\command\ = "\"C:\\Program Files\\WinZip\\winzip64.exe\" /print /ni \"%1\"" msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 winzip27-p003.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 winzip27-p003.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 winzip27-p003.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 winzip27-p003.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 winzip27-p003.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 4344 WzPreloader.exe 4192 winzip64.exe 4192 winzip64.exe 4192 winzip64.exe 4192 winzip64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe 2720 FAHWindow64.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4700 msiexec.exe Token: SeCreateTokenPrivilege 1880 winzip27-p003.exe Token: SeAssignPrimaryTokenPrivilege 1880 winzip27-p003.exe Token: SeLockMemoryPrivilege 1880 winzip27-p003.exe Token: SeIncreaseQuotaPrivilege 1880 winzip27-p003.exe Token: SeMachineAccountPrivilege 1880 winzip27-p003.exe Token: SeTcbPrivilege 1880 winzip27-p003.exe Token: SeSecurityPrivilege 1880 winzip27-p003.exe Token: SeTakeOwnershipPrivilege 1880 winzip27-p003.exe Token: SeLoadDriverPrivilege 1880 winzip27-p003.exe Token: SeSystemProfilePrivilege 1880 winzip27-p003.exe Token: SeSystemtimePrivilege 1880 winzip27-p003.exe Token: SeProfSingleProcessPrivilege 1880 winzip27-p003.exe Token: SeIncBasePriorityPrivilege 1880 winzip27-p003.exe Token: SeCreatePagefilePrivilege 1880 winzip27-p003.exe Token: SeCreatePermanentPrivilege 1880 winzip27-p003.exe Token: SeBackupPrivilege 1880 winzip27-p003.exe Token: SeRestorePrivilege 1880 winzip27-p003.exe Token: SeShutdownPrivilege 1880 winzip27-p003.exe Token: SeDebugPrivilege 1880 winzip27-p003.exe Token: SeAuditPrivilege 1880 winzip27-p003.exe Token: SeSystemEnvironmentPrivilege 1880 winzip27-p003.exe Token: SeChangeNotifyPrivilege 1880 winzip27-p003.exe Token: SeRemoteShutdownPrivilege 1880 winzip27-p003.exe Token: SeUndockPrivilege 1880 winzip27-p003.exe Token: SeSyncAgentPrivilege 1880 winzip27-p003.exe Token: SeEnableDelegationPrivilege 1880 winzip27-p003.exe Token: SeManageVolumePrivilege 1880 winzip27-p003.exe Token: SeImpersonatePrivilege 1880 winzip27-p003.exe Token: SeCreateGlobalPrivilege 1880 winzip27-p003.exe Token: SeShutdownPrivilege 1880 winzip27-p003.exe Token: SeIncreaseQuotaPrivilege 1880 winzip27-p003.exe Token: SeCreateTokenPrivilege 1880 winzip27-p003.exe Token: SeAssignPrimaryTokenPrivilege 1880 winzip27-p003.exe Token: SeLockMemoryPrivilege 1880 winzip27-p003.exe Token: SeIncreaseQuotaPrivilege 1880 winzip27-p003.exe Token: SeMachineAccountPrivilege 1880 winzip27-p003.exe Token: SeTcbPrivilege 1880 winzip27-p003.exe Token: SeSecurityPrivilege 1880 winzip27-p003.exe Token: SeTakeOwnershipPrivilege 1880 winzip27-p003.exe Token: SeLoadDriverPrivilege 1880 winzip27-p003.exe Token: SeSystemProfilePrivilege 1880 winzip27-p003.exe Token: SeSystemtimePrivilege 1880 winzip27-p003.exe Token: SeProfSingleProcessPrivilege 1880 winzip27-p003.exe Token: SeIncBasePriorityPrivilege 1880 winzip27-p003.exe Token: SeCreatePagefilePrivilege 1880 winzip27-p003.exe Token: SeCreatePermanentPrivilege 1880 winzip27-p003.exe Token: SeBackupPrivilege 1880 winzip27-p003.exe Token: SeRestorePrivilege 1880 winzip27-p003.exe Token: SeShutdownPrivilege 1880 winzip27-p003.exe Token: SeDebugPrivilege 1880 winzip27-p003.exe Token: SeAuditPrivilege 1880 winzip27-p003.exe Token: SeSystemEnvironmentPrivilege 1880 winzip27-p003.exe Token: SeChangeNotifyPrivilege 1880 winzip27-p003.exe Token: SeRemoteShutdownPrivilege 1880 winzip27-p003.exe Token: SeUndockPrivilege 1880 winzip27-p003.exe Token: SeSyncAgentPrivilege 1880 winzip27-p003.exe Token: SeEnableDelegationPrivilege 1880 winzip27-p003.exe Token: SeManageVolumePrivilege 1880 winzip27-p003.exe Token: SeImpersonatePrivilege 1880 winzip27-p003.exe Token: SeCreateGlobalPrivilege 1880 winzip27-p003.exe Token: SeBackupPrivilege 2360 vssvc.exe Token: SeRestorePrivilege 2360 vssvc.exe Token: SeAuditPrivilege 2360 vssvc.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1880 winzip27-p003.exe 4192 winzip64.exe 3080 Explorer.EXE 3080 Explorer.EXE 3080 Explorer.EXE 3080 Explorer.EXE 1880 winzip27-p003.exe -
Suspicious use of SetWindowsHookAW 1 IoCs
pid Process 4192 winzip64.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1880 winzip27-p003.exe 1880 winzip27-p003.exe 1880 winzip27-p003.exe 4192 winzip64.exe 4192 winzip64.exe 4192 winzip64.exe 4192 winzip64.exe 4192 winzip64.