Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
06/10/2023, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe
Resource
win10-20230915-en
General
-
Target
7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe
-
Size
268KB
-
MD5
772195f8d1e186997a72f37b0033b233
-
SHA1
0617e0d27b374150e3c3550d423acfbffda629f1
-
SHA256
7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9
-
SHA512
f846bf0de8d625c9a9a06b162bca123d920d5569c093a5aa696b2d2f765845fbeefc6b77dc418102fa569bbddc1a1b37c43f8f67147ae55096cdb701cad5fcfa
-
SSDEEP
6144:jmvQXFz5kyocx5/X/3SPl5MAOQyIhSJI06:jmvizWyoWzeXS76
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
frant
77.91.124.55:19071
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
amadey
3.83
http://5.42.65.80/8bmeVwqx/index.php
-
install_dir
207aa4515d
-
install_file
oneetx.exe
-
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4
Extracted
redline
@ytlogsbot
176.123.4.46:33783
Extracted
mystic
http://5.42.92.211/loghub/master
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Mystic stealer payload 8 IoCs
resource yara_rule behavioral1/memory/3104-50-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/3104-53-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/3104-54-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/3104-56-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/4220-68-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/4220-69-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/4220-70-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/4220-84-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001b005-115.dat healer behavioral1/files/0x000700000001b005-114.dat healer behavioral1/memory/3320-116-0x0000000000B00000-0x0000000000B0A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" F541.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" F541.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" F541.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" F541.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" F541.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
resource yara_rule behavioral1/memory/4500-118-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/3736-163-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/3004-164-0x00000000010B0000-0x000000000129A000-memory.dmp family_redline behavioral1/memory/3004-176-0x00000000010B0000-0x000000000129A000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 18 IoCs
pid Process 5100 E7C0.exe 1332 pb2Pk7LF.exe 4072 JP1JU5QT.exe 4472 jF5nI4Cy.exe 4600 xF3jq4bP.exe 4164 1GG11Kk2.exe 4648 EEF5.exe 4680 F475.exe 3320 F541.exe 2312 F811.exe 5060 explothe.exe 3692 F9F6.exe 2856 oneetx.exe 3004 50.exe 5392 explothe.exe 5412 oneetx.exe 5160 explothe.exe 5176 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3336 rundll32.exe -
Uses the VBS compiler for execution 1 TTPs
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" F541.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" pb2Pk7LF.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" JP1JU5QT.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" jF5nI4Cy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" xF3jq4bP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" E7C0.