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2352 wrote to memory of 1880 2352 winzip27-p003.exe 83 PID 2352 wrote to memory of 1880 2352 winzip27-p003.exe 83 PID 2352 wrote to memory of 1880 2352 winzip27-p003.exe 83 PID 4700 wrote to memory of 2268 4700 msiexec.exe 97 PID 4700 wrote to memory of 2268 4700 msiexec.exe 97 PID 4700 wrote to memory of 3172 4700 msiexec.exe 99 PID 4700 wrote to memory of 3172 4700 msiexec.exe 99 PID 4700 wrote to memory of 3172 4700 msiexec.exe 99 PID 4700 wrote to memory of 4132 4700 msiexec.exe 100 PID 4700 wrote to memory of 4132 4700 msiexec.exe 100 PID 4132 wrote to memory of 4704 4132 MsiExec.exe 101 PID 4132 wrote to memory of 4704 4132 MsiExec.exe 101 PID 4132 wrote to memory of 4704 4132 MsiExec.exe 101 PID 4700 wrote to memory of 1920 4700 msiexec.exe 103 PID 4700 wrote to memory of 1920 4700 msiexec.exe 103 PID 4700 wrote to memory of 2696 4700 msiexec.exe 104 PID 4700 wrote to memory of 2696 4700 msiexec.exe 104 PID 4700 wrote to memory of 4344 4700 msiexec.exe 105 PID 4700 wrote to memory of 4344 4700 msiexec.exe 105 PID 4700 wrote to memory of 4192 4700 msiexec.exe 106 PID 4700 wrote to memory of 4192 4700 msiexec.exe 106 PID 4192 wrote to memory of 180 4192 winzip64.exe 107 PID 4192 wrote to memory of 180 4192 winzip64.exe 107 PID 4700 wrote to memory of 4560 4700 msiexec.exe 109 PID 4700 wrote to memory of 4560 4700 msiexec.exe 109 PID 1920 wrote to memory of 2208 1920 MsiExec.exe 110 PID 1920 wrote to memory of 2208 1920 MsiExec.exe 110 PID 2208 wrote to memory of 2720 2208 FAHConsole.exe 111 PID 2208 wrote to memory of 2720 2208 FAHConsole.exe 111 PID 4132 wrote to memory of 2620 4132 MsiExec.exe 112 PID 4132 wrote to memory of 2620 4132 MsiExec.exe 112 PID 4132 wrote to memory of 2620 4132 MsiExec.exe 112 PID 2720 wrote to memory of 3080 2720 FAHWindow64.exe 71 PID 1920 wrote to memory of 3656 1920 MsiExec.exe 113 PID 1920 wrote to memory of 3656 1920 MsiExec.exe 113 PID 1920 wrote to memory of 3656 1920 MsiExec.exe 113 PID 4132 wrote to memory of 2904 4132 MsiExec.exe 114 PID 4132 wrote to memory of 2904 4132 MsiExec.exe 114 PID 4132 wrote to memory of 2904 4132 MsiExec.exe 114 PID 4132 wrote to memory of 544 4132 MsiExec.exe 115 PID 4132 wrote to memory of 544 4132 MsiExec.exe 115 PID 4132 wrote to memory of 544 4132 MsiExec.exe 115 PID 4132 wrote to memory of 1524 4132 MsiExec.exe 116 PID 4132 wrote to memory of 1524 4132 MsiExec.exe 116 PID 4132 wrote to memory of 1524 4132 MsiExec.exe 116 PID 4700 wrote to memory of 4212 4700 msiexec.exe 117 PID 4700 wrote to memory of 4212 4700 msiexec.exe 117 PID 4700 wrote to memory of 2564 4700 msiexec.exe 118 PID 4700 wrote to memory of 2564 4700 msiexec.exe 118 PID 4700 wrote to memory of 5004 4700 msiexec.exe 119 PID 4700 wrote to memory of 5004 4700 msiexec.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\winzip27-p003.exe"C:\Users\Admin\AppData\Local\Temp\winzip27-p003.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\e567d43\winzip27-p003.exerun=1 shortcut="C:\Users\Admin\AppData\Local\Temp\winzip27-p003.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1880
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2268
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71EF61D98AE97B53A8A18A8C6C3D133E2⤵
- Loads dropped DLL
PID:3172
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding C9F2278AC6C3D7468C8EB052CCA8F72E2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\CloseFAH.exe"C:\Users\Admin\AppData\Local\Temp\CloseFAH.exe"3⤵
- Executes dropped EXE
PID:4704
-
-
C:\Program Files\WinZip\adxregistrator.exe"C:\Program Files\WinZip\adxregistrator.exe" /install="C:\Program Files\WinZip\WinZipExpressForOffice.dll" /privileges=user /GenerateLogFile=false3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:2620
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 1" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_9AM\" -show" /ST 09:55 /F3⤵
- Creates scheduled task(s)
PID:2904
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 2" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_12PM\" -show" /ST 12:55 /F3⤵
- Creates scheduled task(s)
PID:544
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 3" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_3PM\" -show" /ST 15:55 /F3⤵
- Creates scheduled task(s)
PID:1524
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6CABB901B5CD18BE81F13EB580509115 E Global\MSI00002⤵
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files\WinZip\FAHConsole.exe"C:\Program Files\WinZip\FAHConsole.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files\WinZip\FAHWindow64.exe"C:\Program Files\WinZip\FAHWindow64.exe" register4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720
-
-
-
C:\Program Files\WinZip\adxregistrator.exe"C:\Program Files\WinZip\adxregistrator.exe" /install="C:\Program Files\WinZip\WinZipExpressForOffice.dll" /privileges=admin /GenerateLogFile=false3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
PID:3656
-
-
-
C:\Program Files\WinZip\WzPreviewer64.exe"C:\Program Files\WinZip\WzPreviewer64.exe" -regserver winzip642⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:2696
-
-
C:\Program Files\WinZip\WzPreloader.exe"C:\Program Files\WinZip\WzPreloader.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /noqp /nodesktop /nostartmenu /nomenugroup /autoinstall /lang 10332⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:180
-
-
-
C:\Program Files\WinZip\WzUpdater.exe"C:\Program Files\WinZip\WzUpdater.exe" /schedule2⤵
- Executes dropped EXE
PID:4560
-
-
C:\Program Files\WinZip\WzBGTComServer64.exe"C:\Program Files\WinZip\WzBGTComServer64.exe" /REGSERVER2⤵
- Executes dropped EXE
- Registers COM server for autorun
PID:4212
-
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe"2⤵
- Executes dropped EXE
PID:2564
-
-
C:\Program Files\WinZip\WzBGTools64.exe"C:\Program Files\WinZip\WzBGTools64.exe" /s2⤵
- Executes dropped EXE
PID:5004
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.6MB
MD59305c57ef7040f3047ce662f9e33b655
SHA1b14704d65004db568741e30d988caa5eb358ed88
SHA25685fe9c60fa2b00cc97f723c6105456d7c9ae1daf8be1415494f15dcfc2fea3a2
SHA512322574931a7036ab351a13bb7bd1273258b81f5b1a790a01f52aa3eaeba275757d43c5f031921974081bad34d2f1b0f26b3387642d112bbf783b73c3a1eb2f4a
-
Filesize
285B
MD59c2910625722a5d4b31b5f378d815f3d
SHA140be0d9e3e2cc138734c45573b2d20adc614ae1e
SHA256ff3c784f480397993f81fdee77d78081bfaad7b949345cbb864487b050de7301
SHA5124b0729bdfcde3bb1eb85b031a4f91bec26e38fec72d28cc7e8275a006b6da7e4598430a40f34a45ca8609c84654f798edcf31e421a6761aafdb0df61e318b199
-
Filesize
2KB
MD5e88e23e21ceaaa7bc06806c577ab2411
SHA11d403c7a9db902fd6fb3572d3f54cd7c8475a7b7
SHA2560d1e3afe9db1c1e94c924874f4f48b1d1e372a2d539ceb2a1bda82d0dcc44a6c
SHA5120fe600ac95ae639ae34bd4aa94a445a8cfe098905565fcb4ad6d691bcc86f11c5d8aad10549fb9845b7ecf38a5b40d7dafec021558b98e349afff88f498b7ca6
-
Filesize
1KB
MD5ab1fe4634b6b57d9963f88e08e6f1502
SHA12a11a049f5a9f49f6388094d01d9bf081e983e9b
SHA25684c950fc65baac25dc86a4506f26363141d78f788d8b6e6cd457422d80e2e7c7
SHA512d4c159a0422a592f2a675d69cb468b41afd7e97c7c4d17d7327d823e17a80e2190a77914037d21e745e6175aff8af44581f8b1ce74d49dad001dc76c8af0f9a3
-
Filesize
1KB
MD5f7e4814366b4e76a3ad97ff0e4f83261
SHA1e8e6586e973527d2f3a728d1325e8dfa81171d72
SHA25649910934a43f299be9b814c00ff0f87b6460b3eec0c3eccabde4a825d6682e18
SHA5122a87a5e08a7f68213d936602933c2bd90cb4457a8dd82d9a3b27b26fd8003e41f65fdbc81cc7a20e4e86c11ca2005e4f733623cb29ece55647b433213c6d0bc4
-
Filesize
1KB
MD52eb5ca8091eb13a9fe99f403598d97e2
SHA1c0927c3aeee85fc7d76eb7bb6012d70334ff5542
SHA2568183a0ee3edce1ac7aaaef05bb49bb3b08d972ed2b98dc202233332277fb3364
SHA5129c5a2bc2a5b1222d368bad1829206d1d74ca256198f966a720ef70da8700a9496d942f1fe1bc92f158f8ed71a142644a1477a7937944b436da3a18301887d578
-
Filesize
1KB
MD5ed45fe5cdf7cb397c029c6736643dca7
SHA1ed88a9815c71e7d324bde020672bf6d338d72ddf
SHA2566db67f5c5724b411c894f63554faafa56d572d184705518d021a28d6807e0319
SHA5123796d53bed81e1c1c641c6efd86b6fcec1b3babc7cceae9f4bd8503f7a61b9ba210b14dcd8534f331c634f24a0f3183b357fd4436201ba3a5888e587ec683183
-
Filesize
1KB
MD57e668bbeb220ab683584d294aef07596
SHA193bd8a594bdcbb93e2beffd4c59f3d0d5825f9dc
SHA25659838aa7c11a9aa6c97344fb26eb7fec0a252df123c4ffefe83378400bef1138
SHA51244dd2013dd30c7d71e49882acdc74ce019a78ad5cc2e44b4d07e975908a14b8b18d456a4840b5c019dfda442fed61d3838ab91fd318ef8cad98ff74dfc1cd7c3
-
Filesize
1KB
MD55840b661866c90e8f19c25e01309957a
SHA1520481f8923733eba788e32f272481bdb3e6a5df
SHA2562e9cbdf05649082b1fd0000533d1ae570f21433368b4fc3fcc91cc707afe4840
SHA5125fc7e9f0530c21a28cced3870dba745eb554453fea3db8f28ae5ed38c5dcc15d95bfc7bcaa5eabd68c30a16fd511c9bc7ab6be547f5db472c7d5d832dda4930c
-
Filesize
1KB
MD5297dd23672c4b3282a46bb0af221f201
SHA14d744db7eb0b23a6c5c1bcdf0c5e00abd19377bf
SHA256ddb95a7cc3df3cf45eda108e184460e5d72d4625f70a04a05c3d7f4489af4366
SHA512c5a33ce154a0ad00e2f741ade824da21867c94424cf33c7d154c174c3830e9825d4493c5e360622d3dc1ffe64990c49332e1997d50ab0a079e11cc85fb441b37
-
Filesize
2KB
MD5bcd66ce074860adfd691fa9ec6fa8b0e
SHA1f71194ef771bdbe01961e4e437127e67b33c5170
SHA25678c022d87e3f086403298e095954c54328f0cc3fcc2773da53239c4ec00a6461
SHA51248cb0766759a84f15c522839ae8b522630bbbf37c8bbb7aaea94f3acc4b06e4526961a77e8dc28e22ec8e7615b1cc8e84a343f8c908d0bfd5e1a5e574b55287b
-
Filesize
1KB
MD5b24b02b5e65ddb599a11dd6937240b3d
SHA10c4ba33f48be860a598e25b9f07e5345b2c1c5a1
SHA256564d5875deb4c68da475204dbd8a952ed1a76c8475b030e4363cea80e638b036
SHA512c570f03b1d0c72e48af43ef890a3032656c7baa8a864baaaa04cf93f167d1981940c0d8fd6d0dd6bd80495fe18110dc80eef57b4fa92cda5db7f7613e1cd06f4
-
Filesize
1KB
MD546b8c279750995044f748ef306e158e0
SHA1fb5903c5c1fb0522c1d5f3a5b30249f72dab8570
SHA25695a8d481655332d2ca0db7b8cf856d4b599ed3774bed53d90d34ac253f1b9840
SHA512ebecbc4056d7ba2e3339d93cc01774e84b7feec337e20ca287e247d06d74a5097142c09d786033bb64db79ea2952ef7bd7bd38febe5093d4cf1b953b6969fc57
-
Filesize
1KB
MD5926b80db916cefed34bcb5c427b4dc88
SHA11d6e25fe9396e2afd0959dedc0fc68d60481583a
SHA25673bf4f52ed0a05d5c31ac37e3bd11c7696c39d3077c870fa922f31d6e2e77e2f
SHA51251e32bd26d8bedfc9bf80a827f2cfc9ac4306a6d1ffd21e1d041afdc61b7eca1000a57ac5836eb419bb8e6c6f350dacd5979ba8d57294499264fe9c0255d51ea
-
Filesize
1KB
MD5099a81126c1f14b749eef68bdfd8b54e
SHA131b2cf2e27dea5367e0baa8d01f5732739db77d6
SHA25607997aa36bb941163f48a2ed3be42df2c6cabd9bfeaee1f77cee4f01ef3feace
SHA512bb25b4bf77a5b490b4b83b3664de5ebf039c4b5d6b5641f608b8039edf650213951e5f1734e5e4ec6030daa02582572a4360b2dade54f56d7b622f426f1b567a
-
Filesize
1KB
MD5ec1e3ee59d66b90a546a56db7efd36a6
SHA1c1e99d58db0d0dea4562062ec40766bc15adcb57
SHA256627d3b1a7c5f2eeb67f9d6909fe6c9b9614efc33bf71ab91468c36e149d25ed0
SHA512c13c12c1ad150bc093bbe8434ee915001b074714717eecd50a5ee38388091c33347dc9110da9791ae80a2103870ec5e849b786244f28b6b20c02b07e6a6f19b1
-
Filesize
2KB
MD553ec421ae110d72c21c792ea66571480
SHA1ac09f82142be3a95e23d6a093333d0ac0fe52131
SHA256640fe9aecc5e62c1a30c3227e8eb72e8fe6df3e0182861e4113ad8d804268027
SHA5126e9fb77f5934da2052d071d53ef58a3b3299693dfbb12398004133b218aad5fd781dc369a1cd7329743eb75fc3293f29d60b2be1964ada29562219b8f6cb684c