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4592 set thread context of 3260 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 73 PID 4164 set thread context of 3104 4164 1GG11Kk2.exe 84 PID 4648 set thread context of 4220 4648 EEF5.exe 92 PID 4680 set thread context of 4500 4680 F475.exe 102 PID 3004 set thread context of 3736 3004 50.exe 125 -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 2864 4592 WerFault.exe 69 4212 4164 WerFault.exe 81 60 3104 WerFault.exe 84 4700 4648 WerFault.exe 87 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3136 schtasks.exe 1204 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 59a59f669ef8d901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000292aa5554904e55cf3b172cb02f5d12ab947cb238dfb096b1edc7d58624682f991e384811278bd729d760264642d3c88f5065c2dae4f8ad174f1 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 875b0f529ef8d901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen Process not Found Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3260 AppLaunch.exe 3260 AppLaunch.exe 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found 3280 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3280 Process not Found -
Suspicious behavior: MapViewOfSection 11 IoCs
pid Process 3260 AppLaunch.exe 1120 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeDebugPrivilege 3320 F541.exe Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found Token: SeCreatePagefilePrivilege 3280 Process not Found Token: SeShutdownPrivilege 3280 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3692 F9F6.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4368 MicrosoftEdge.exe 1120 MicrosoftEdgeCP.exe 2860 MicrosoftEdgeCP.exe 1120 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4592 wrote to memory of 3096 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 71 PID 4592 wrote to memory of 3096 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 71 PID 4592 wrote to memory of 3096 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 71 PID 4592 wrote to memory of 4160 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 72 PID 4592 wrote to memory of 4160 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 72 PID 4592 wrote to memory of 4160 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 72 PID 4592 wrote to memory of 3260 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 73 PID 4592 wrote to memory of 3260 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 73 PID 4592 wrote to memory of 3260 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 73 PID 4592 wrote to memory of 3260 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 73 PID 4592 wrote to memory of 3260 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 73 PID 4592 wrote to memory of 3260 4592 7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe 73 PID 3280 wrote to memory of 5100 3280 Process not Found 76 PID 3280 wrote to memory of 5100 3280 Process not Found 76 PID 3280 wrote to memory of 5100 3280 Process not Found 76 PID 5100 wrote to memory of 1332 5100 E7C0.exe 77 PID 5100 wrote to memory of 1332 5100 E7C0.exe 77 PID 5100 wrote to memory of 1332 5100 E7C0.exe 77 PID 1332 wrote to memory of 4072 1332 pb2Pk7LF.exe 78 PID 1332 wrote to memory of 4072 1332 pb2Pk7LF.exe 78 PID 1332 wrote to memory of 4072 1332 pb2Pk7LF.exe 78 PID 4072 wrote to memory of 4472 4072 JP1JU5QT.exe 79 PID 4072 wrote to memory of 4472 4072 JP1JU5QT.exe 79 PID 4072 wrote to memory of 4472 4072 JP1JU5QT.exe 79 PID 4472 wrote to memory of 4600 4472 jF5nI4Cy.exe 80 PID 4472 wrote to memory of 4600 4472 jF5nI4Cy.exe 80 PID 4472 wrote to memory of 4600 4472 jF5nI4Cy.exe 80 PID 4600 wrote to memory of 4164 4600 xF3jq4bP.exe 81 PID 4600 wrote to memory of 4164 4600 xF3jq4bP.exe 81 PID 4600 wrote to memory of 4164 4600 xF3jq4bP.exe 81 PID 4164 wrote to memory of 5008 4164 1GG11Kk2.exe 83 PID 4164 wrote to memory of 5008 4164 1GG11Kk2.exe 83 PID 4164 wrote to memory of 5008 4164 1GG11Kk2.exe 83 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 4164 wrote to memory of 3104 4164 1GG11Kk2.exe 84 PID 3280 wrote to memory of 4648 3280 Process not Found 87 PID 3280 wrote to memory of 4648 3280 Process not Found 87 PID 3280 wrote to memory of 4648 3280 Process not Found 87 PID 3280 wrote to memory of 240 3280 Process not Found 89 PID 3280 wrote to memory of 240 3280 Process not Found 89 PID 4648 wrote to memory of 5052 4648 EEF5.exe 91 PID 4648 wrote to memory of 5052 4648 EEF5.exe 91 PID 4648 wrote to memory of 5052 4648 EEF5.exe 91 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 4648 wrote to memory of 4220 4648 EEF5.exe 92 PID 3280 wrote to memory of 4680 3280 Process not Found 96 PID 3280 wrote to memory of 4680 3280 Process not Found 96 PID 3280 wrote to memory of 4680 3280 Process not Found 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe"C:\Users\Admin\AppData\Local\Temp\7983e69c8eeb7b2c9e8e1ede06f19dccd369370ca28bd6b0c31ac390f18bdab9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:3096
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:4160
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 3642⤵
- Program crash
PID:2864
-
-
C:\Users\Admin\AppData\Local\Temp\E7C0.exeC:\Users\Admin\AppData\Local\Temp\E7C0.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pb2Pk7LF.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pb2Pk7LF.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\JP1JU5QT.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\JP1JU5QT.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jF5nI4Cy.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jF5nI4Cy.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xF3jq4bP.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xF3jq4bP.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1GG11Kk2.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1GG11Kk2.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:5008
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 5688⤵
- Program crash
PID:60
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1287⤵
- Program crash
PID:4212
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EEF5.exeC:\Users\Admin\AppData\Local\Temp\EEF5.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:4220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 3402⤵
- Program crash
PID:4700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F01F.bat" "1⤵
- Checks computer location settings
PID:240
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4368
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4100
-
C:\Users\Admin\AppData\Local\Temp\F475.exeC:\Users\Admin\AppData\Local\Temp\F475.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4680 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:4500
-
-
C:\Users\Admin\AppData\Local\Temp\F541.exeC:\Users\Admin\AppData\Local\Temp\F541.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:3320
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1120
-
C:\Users\Admin\AppData\Local\Temp\F811.exeC:\Users\Admin\AppData\Local\Temp\F811.exe1⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"2⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F3⤵
- Creates scheduled task(s)
PID:3136
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit3⤵PID:3452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:532
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"4⤵PID:4716
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E4⤵PID:4056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:1568
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"4⤵PID:204
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E4⤵PID:3580
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:3336
-
-
-
C:\Users\Admin\AppData\Local\Temp\F9F6.exeC:\Users\Admin\AppData\Local\Temp\F9F6.exe1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"2⤵
- Executes dropped EXE