-
Filesize
1KB
MD5576a165bc8020d023d91f55cd13b3d28
SHA11f0ce0bba1950250958f89d101a1708f9d12714f
SHA256fae111385e1606ad22ee8239788df8d52f78d01067186d6c67f316ff17997bc2
SHA512f9288584e9072e21d1710acc12a8bb45c99e29545051bc78b5f947c316ff79bd7d1f8df1d02e2bd679a74edcea6ce882d11bf7b20a64d154dbb6fd6eb0aa5590
-
Filesize
2KB
MD57d592ab83d27a8d4360aad3b8b30772a
SHA1be3075830aaae99421a9fcd1274a8b079d445809
SHA256f1672f3ace3c1d7f87beb7fdf5d31fcae2e98ac35e8e2565805de6eabddd4698
SHA51297f22a74e47706568277dd72f7ddbc5e79a8046dcb5f2ab88f04d1701a59c3225ce1ebf54c8e15f6ab44590df4076d39ef5817d9cf5066960fd3f4576c9eb86f
-
Filesize
1KB
MD5187b82e5c684a665e3844b8a1c19a7f2
SHA114a294df14adf91c77e3883dea7836cdf0b4e17c
SHA256cf0c65775234d451d8194538b7f258dfe032920f784d29d7fa3cd2e2d703a78d
SHA51208372a1f9440fa9e6e471c75396dcba90dfec3cc17dbcb8562a58210357e2be0cce71fe90b83a759cb7408c6b5eea6569fa9e78458e97d6fff08ab15368cb759
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD5c6c20457dd07a09cc4cece7ec18e47ac
SHA1a62892eda5f7230afa68c7bddfd5f632d2132d48
SHA256f20fc237da685d77196f8c5e8863346184946e892d27eeab65e5c9c030fd1cf7
SHA512e66163763fac1f653de031cd543088a458837266c26dee2e3994bcc2f8f255e90e54a67c035fd67ede9e2928935256897811dca81e28d184d6954190d46379c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_E2B2C48F2C378D0C3347FECCD57676BA
Filesize727B
MD515f46245407241369f0ee530ccb0ca03
SHA1dc55c709c7880b6d3ce84259f46b3fccd162854b
SHA256ef25e2acc61a7b42074fd23d6d3055747b44f849a984ed4ab41dba9e067cca7a
SHA512b6ab64661aaa70acc01ad1d05cb1ce3a24dd618f61a89c43bbe5dc2929650422da126efcfd73a25d3f61cd8504dca2dd74abe903355bad442d920babaaad229e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD578106bca531f87de9426515fd4455d66
SHA14504e47f412e28be2ae7d64d3811783869d1675e
SHA2562033c5f9f0f77fba7ed6001ce4077bcc96438f3f3628dc09deaa6b1c0da5af59
SHA512b2c9b5c39ff6716201d234dfa0714ffe07a767764eaaba6595b4e25cbfd0e04cdc02b89af3d70c88e8fe29fa9397c809ca829cd79e0a9edfe605fc9058c4d233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize430B
MD576d0492d0ddda8a67e07a24a0c0f9985
SHA1364c955f4f9d7fd825fc1ce289f7a3750272059a
SHA2569d24aea483bcc330e475b1020fa9694efee92681a5ba6b14cdf9f635b86c86ad
SHA51285c86b747ad53ec63f70ccec521af5a4ec8cc85f32b96b994b5bf9b7930841c6269f6f41ff33183ded7d7d2309e43508544d31dbb68878f31a80c50b5ce0d1d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_E2B2C48F2C378D0C3347FECCD57676BA
Filesize404B
MD59dcf14ec1de9ee3943bef0f6d4843a6f
SHA19e4d11b9d44da5aeb1da0c1340d67f2618df29ed
SHA256383f770aa3af0b9664b6dd70994e38a41d886ef0f4489a9891e6a2b76769f06c
SHA5124c60f4c668522c4186fc27223c7fb9c0360ff02ed95cee8020818a9f2e15e4b28f854128d9bc6690c83ecf2d78e0b8f3c12cdd4463fb0b8f938c0733589549bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5a11d0724b5492bdac917ef4917b0556b
SHA1896e672d6a93f5c8d682e4e769213533f4184cd4
SHA256a69bc1b04985a06b142eed31f1c7e68132886d7d4f9aae3ef7c48b13f14990d3
SHA512c62a262e14c4de38abf8fd8a1789d574cfa180debcfbbde1a47b1daca8fc2bf83a206fc77c021bffd466ce9a999d6b96fbf5f02310a01f8618e0ce8daacccf9f
-
Filesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
Filesize
1KB
MD5b51ddd4f82159464a8ff2d522fa16e1d
SHA17de8b72be4e13a5c527ccb2d24f36c002442daaa
SHA256852217c17d239df5eb802a27dc2a2548fe47247e9f61ff4d03f8bd5a58368e1c
SHA5121e466f8f020d9b7c7b58ffa720aac79b80a468a8b006aa448e20dee89c032b1e1697569f17e21dd021ab47ed33cea498273d5078e16d9cb03b5bf137f98d0a90
-
Filesize
246B
MD555b746738db2c90e40539e878550bb22
SHA1f3e285533d105603fd5d9f51a8b3005e6945cca0
SHA2563c3a301b52be02a2b5fdeaee19b6030bd450f14c8d18a75b817cd7b8d7cd7254
SHA5125acf1a2b188db7702b11f787a3c34a245a583efdc3d4159a5db8477bdbe94ac2f31b755ec19d624d62414f2b4ac7b08a5405a4be04f5bc15d02ecb6cb93a9d67
-
Filesize
63KB
MD5851796b410ec9d6f57469f902b35ffc2
SHA136debd53b3d9a7732b450c10597c8ed8c8492d26
SHA25617862aa3e9849968032a3b5ff35ae96d55f77c024c8964bb277c073c6ccfc6b5
SHA5126399dd43eec64c7c01b585b21cd8d9f45b6662ff71c3d690ec0ab5523978b0fc8f82825cb04e7dc72eb24d4084ea01457e8f59da8ab7d1a7ca4d196dd057bf32
-
Filesize
2KB
MD57ff974ceddd2170daa5bebc3ae0a23cd
SHA1aeb37c04a88652122f0be90190e1832e06a44c0c
SHA256098e66ad10a8ef6509d61042d67f6d1a43c09762c441e99bf4860abbb2c8da7c
SHA5121820569d52acd8722e53dbe16905c55d9f149c3483ff84c4a5e1a7317120efeabeb77b75bc7828d2878a9697c3312c8a0aa38208a023ebbd2f4584ab8d5acd05
-
Filesize
95KB
MD5fafb9108434c830527a3164a8d4064ef
SHA1aa5dd6bf31eefc7d03d8b82ee14fc8e604df7dc3
SHA25601e67b77de0668d76bd7e3c4b9d3f2dc90f4b44d9c3e070704bbab05b3b768c1
SHA5123a89787320955edfe3a41c3c756da7ee66b85e5cdb40fe2c6ec2936af4931e86458ab57d36fd6559b0631f6fc335d2c1917223b476a2876c9c25969109ff2e3f
-
Filesize
95KB
MD5fafb9108434c830527a3164a8d4064ef
SHA1aa5dd6bf31eefc7d03d8b82ee14fc8e604df7dc3
SHA25601e67b77de0668d76bd7e3c4b9d3f2dc90f4b44d9c3e070704bbab05b3b768c1
SHA5123a89787320955edfe3a41c3c756da7ee66b85e5cdb40fe2c6ec2936af4931e86458ab57d36fd6559b0631f6fc335d2c1917223b476a2876c9c25969109ff2e3f
-
Filesize
924B
MD518308746deb4687417e8685b527e5023
SHA1ecc69c3379ef4b1e0d3935854ec3a232e0b0a784
SHA25635b0d7a454ac65cd980a24500701245a2953aac7875774fc7ae366973b366d4d