PID:2856 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F3⤵
- Creates scheduled task(s)
PID:1204
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit3⤵PID:716
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵PID:200
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:1660
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵PID:3784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:236
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:N"4⤵PID:3344
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:R" /E4⤵PID:4720
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2860
-
C:\Users\Admin\AppData\Local\Temp\50.exeC:\Users\Admin\AppData\Local\Temp\50.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3004 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:3736
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3612
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1648
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3784
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5616
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5804
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1584
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:5392
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
PID:5412
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5092
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:5160
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
PID:5176
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\1HIKB4M9\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\V318MSL9\B8BxsscfVBr[1].ico
Filesize1KB
MD5e508eca3eafcc1fc2d7f19bafb29e06b
SHA1a62fc3c2a027870d99aedc241e7d5babba9a891f
SHA256e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a
SHA51249e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\C9D8P0QC.cookie
Filesize132B
MD5c5cc9d573a101134809068909e8000dd
SHA15ab89b3a1d897394b8059af92cde6b7c7bf40f30
SHA25663796dc761fc2529c944e2cc67e6832cfce0d3196449274ecb8aef42463755a7
SHA512995da6da96a4af999fc27c2fe8ae744804ee70ab1a16c4efe5b6ddd47700eb52eac537c52a4e663b37f07b00702634b58b02e9b1bd3de876cd0a5396773eea6f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\Y0SUCTJY.cookie
Filesize132B
MD513043a13bd25d6c82944bd1cd91ed2dc
SHA17f75e6396b983c73095a07d90505c09f322f8ecb
SHA25615b55fbf000e298e9b3a7d53e1407ac4e4ecc7ac0cf10d07d3f93ddcb49939fb
SHA512cf88fc1839b3096bbe28929b630d49872d8b2ed7943d6002ae26914415dd198626c81a09338cbd114995762cd7c9ce52ae0c52ea3b582c6ec1a84839a73a98f2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD51683b1ae63c5577cbb0d1ec26998ae85
SHA117c695a7f00e2ff464a4a600627a7050461dbb7b
SHA2565d09699c076af946a4542756bbe31a1edbf9945fe2830a2c7442d1b374f72d0b
SHA512e241f9ed759c4075f4db1bb04fe7caf282afb61d4b1f039765686a0890eac51ebd803dfc1e81532a8ad244070603e2cdda56952ce8dd9ff518470ccf48c0c1fe
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4
Filesize472B
MD5c0c3e05b26e30e45ea530e8aef9e7eda
SHA16c9b45ca8961b4f7b9c59ceb493e6ea2dfbb565c
SHA25604ca481563cbdf29f1900846329ae3077021fc2f19e395d74d5d40f0c0101eec
SHA51248fb72d11e2171536799a24e34d24621515d1bf99b7102e8e9a8a7ea858c7bf8628120ef949eef11c3c3f0cf5da173b14e4044c738aabc1cd05ab150cce8ab27
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5762c320980afd13a13f51e20ba56a242
SHA1a3b2fb713511c1728b6df5568d52e8e063f1040c
SHA256ad2e64121ddb7fa2d017cc1e02344f9b14b43939207d1e7df07d88878f504d24
SHA5121b3753956a7deea550866fc7931004d2a8036569a453c284fcd1d83d50a9fe69f9ec45f87072014ba7912a2e569367f9a9714ff7fd57f8c0920fa413c984b96a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize338B
MD5a71327eccb3417db0efb714d9a0f7e6a
SHA16051f09c7b21dfe38234c423bc6e9b6c1eecf4ab