SHA512ff73dfb93cd34c9cae1447308a38405f3aeb8a20a60f8e195b4aee6d62f365c100708cc5a24771cdee230d005404a355b5bc23772c9dd7d9d1df66badecbc85d
-
Filesize
73.7MB
MD5419ed743a5a2cf9693246c9d65ba834d
SHA1160973ebd85a33cbb1ad29696a3c8813e120b992
SHA2562cd6f38161d8713f6c874b4142f987b18b84df63e5b6645510427911a033d9d1
SHA512931ea40d5158c8808450e04c519e0811e0fec0e1777e6120bcede658aa937557a7208a495b67f7b3ee62282e94110a398d47084e56d89d6655c1122920626c90
-
Filesize
73.7MB
MD5419ed743a5a2cf9693246c9d65ba834d
SHA1160973ebd85a33cbb1ad29696a3c8813e120b992
SHA2562cd6f38161d8713f6c874b4142f987b18b84df63e5b6645510427911a033d9d1
SHA512931ea40d5158c8808450e04c519e0811e0fec0e1777e6120bcede658aa937557a7208a495b67f7b3ee62282e94110a398d47084e56d89d6655c1122920626c90
-
Filesize
2KB
MD5d971869bb033f2c5fb84594d294d72d1
SHA1aa4b5cf43951dfefbad4adfeaabdc9ca26fdd1c9
SHA2562250c2cc95e4c339864c059e2e6322cc9e710c3da64a6a1cee3ee0972a227147
SHA51276db5c36fac0d2c4618c60bf21c97d03279ed2626373461493cab77e9a4a0eaf622f1d0b350a107ebb4972fd89b473264fc9f03e4e57425c22c1ff50d7b37c4f
-
Filesize
2.8MB
MD54ab9bed90bedaace02bb997063a81a2a
SHA15778d4dbf5bcf1fd52717c4709de6a3bf9e2c127
SHA25678e4bbd109f8fa1a87b91769320650acd17bd09b623e4557fb9832ba1a0702d6
SHA5120463a63dea0b4c81b1f38ca7eb31aad1935e7f1ebcfa7b9878ee62df50e68b2e4695c49a7a2afd14f926ceecd136e90c26a947df8a0c66c669c2f3dd779f9c00
-
Filesize
2.8MB
MD54ab9bed90bedaace02bb997063a81a2a
SHA15778d4dbf5bcf1fd52717c4709de6a3bf9e2c127
SHA25678e4bbd109f8fa1a87b91769320650acd17bd09b623e4557fb9832ba1a0702d6
SHA5120463a63dea0b4c81b1f38ca7eb31aad1935e7f1ebcfa7b9878ee62df50e68b2e4695c49a7a2afd14f926ceecd136e90c26a947df8a0c66c669c2f3dd779f9c00
-
Filesize
2KB
MD51757c2d0841f85052f85d8d3cd03a827
SHA1801b085330505bad85e7a5af69e6d15d962a7c3a
SHA2563cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
SHA5124a12a55aac846f137c18849302e74d34df70ea5aaff78d57fce05b4776bedcde9e1b1032734e29650bcbac3e6932dfef75d97931443446a23e21cf5b3072dd9a
-
Filesize
2KB
MD533b1c68fff898cbf19c44e486c856282
SHA14bcae82469404701498583903ccad307c64e2aa5
SHA256265d280bad44060c22a6caef0140bb8085b994cdd8d76789f3a43a6e7f2a16ea
SHA512e8ee2691c3b5c6542873e804f6ba7b13b9230de0bd28944a18bc25c529afe1a11d452988387aa3edddfd2bf65b02e293e549415b0a6a961285d50b3cd2d46a7f
-
Filesize
20KB
MD51ce4eb3e5153f4c9b93a3cfdf3ef2e77
SHA103b04e1e31c9c355e7caf71ba0ecb12e741d9aea
SHA25695f4c300d84eedd0c43a30a1b6f0dfbbf7b8c47725511981e4cfe12dfaeb0e93
SHA51275b272ef0d474be75aa19226a60a9c6d0370cfbd40276a274460391dbbe0350c17849aa21f375e46bacb7cf7cb3052be5862569f5a196e15b8ca49baa82436a8
-
Filesize
14KB
MD54b618927fabd5bfea9cf228c9e3f4428
SHA17dbd0ebee22f43e831bfdd6f523d64e4fa3b3bac
SHA256a768c604ae9ef96d0f26d8e6c46b0c24515ada8945c9bd8a86b8173eea730653
SHA5127bacb6b475317b1b576f7be9f88838896a66b134dd8ede5f33c03b30b8f028c2f221e4c424fe94ed97a1d580cfc5894a4e60c3db48a9548b53ecd264803b423f
-
Filesize
711KB
MD563ed3f09dc01f121b261b681eb77551e
SHA14144be490d7045d37b05cec2b547385f04c35bb9
SHA2568627777c53a31448c9e61705478b77edbaa2dcfd55ef930eb33f840bac014781
SHA512353ef7b301b5b2170f02a7438ce231b231304ec528ecd3687ff5bad41ff19d1efbc93e3736d86eb72b8c274f2f4936639e767c116266c0e850a167b680bcecef
-
Filesize
16KB
MD5c9f970b77486b6c60f583de55b82ebb2
SHA1ac80263df2a6706ceef401b55b0e3f35d14985a7
SHA256dd727b90f3c6b053fa5b4c8401440e5d120dac6b93305573caaefecedc5f0c5e
SHA512b33b7cabbce1469c41a2f5ddaea7c3ced9d4d0239edabbd37931d53ddfe7c50d5a9bba101b702d8367ecdfa4df6bdd6bb614d8cf6c639e3239cef69a8d434942
-
Filesize
124KB
MD559068c9a357b259a32c5acf1eae1b6ca
SHA1cc30ade1b55ca43070ddce5cc9d613bfb28a1115
SHA256ea52a6f973100cbdd3217a609ef3737dae42597dd112165fc8a0c42fbd37a517
SHA5123c57bb3494757aa9badbd77f3e5f84f680104bea9778dc8e0875ae18eac0595d8da5aea13643a81ba154633afc25412a2e12f843858d978f8233380c25fdce9f
-
Filesize
205KB
MD579f3461a48f669ef914eefbd83925820
SHA1ef791b21f2de9a9b80f4bd9523b037b6432f41dc
SHA256a9b420a106adb6b09e5dd39a864dd00519aade91ce6f500c179e9e6652b0fc51
SHA51220cdb62ae15343f82081629df3e92f0fbb9dd61d793a1d1f73d9a37fd1c0c6265d574372d25de2857c279b5097858598cc6494ca272106fa67664479152b17f1
-
Filesize
5KB
MD59f74dffb0fea380b891a7b1596109a22
SHA1256c884dae9a58ecb5ec7525721a78321f75547d
SHA256ec9d030b3f64cedc4645f8efea56baff55f1b13dfb0db6eececdb9612676f893
SHA5128defba25f67895fd2481bce885a9cd8318f0a0d3f95082758c2907c1ca75f93d78a541c0105ce018cc457570cc63e0cb8691fabaf10222482b430179cbd4f37c
-
Filesize
45KB
MD58327a3e34961e36c0e7d5834add0a104
SHA1762c9d75863e9432803a6f9871357d279a3cc1bf
SHA2569d1483d12009e62d2e7259cfc4e2674d1a16a47fac1b819017d1d2d2abd9ee6c
SHA512dfddafcf86ae1e537a995ea29d3ff1ff99975c6426c8fd5dd747bd7411865f14adeeeb61fa0b75e1ef63050b513368110b9c9891eed0afe3510d00c8ed76fca4
-
Filesize
36B
MD5140918feded87fe0a5563a4080071258
SHA19a45488c130eba3a9279393d27d4a81080d9b96a
SHA25625df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
SHA51256f5771db6f0f750ae60a1bb04e187a75fbee1210e1381831dcc2d9d0d4669ef4e58858945c1d5935e1f2d2f2e02fe4d2f08dd2ab27a14be10280b2dd4d8a7c6
-
Filesize
93KB
MD55790ead7ad3ba27397aedfa3d263b867
SHA18130544c215fe5d1ec081d83461bf4a711e74882
SHA2562ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
SHA512781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a
-
Filesize
12KB
MD597753710dc6fc2f47616d0578e991eb5
SHA1b28a9c0b217aefd5c43ac26cd1d2a45a44184f15
SHA2562e5f9b159be16a83d09c1dc654c73737e10d2a6f8372b51be480b1ba42b7273c
SHA512ed9aff4ed084eafa0fcaf213f10e5ba2a57b1b18eed4410d6c1a714e6f02b1dc0e94ea5cb45ee70f4556d8a9196a8f606b1e058821ac1673acdcffda18161465
-
Filesize
5KB
MD534f8eb4ea7d667d961dccfa7cfd8d194
SHA180ca002efed52a92daeed1477f40c437a6541a07
SHA25630c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
SHA512b773b49c0bbd904f9f87b0b488ed38c23fc64b0bdd51ab78375a444ea656d929b3976808e715a62962503b0d579d791f9a21c45a53038ed7ae8263bd63bc0d50
-
Filesize
2KB
MD5f90f74ad5b513b0c863f2a5d1c381c0b
SHA17ef91f2c0a7383bd4e76fd38c8dd2467abb41db7
SHA256df2f68a1db705dc49b25faf1c04d69e84e214142389898110f6abb821a980dcc
SHA5124e95032c4d3dbd5c5531d96a0e4c4688c4205255566a775679c5187422762a17cbca3e4b0068918dbf5e9bf148fc8594f8b747930e0634d10cc710bea9e6ff5d
-
Filesize
580B
MD52737fd95a9352c89430915a7e8be7cbe
SHA1238918829ae79d506f50264549147756081d82b5
SHA256d7d8da3dc29649e10c235dd1b1c49069707d74f1c6c0ec542c54fa50cb007f6b
SHA512a3afc66bc7f32e669f5cdf61934cefb91ac269620aa73d7f08cb7446a051b01de54ee0d483bc96896585103a377f1e11680184fab280b1139dfb02fcbd2d43e4
-
Filesize
34KB
MD5d450a4f8c85c8bc04329c1290f7d040c
SHA1850b598bc3ac3ff47629fbb2d0bd2c793edcacba
SHA25605ceacef18474cb3a939efb608e14483f386f97a8178f9ebfcf49850e61370d7
SHA5128e2aff86412a4eda4d4b95fc338e4c6ad0142ca95ca8d55f3fb7b91ab31feecaeb2f6301be1301bbcbe9edf239e400470601467ad8c7c23cc2db0e0a11b5fb2c
-
Filesize
1KB
MD5d6c9af2359b6d2b70f5952362d97d8c5
SHA1bad5a4f26a1c3e03d7aed0b1a2302f6976968936
SHA2562a1591b93cd0b7c8795b04aa47404c4a1c0b8857e7adfdaa2590aada61133802
SHA5120653839d20ca7baa94af04bcf09289cfb480c0e2b5202060e9d966fa6a79f0d618ec22ad75cd76b97df4cd939e27357b1aeb9527453180c100dc43282bcc6ed2
-
Filesize
2KB
MD59866262066431a37850ee51677473bc3
SHA190fdfe4f61294ef4cc9dd0d25ae482b6ebe5784d
SHA25641700cceb0226f9198b1e09be78e0a2942cfcb71529f679cca390f7385502a2c
SHA5129b5a991f06490bae36cce22c01c56357ff71cfedebb1e8b6910eabb0671bafca54bf5040a0c56d138e4e5f752f012b918f5b0cb594fb4e9bfa68fc97dc4d5229
-
Filesize
3KB
MD5c6439dbc2eb9d5b026ba205932958cbf
SHA12ddb7e7e09260a9138f4e282985a8f26ba7b7a09
SHA256934c949b9369958c7c2fb293283fce40f08dafd63841f7ca46d7e46c552e9c03
SHA512c5fd1cd91a0d19e95b56ed06f625923176faddfbf91c668e76755420da3691f18fa3ee38190908066b6b55da54543ca9ba53b53a199e1b7e9e38a016c24ee185
-
Filesize
267B
MD54ae15c449669ebcb864ed45637c3e3cb
SHA1467a81a8e3f044a5b7f7369ed63c430d83a84b48
SHA2567b19373f0e1b5bfc2499da6c4e0d8584b0371ead066f09aa5df132528334deaf
SHA5128ea665748bc574b162ada5f3f535969ba286ff18b49c3414f95f84621c92ab4ee8ae5c27598138acd5429bdbba9f85af45b46b89e66546cd312f00bc2999f9b8
-
Filesize
2KB
MD57b278f2ca126e16376800d6b5dd947b6
SHA1c86c7b8d46dccd49688489a748535226526c63fe
SHA256ca8c664cbb210ebd14e92853ec9f6067512744158c795cc4dd510e99fb32e036
SHA512114fd77749d08cb28241743054bc06fa36cc3189c10e789c0f960a08e29600fa7c3253928dc111da8684b4d3f4142722a082ff1efd4b2ab884290c7c774de79a
-
Filesize
1KB
MD5c52f9696d2dbb145633a7ed1eadeb083
SHA1a04c1b23882af287d1f53331ab8e493982ab58bc
SHA256dccd51191cd0c6a31e5692944b394f8f2c6596d4dd44982a362db26342d373d5
SHA512c82bb2559dccf7c6795987e1bf400745433bf183f70be0efa71a68d3592a7feaa97d768e988eeb6d69df2879667f9afc2b0b498c7593a59558c1c465182f9b76
-
Filesize
1KB
MD540d07e37e26ee54a57b18c70c3e63d04
SHA1847ff3c3fdb4188feb1cb86034086543831bf75d
SHA256f234498755b699a077ef73c1c82973d39078818bfb7f68c35f2ed0202807cfe8
SHA512dec4c2327da5323b24914dcf8211b7a9d31524e57f10898401005449aab8dc67f28f160e94b8fcac4c0640a24b24233684048f19a81c513e376ed430be28b7f4
-
Filesize
3KB
MD55bf37181edaf9d4051264105a0bc593f
SHA17590c29aac79246969416a102f4926a4f06f117b
SHA256c4d316dc0b7988a7e4bfd8dfa9f69670132a4fb3918ebe38306f75c6c63b93d9
SHA512dd3ddd878f2e46f0c5fa50c56fc6d9fd0f179eafc17ba40b405fec0c899d8cbf0d9a80f15a8f0da02234d3e2eddee6df2bb03d061dc7113c39888fba012b1dcf
-
Filesize
11KB
MD53f40b2af35b435425b58271dc800351e
SHA1989ece231ec4e0b2dfb3f5297b4bbd2f5ef7f7b5
SHA256b9695fcfb5fbe953ed0bece14a8d5dedf6e5dba2cd76cfd533494c536bfcf9b2
SHA512af30ad451022d2f55f881f877d7ae4fe0ca1e713563144f731ba1823d6e18ee515ba35849d80f2c8fc79b56e2a7cebb9301ae6b83ad52b111138a599a581585c
-
Filesize
587B
MD5a8a9d7cdc3428c8bc26111f7be3695c2
SHA1c219378f4e828025717c76c335e3ef1c5702ae60
SHA256f1c05ddb3ba731f2587f01c978168c76297880896a262eee77575fc5ff72a951
SHA5125f88d31b11b5a0f880e0199680e1b1a29aa0b6e954940c35140148eed439fb5dfe46565f20c2184460ff5f814c6cf38ef1f48b4258be829e45137b9092d48f06
-
Filesize
2KB
MD541bfaedb192bee87c1c56891bcc82365
SHA1e8cca3e6ae94580c8c2c2e7759e7952874cd8cf1
SHA2563005b43a1147d9dc34acf39e5f925ab2350de83615bc5c71586de5bff088d57e
SHA5122ee621a7df355f2414b233106d397ca844db4334ddb4253d31a3102512a0fd66bfa3e981039ee2311686e4e075343959c1e6459a19ab271b6150421b40f27ce4
-
Filesize
1KB
MD593ac28d1917ae519f743568f96012230
SHA1256ec8cb4954f536aac06fe9a675f34f57b6961a
SHA25637d603cc938999d6d057008e587b62d4b20d92c87eda816ed7176cba4500326d
SHA51224c12698432285a898ae2ca32720c463c953c604c6019ce11d561eb61e7c5e05fc2954179f81c097d24ae9ee63abce929bd5098e76fc5019fc4f6c6ea8f26c05
-
Filesize
506B
MD57e20d80564b5d02568a8c9f00868b863
SHA115391f96e1b003f3c790a460965ebce9fce40b8a