SHA256f4bd82e6bec7a19ae5be107b996b24ba8a0cc11dc0f15722be5c0db7268515f4
SHA512351d50ecc2314cb45eb507dd2e558d64e37d72fad5e268adc15eb685db943f9e0cfe930fbe093b94268a3856123f8a58621ac26bc36221af7065f3ccba80547c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4
Filesize402B
MD569f0ff4329fbe402be5f04227039e748
SHA1ec22988b1ba660b6b6ecea3fb47575a7ac612ace
SHA2568f877d2fb5b74c8feff374a3377e1d017cb6d4d61ffe1aa0ab1b17ed956e60fd
SHA51292df624c668f32073c000542db12b90c5e50c6f198c5613a38240b7e55e3b6d9d138bc763e5108c89eb45777a65093d7d80ed58f96dc0678929b80e752f14ab8
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD58c0830f85de412e8a62a535fbe29d19f
SHA1874a099a670b5b1e927235b1410ce5a118b32087
SHA256286d7ca1e17a152810abbe47dd3c2dffe61c02423781e7016420d4fba5d9e298
SHA51216b2bf2b34e4322c70d29f687a0b3c20e3c6daf91851667672cbd735a7988868e9a42cbed1836b8c8521407ca471b50ebf612a8fc175ef16da96e1b86694c52f
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
1.6MB
MD597c00af317c285443d09f6907a857394
SHA1399badbda7916d8bb139225ef0b1f5c5682aee30
SHA256b67ba47d9f0ecd61c7aad92910644b92d06c1c3151027d6ef5ee303a2d42c38a
SHA512f6f83ebb5dda83febfb2c68eb69ac0ee1010ab0d0fd698590e97ca0c94b63d12c32cde827ae7d8db1e4213ad7f559864dde3191a903782e85a8ee600584d813f
-
Filesize
1.6MB
MD597c00af317c285443d09f6907a857394
SHA1399badbda7916d8bb139225ef0b1f5c5682aee30
SHA256b67ba47d9f0ecd61c7aad92910644b92d06c1c3151027d6ef5ee303a2d42c38a
SHA512f6f83ebb5dda83febfb2c68eb69ac0ee1010ab0d0fd698590e97ca0c94b63d12c32cde827ae7d8db1e4213ad7f559864dde3191a903782e85a8ee600584d813f
-
Filesize
1.2MB
MD53e687a14033b8ba0968ce86c415abe8e
SHA1c5483168957df8fb20c9587148553c01953dd750
SHA256198e731935d5a9c0b26797118791b53fd76ddd1a38302cf739ad3a57f0c6b2e9
SHA512b60bec6ef664945bcdef20dde1a5904e5895abdb5fb91fcd19a68dc401ae43a53f9bbd67e7b56b1966d21e19cd22ebd4633c6ba200f2de81d5c4037478b4068f
-
Filesize
1.2MB
MD53e687a14033b8ba0968ce86c415abe8e
SHA1c5483168957df8fb20c9587148553c01953dd750
SHA256198e731935d5a9c0b26797118791b53fd76ddd1a38302cf739ad3a57f0c6b2e9
SHA512b60bec6ef664945bcdef20dde1a5904e5895abdb5fb91fcd19a68dc401ae43a53f9bbd67e7b56b1966d21e19cd22ebd4633c6ba200f2de81d5c4037478b4068f
-
Filesize
378KB
MD595ab34f204236ba37848cc9cc95405e1
SHA1bb51007f4c622de6695c888b0ad77fd7d338d57c
SHA256699f39018aace26083e65b195f12fb9440be99f4fd86b8a6c1fa01683dbe91f6
SHA512180711f110f58ff84524075c132ca202274d5f8983aba1374b6f39dd86c572f950c36538da73b554df0b9935159a3bcbb5a39255acdc891e5d42a7d20574bf07
-
Filesize
378KB
MD595ab34f204236ba37848cc9cc95405e1
SHA1bb51007f4c622de6695c888b0ad77fd7d338d57c
SHA256699f39018aace26083e65b195f12fb9440be99f4fd86b8a6c1fa01683dbe91f6
SHA512180711f110f58ff84524075c132ca202274d5f8983aba1374b6f39dd86c572f950c36538da73b554df0b9935159a3bcbb5a39255acdc891e5d42a7d20574bf07
-
Filesize
378KB
MD595ab34f204236ba37848cc9cc95405e1
SHA1bb51007f4c622de6695c888b0ad77fd7d338d57c
SHA256699f39018aace26083e65b195f12fb9440be99f4fd86b8a6c1fa01683dbe91f6
SHA512180711f110f58ff84524075c132ca202274d5f8983aba1374b6f39dd86c572f950c36538da73b554df0b9935159a3bcbb5a39255acdc891e5d42a7d20574bf07
-
Filesize
79B
MD5403991c4d18ac84521ba17f264fa79f2
SHA1850cc068de0963854b0fe8f485d951072474fd45
SHA256ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576
-
Filesize
459KB
MD599fccf467db878a1448f8ed377d80294
SHA19ee34d07c2ad581fd534ae2f57c4d1977b3fcf34
SHA256fda308579a9c80c331e9adbcb3ca0547cb482a965e19520ac002ccfa3ede460b
SHA5123502349019b6d86e9e398b3c5aacb97d543867c24aa1d2cd17b70e3dc634cbc64aba11753bdd83f55f4c5f7479626906870c83e56636e6b0d6b7bb2490b9efa3
-
Filesize
459KB
MD599fccf467db878a1448f8ed377d80294
SHA19ee34d07c2ad581fd534ae2f57c4d1977b3fcf34
SHA256fda308579a9c80c331e9adbcb3ca0547cb482a965e19520ac002ccfa3ede460b
SHA5123502349019b6d86e9e398b3c5aacb97d543867c24aa1d2cd17b70e3dc634cbc64aba11753bdd83f55f4c5f7479626906870c83e56636e6b0d6b7bb2490b9efa3
-
Filesize
19KB
MD5cb71132b03f15b037d3e8a5e4d9e0285
SHA195963fba539b45eb6f6acbd062c48976733519a1
SHA2567f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a
-
Filesize
19KB
MD5cb71132b03f15b037d3e8a5e4d9e0285
SHA195963fba539b45eb6f6acbd062c48976733519a1
SHA2567f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
1.0MB
MD550396aa17d248d8afe74cf8f19a9c33f
SHA133bdd0fea1dbc5434c5edf34106af19ad76b825c
SHA2561758bfee38a61d558e5e500b6cc4d6896eabe1b55f729591163da9a72a9f6e85
SHA512beff0f6cee774e3fb8dcfdc0ef7a443cffed16ae40ead36aa51307a52d9fa0cd3ab7da6831e9cb5db84611f2f00cd5503061d22a4d4fa77aa2f38f470db14bc0
-
Filesize
1.0MB
MD550396aa17d248d8afe74cf8f19a9c33f
SHA133bdd0fea1dbc5434c5edf34106af19ad76b825c
SHA2561758bfee38a61d558e5e500b6cc4d6896eabe1b55f729591163da9a72a9f6e85
SHA512beff0f6cee774e3fb8dcfdc0ef7a443cffed16ae40ead36aa51307a52d9fa0cd3ab7da6831e9cb5db84611f2f00cd5503061d22a4d4fa77aa2f38f470db14bc0
-
Filesize
885KB
MD5dcb7dd1183d028f3784e63f8a63dd11c
SHA10383498afbc0b7dc8405711712a18d6bb41af6f2
SHA2567869320b7c531f801f0cf245cce512fe55f1cbedd1311665c356ad6bf314ede8
SHA51283f588765502e7268d196f0a7ca1d0a27ea3330262a882712bbf2a2be33938bc2b775b59e2f9fcd7c9f12c34e5538b0f8a2b20c2b32a8509a69792377b01789f
-
Filesize
885KB
MD5dcb7dd1183d028f3784e63f8a63dd11c
SHA10383498afbc0b7dc8405711712a18d6bb41af6f2
SHA2567869320b7c531f801f0cf245cce512fe55f1cbedd1311665c356ad6bf314ede8
SHA51283f588765502e7268d196f0a7ca1d0a27ea3330262a882712bbf2a2be33938bc2b775b59e2f9fcd7c9f12c34e5538b0f8a2b20c2b32a8509a69792377b01789f
-
Filesize
590KB
MD5b02dee59706aa71090cfa2a67cc0c7ca
SHA1d869ea683c563affb2b7041fdccca5b61d1141e3
SHA2567eca710778bc8571155750f273a6fbfbd6ed218a394e95cb64620a3520bf70f2
SHA512d7ea424df02d92fbb1ac8c7d35231cf888df4a82aa35583c2c5f6a7f8c83b3ef0fa833e95a630a37906fd88655653884703996022df97b7c251b7e39cd7b529a
-
Filesize
590KB
MD5b02dee59706aa71090cfa2a67cc0c7ca
SHA1d869ea683c563affb2b7041fdccca5b61d1141e3
SHA2567eca710778bc8571155750f273a6fbfbd6ed218a394e95cb64620a3520bf70f2
SHA512d7ea424df02d92fbb1ac8c7d35231cf888df4a82aa35583c2c5f6a7f8c83b3ef0fa833e95a630a37906fd88655653884703996022df97b7c251b7e39cd7b529a
-
Filesize
417KB
MD5d6c90b9404be517719efb3e440559564
SHA1e80a31033f5152ff7c99f77b54aabad49133fc67
SHA256d57df80c79fcc09a425cbf698b5da027e320671a4def137fd8d152ca2b8b073d
SHA51259bc81d46745ac68f86cee31c483701dd4388563975f390ac6e7edba4baab5bb97abc430b33c0f44b70f8bcb74af5d4a82e2e02f1242770711c9816ad1e77295
-
Filesize
417KB
MD5d6c90b9404be517719efb3e440559564
SHA1e80a31033f5152ff7c99f77b54aabad49133fc67
SHA256d57df80c79fcc09a425cbf698b5da027e320671a4def137fd8d152ca2b8b073d
SHA51259bc81d46745ac68f86cee31c483701dd4388563975f390ac6e7edba4baab5bb97abc430b33c0f44b70f8bcb74af5d4a82e2e02f1242770711c9816ad1e77295
-
Filesize
378KB
MD595ab34f204236ba37848cc9cc95405e1
SHA1bb51007f4c622de6695c888b0ad77fd7d338d57c
SHA256699f39018aace26083e65b195f12fb9440be99f4fd86b8a6c1fa01683dbe91f6
SHA512180711f110f58ff84524075c132ca202274d5f8983aba1374b6f39dd86c572f950c36538da73b554df0b9935159a3bcbb5a39255acdc891e5d42a7d20574bf07
-
Filesize
378KB
MD595ab34f204236ba37848cc9cc95405e1
SHA1bb51007f4c622de6695c888b0ad77fd7d338d57c
SHA256699f39018aace26083e65b195f12fb9440be99f4fd86b8a6c1fa01683dbe91f6
SHA512180711f110f58ff84524075c132ca202274d5f8983aba1374b6f39dd86c572f950c36538da73b554df0b9935159a3bcbb5a39255acdc891e5d42a7d20574bf07
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
Filesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
Filesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
Filesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4