SHA256cba5152c525188a27394b48761362a9e119ef3d79761358a1e42c879c2fe08cc
SHA51274d333f518cabb97a84aab98fbc72da9ce07dd74d8aab877e749815c17c1b836db63061b7ac5928dc0bb3ffd54f9a1d14b8be7ed3a1ba7b86ee1776f82ba78e7
-
Filesize
2KB
MD5b23411777957312ec2a28cf8da6bcb4a
SHA16dd3bdf8be0abb5cb8bf63a35de95c8304f5e7c7
SHA2564d0bdf44125e8be91eecaba44c9b965be9b0d2cb8897f3f35e94f2a74912f074
SHA512e520b4096949a6d7648c197a57f8ce5462adb2cc260ccac712e5b939e7d259f1eee0dfc782959f3ea689befce99cddf38b56a2cc140566870b045114e9b240dc
-
Filesize
2KB
MD550c3c85a9b0a5a57c534c48763f9d17e
SHA10455f60e056146082fd36d4aafe24fdbb61e2611
SHA2560135163476d0eb025e0b26e9d6b673730b76b61d3fd7c8ffcd064fc2c0c0682a
SHA51201fb800963516fd5b9f59a73e397f80daba1065c3d7186891523162b08559e93abf936f154fc84191bbadec0fa947d54b5b74c6981cebc987c8e90f83ddf22c4
-
Filesize
11KB
MD55d678c703857fc2c298e25ade4c90f54
SHA11eb392b5fa61c835ee32e8b9c6d89c6ff37bdfce
SHA256b6f888c26b19fb28a0a9ad35eaac763d53e888c600d3811c9c06042bee8c4c6f
SHA51284b5bc8e64591e737f2aec815badfa9c1a47622ed4c6dfdf794eede481d33d0d874ad13e93c9d205e302054859175c6753bab9360f630b3856222dcdb74592c0
-
Filesize
2KB
MD507a983653f6ff14da5a355eda093ea6b
SHA160aefe57052cd14cbaa28f22bc18a7a6933503d3
SHA256a3dead0aa2b886493733f48ada2c20aa3185fadd9d696104b1e3d6c21c37d433
SHA5126b8079913ccb26b003c620889d33059beff45dec6ca8ab5617457716db4b2cbcc21effb403c1bbab72db0e9bbe32bd41274b6d486fdac8016d7303555b259892
-
Filesize
2KB
MD5bcc519c4b8ef7e26aa39681687ffcb7f
SHA1c59c36dc00e283553e45efdab2eecbb9b5d830db
SHA256308d7eb472a0af7f045ef22ca108c7ac7eba002ca4b9d31cc0a0854afbeb7542
SHA512852e01ba2629d2093b37e93b5b0b75123cae153d45c349ad2f67867aec77b2886199ab6c32415f41a80409bb4619c0c11d020b884cc780ee8d1651cf55ebdcc0
-
Filesize
9KB
MD5fda79e06c6495f84d59e1a26449336b7
SHA19882828ef3f934e059d602d120317547b5e975ed
SHA256fb50127f5669e8f32762b734267487c3fe572c598afebe7a948921e60281e7c2
SHA51274c65d17ce61ddf8901c84f2df07d935c1bc9ff8302cfc42cd660a0e0261027fa182f21e12b2bf64700c512c2a9706a91f0653eb999572d22fef1ad2ce53385e
-
Filesize
24KB
MD5a2505d86ebe81870a2c3f1dbb4c0d9eb
SHA19320f645efddf913b8688a7ff88264491477475f
SHA25681dd8fa15e46a7d9414ed9b901b693245f9d51f2e72e6a6d459eebdf0c69c810
SHA512dbdbbc09326befd29434d263d0db6e7894d086d04dc068d00b5afd0235d8ff4243572c7732125c60ff87b331ea79a880a77b229c378d5dc493721ca6ffbf2bb6
-
Filesize
1KB
MD5b9008278d01d092b1fce29b715fdeaf1
SHA169e97d4ec45b4d1f592b6a365e26b04d64896fa2
SHA256864f2c8299c0a32f848648d6197fccd0f466a2a00a9865846f722ad0a0907bad
SHA5120746a243948e1f83684fee038aed771a7426fee0e0da0df09831ec9b3c76d3d3a9c4f816f36e3012390b4830d34785e9f2dc05e5c849424d9d29e1d5bf5ef88d
-
Filesize
1KB
MD5d5fd32e38c31d98253c130a07bdb4cab
SHA10f0af164e39507649d4c0662725a03096e209b6a
SHA256b5972b205d5f0be43feca6e1d7bb8895fc897d5ca516b7fbc1f3bd1d29aa2d6c
SHA5129a98773b3ac55606fafbc0bf6ede82420d599aa387ef46cd3490e7b79035f2b4d3581142e97be0ef25b685d66bfee8e7cf65fabc89b53578b7ae70eb8d4306db
-
Filesize
1KB
MD528c387319b1a2b7552422883b5e89596
SHA14f015751da9a1dda8d4993811b11b506923c9b38
SHA256e1668b0b904f0489c70dbff487cf8d939eaaffea309dae2c5279eb58b381e6e1
SHA51260241c2aa95c569f3a891deb42c7a8faa9739fadee293717d444567bf1a30c8bee7b9dcd029a9fcf0a328b3c7b0395d005093780d7ca4b5d6ce919c29af0de04
-
Filesize
1KB
MD5400d2c4091ff01079f2105127f63a3c3
SHA1bc7f74e81b39ae45be7217e2f0d1c3e131d15ea0
SHA25699553a4faff677807534743cbc301a0e4c0411b40f96669ed5dcac424888eae9
SHA512a963319051fee945b0fa22bdf95352d4cc05dbcdd54618d4455f9575935162983b62a58666476a60fbabc9e021c1cc032119c5f952beef4afa40f19fdc424420
-
Filesize
1KB
MD5850c104834d97b59b8c29e4d407d99ce
SHA12464aee0f4c3b0153a119c52a1012c946b4629d0
SHA256e10886a45ba056d0112d2360f46ad67a7daeacb76e82320e53bdf8500d041e35
SHA5121210099e35081639b58ab9201c0acf656131a485a811a04016057d1b59f8a82891be178e189aead9c5a5609542ccf043d4e86546e18b90b0839b04c79e1875d3
-
Filesize
1KB
MD53fe321a5da4e6bddaf36ceb3a801c05c
SHA1e456cef804c846ff27b037876d5b6cb1faded14e
SHA25634d4050a74df94b476087b83813bf7d701dcb024e0cbcc3445f8914267e046eb
SHA512a3be2717a9f9aa6025e124d580dfabb1a85e6fdeffdbca142753f07ea379a175690306b8d4baf6ea77df2b901ce59a6da582180eecebcb3c0f00c49bf6375e1d
-
Filesize
1KB
MD549552c051889755b5fbffd84755abeaf
SHA129867cb69a5f4918b2c35225e683af70115dac92
SHA2561ad2b407671285ebf7a737d8cd2cb6c48876414f9a0292c2f0e8678e2574da14
SHA512e47683f5b4769becd922485eb6fb9026ff56dfd351d7294269f36718d6e816535551d27a8240131725de75a716c49ae8e023771941682f779c2742f5bddc8dcc
-
Filesize
1KB
MD5877845a1c2479cf899e8847b53dbc3da
SHA19b5f20c13b460e26ebccb60fe5b063229b8d8b3e
SHA256e4ec099f69a18dc2ca9f6d874bbcbd4fdbbb06ab4dd53962873f504e761d07d9
SHA512700ae73b529e9cf6cee4e10870927060441fb1b039473fda2d314dbe83998f2d7d80d86ef54dbc8f6653020b452cdb5f60b0f3ea95d5eaced36fc5d087d63e4f
-
Filesize
1KB
MD5974b77ec07af05a08c6e044fd6100020
SHA1c140aa1e4be9033016931895859eb5cd9e3e04fe
SHA25626ed5157efc4e80a883917e63b38493713765618ecce6c15b155ba826bad9234
SHA5122bf72a66c76299ecd891e023c97d8daeec42de0b5da948a140059173fd54a843cec91df48b37a39e6bdcbee822ed29e08c4a0dd7ab2d4a00554a367eebd897cf
-
Filesize
1KB
MD5ba19a1245c7997bbe70cac5725ab9dc3
SHA1cc848d0e7c0e8b58df1e5a8c64a2964ed32c92ae
SHA25641f0fcc65301fa448e9f567ab872f284db77f4e2bafdef6a3c64d694c03f1f6b
SHA5121a96bf2ede28c94cc3e3e36ff4e131568582c64f1e5db38190fd1b7d0f45f5598e307124e9b79a92343a0c57010433ab17f1ed0ca1bcf452f263b34af75670b7
-
Filesize
1KB
MD5b8267635a1abb2330dd966d57fb07490
SHA1a1f6b4388ef814a7ef4b1224652f8cbf87081007
SHA25699cbe008878b5e5b357e0fcdd6ead2602c5517a45a6236e4305e88a97b1f8100
SHA5120e56b605222affc1275e7268803693fd24800c5ee6ef5b5d08e4c58a5f929d0541d2c2e2a7fb1fc495279c13ea373d507bcfd91d6774dd3f6e2b74bb989a3bdd
-
Filesize
1KB
MD52ac467882d165b6a87c6fedf33325eea
SHA1b0a4e9bb8afbe657bb9cc353ddd0de64ab022a74
SHA256becd6dc4748fa6abbb338715b698fd6ed4b4d552be6c25295dd7dba46eaae15c
SHA51265f0e728c8991d5ac373460d66ad3b5277a35c333cfd424a2d19c1b4d729021d3482565100de596d49875dc21f96e928962ff1ed2321da7b446d570f37c3f073
-
Filesize
1KB
MD589d25b9bce2c912b4aa17155de3a0136
SHA11ab2b0d6510ec756418a9eed30e2110327e06739
SHA2565946ad161ab6b204ffa1c82f4a45d9ccbffbd878ddfe7e4624d5ba5bec64aaa7
SHA512fb3f4aaa3129096bb5265f5fe73dcf45baaa705a1a0fd64ac086b84bbf23442bd3f8cc8af89debc78fc74b2b9069b9133b0e77ea144402a7fcfa133a0db51093
-
Filesize
1KB
MD5d12aa3ec325a827148116ddcb43f178b
SHA12f37b7cc60afe9e52539989040d13ecad220a963
SHA256b05f6df8857428f62e70632bfda70212a0e23802dc9e241456d26bc4d71a5aa1
SHA5127e258cb1f6a2a965b5803af8cc0b384d9520a70212a5d0a52c9ad61d0096d6d008736cd727b5a3971b4bcb1f1ab17d7a9a367ae6ff36fd2f3d49b5f7baebe8c5
-
Filesize
1KB
MD5412061a62dffffa227d17995f61a5e69
SHA14f72d87c12b04f6e0934701ad0533e007fdac54f
SHA2564dde829e89c9efefd6c46cdff27c22e20ccb6d65e0107973eb670adf3c07ef27
SHA512afdb1c9cdb4346cbd2a99d98a5d81c8e122cc858e928e84e295edebc89d0c86e483af0e027dbbf02cdae271fff69e9b0802def1e8da0b936ae5f261f2573a58c
-
Filesize
1KB
MD5b8fc7d78f52de09a00ee852363657b7c
SHA115d3d66a8b593fd682c28efddcc999fc006b87e4
SHA256b828935568774b2c5277330af49762e945abde5f914c99f5489d359a28ef3745
SHA512fdce8157e430181b610443f58cf6e65901a4c5dcf7c6bdf5eabdbb435bdc51f7249c0cefd37eb135d33b7921c89349cd0e82a808a8b33ed161484eaf6417078f
-
Filesize
153KB
MD5a1b7850763af9593b66ee459a081bddf
SHA16e45955fae2b2494902a1b55a3873e542f0f5ce4
SHA25641b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af
SHA512a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1
-
Filesize
153KB
MD5a1b7850763af9593b66ee459a081bddf
SHA16e45955fae2b2494902a1b55a3873e542f0f5ce4
SHA25641b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af
SHA512a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
134KB
MD5b4b6a751b305e4acaca17d668c690a3d
SHA186d67ba22f9d5fc76d26cc1ab2811b2bcd076cb6
SHA256567279560b7f79a627c161cb0834d41f847ebc839f5f1a1d5b746a7fb26529c3
SHA51251837ae406acbea34628d818468d1bd107684bbb07dda0cd07c515d170e329ef85d7dbed1f7f939ea065211e4559aad1747b82352c92aebf15386b03b40c88f5
-
Filesize
134KB
MD5b4b6a751b305e4acaca17d668c690a3d
SHA186d67ba22f9d5fc76d26cc1ab2811b2bcd076cb6
SHA256567279560b7f79a627c161cb0834d41f847ebc839f5f1a1d5b746a7fb26529c3
SHA51251837ae406acbea34628d818468d1bd107684bbb07dda0cd07c515d170e329ef85d7dbed1f7f939ea065211e4559aad1747b82352c92aebf15386b03b40c88f5
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
498KB
MD5a766cb532a12aca342b1eee53e5da4d9
SHA14dc95fa0ecd63cdea2379124bb07d233107219b2
SHA2566cfcc09e9984d4e572ee7b27db40acf49267f986c4df5b3f2a4a35ce0e9a3ae2
SHA512d810ab9cfb5c24be8858d82a4d1c55eb9611a8641f65a8a19243513522343cbdef74be3395a7ef868634b868e655ad27222f1fea84e50367c35da77903695b0b
-
Filesize
56KB
MD5dc4eb1155c5524f69a8d5c2412d2aa86
SHA13cbff9f26c40ee4573199f2a0aec32e28f6caca6
SHA2568e5d8af50657d1458dc967defe41f053847e02a6f4be85f4c83dd75b97680129
SHA5121c727e575125efc3bdffc71ab9af10e3e07547570b6c08c65c9b4b5c4dfcf7414c196704fa44a5a519cbc684a87f4138753f5b86279cbf6320105066c0bc68a9
-
Filesize
324KB
MD579c9aea216cba871731c0d457bd4357c
SHA125c3791464c75682d7613bec97bff594e2598c0b
SHA256fd2b3b769b765798310df01a45f629dc6d53d47ed5f8120745a13eafa8514307
SHA512ce250f611247b307018766602a7e86330d838d7dd91f326f50e8fead3ef25695a7382f1dc34583bcb07b665047159a5c76db095be31637c2ceb00c2b47528b8b
-
Filesize
324KB
MD56c96e8a9e5b7281c8dbb72f71165e35a
SHA1a9a3590eb24c273b3de392bd9176fc2879ef8dfc
SHA2567b948c7a3f284788247c298556d66bb21325081df2172050eec71db762c657fc
SHA5129ad31da1b32f7b3c204aca8f4b171d25d2547050f8537b39b009e369ca8bdf24af3477d166f6fd48a098947ba14331a95dd8448cbcf24918222daf486645625e
-
Filesize
332KB
MD5948d14a5253cf62239e7230b891bad05
SHA10904f51284dfd726ae581367380cee3182c8135a
SHA256530d31764e9cd8224697b9f74998bef68643a1eb4f69589d80facae324fbd375
SHA51216a0738f28c9c9f435efb8df13667ed314af884b5bd04e14fbfef82215a169e5b84324fa6145e73aefd91bdd112afaa9e8e07febbafba99bd139f69e04c28809
-
Filesize
324KB
MD555be933a556a7b134ee9ec6e1c74b4e9
SHA13e56d8f9c32d7b43f21ece39b608bd7a231aa030
SHA256a09a9786456462bccee15bf7e21f4a3ad5ba2253a3667aca49b277aac924e1f0
SHA5124bba78ef88441eef0422e6688150ff83dff73cdfed349261caceb0e66e52fbc0a62e2026e1eec9d22af9a6eb61220586d5d6a66276d860d412b990161019351b
-
Filesize
140KB
MD599737c363f249a131c9fd6f26f8547a9
SHA11bd61fe8c7129bd020802119b735b253d43b976b
SHA2564c53248fd801d697a3efea4d7b9175c2a74719680c4612cc70c994ed9d2c7aa9
SHA5123c7541d18240802bc5ec7137d96148f3555555ccfac42eb08be6758c097b1f3d0927f8c93354674394618cba1aea9f9aa906a7e5fb0dcb589a7cf830258d3003