Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2023, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe
Resource
win10v2004-20230915-en
General
-
Target
4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe
-
Size
1.8MB
-
MD5
169b6a20fea6f9c6e68eb87e4a07db0d
-
SHA1
126fe5d3b39d0e1ae549edbc5e4b615db11454e7
-
SHA256
4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150
-
SHA512
967b70bc4073a949659d765e74786a94d77688123856c381c4a6462976a9bab3b9d6634512bf1b4d24d067373ccdb7a422600ad6c687325cf504191e12eb01b1
-
SSDEEP
49152:qFV8hLZda2Oxs537fOhRnjekVYZcsRCOpulN/H:MV8LZ/+98ZcsIOpOF
Malware Config
Extracted
redline
frant
77.91.124.55:19071
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
amadey
3.83
http://5.42.65.80/8bmeVwqx/index.php
-
install_dir
207aa4515d
-
install_file
oneetx.exe
-
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4
Extracted
redline
gigant
77.91.124.55:19071
Extracted
redline
@ytlogsbot
176.123.4.46:33783
Extracted
mystic
http://5.42.92.211/loghub/master
Signatures
-
DcRat 3 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 5268 schtasks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe 5148 schtasks.exe -
Detect Mystic stealer payload 11 IoCs
resource yara_rule behavioral2/memory/2544-70-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2544-71-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2544-72-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2544-74-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5224-349-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5224-350-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5224-351-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5500-365-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5500-366-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5500-370-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5224-374-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral2/files/0x000b000000023252-361.dat healer behavioral2/memory/5452-363-0x0000000000CE0000-0x0000000000CEA000-memory.dmp healer behavioral2/files/0x000b000000023252-362.dat healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 179E.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 179E.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 179E.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 179E.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 179E.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 179E.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
resource yara_rule behavioral2/memory/5012-83-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral2/memory/5556-516-0x0000000000930000-0x000000000096E000-memory.dmp family_redline behavioral2/memory/5844-517-0x00000000006E0000-0x00000000008CA000-memory.dmp family_redline behavioral2/memory/5544-525-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral2/memory/5844-534-0x00000000006E0000-0x00000000008CA000-memory.dmp family_redline behavioral2/memory/5436-536-0x00000000005C0000-0x000000000061A000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation 1AFA.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation 21D1.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 26 IoCs
pid Process 4436 Da1MZ02.exe 4648 uw0Ic44.exe 2036 LK3xq94.exe 836 1Xn41Yv2.exe 4424 2NB3424.exe 4420 3gP60rf.exe 1548 4Tv950BJ.exe 1112 5Cz5gG7.exe 3536 E05.exe 5028 DH9Lx8ok.exe 4204 1171.exe 3696 co6Sd1dr.exe 2032 hJ3Oc2fM.exe 5168 ML1NB2bV.exe 5272 1626.exe 5288 1jC59Tl6.exe 5452 179E.exe 5644 1AFA.exe 5232 21D1.exe 5248 explothe.exe 5844 26C4.exe 5436 3116.exe 5556 2Tv540Ka.exe 5976 oneetx.exe 6004 oneetx.exe 5468 explothe.exe -
Loads dropped DLL 3 IoCs
pid Process 5436 3116.exe 5436 3116.exe 4996 rundll32.exe -
Uses the VBS compiler for execution 1 TTPs
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 179E.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" uw0Ic44.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" co6Sd1dr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" ML1NB2bV.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Da1MZ02.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" LK3xq94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" E05.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" DH9Lx8ok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" hJ3Oc2fM.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 836 set thread context of 4252 836 1Xn41Yv2.exe 91 PID 4424 set thread context of 2544 4424 2NB3424.exe 100 PID 4420 set thread context of 5092 4420 3gP60rf.exe 106 PID 1548 set thread context of 5012 1548 4Tv950BJ.exe 110 PID 4204 set thread context of 5224 4204 1171.exe 152 PID 5288 set thread context of 5500 5288 1jC59Tl6.exe 160 PID 5272 set thread context of 5548 5272 1626.exe 162 PID 5844 set thread context of 5544 5844 26C4.exe 186 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
pid pid_target Process procid_target 3756 836 WerFault.exe 89 4828 4424 WerFault.exe 97 3532 2544 WerFault.exe 100 4672 4420 WerFault.exe 105 2908 1548 WerFault.exe 109 5356 4204 WerFault.exe 145 5564 5288 WerFault.exe 154 5744 5272 WerFault.exe 156 5696 5500 WerFault.exe 160 5276 5436 WerFault.exe 183 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5148 schtasks.exe 5268 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4252 AppLaunch.exe 4252 AppLaunch.exe 5092 AppLaunch.exe 5092 AppLaunch.exe 836 msedge.exe 836 msedge.exe 5072 msedge.exe 5072 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found 3148 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5092 AppLaunch.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4252 AppLaunch.exe Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeDebugPrivilege 5452 179E.exe Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found Token: SeShutdownPrivilege 3148 Process not Found Token: SeCreatePagefilePrivilege 3148 Process not Found -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 5232 21D1.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3148 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3224 wrote to memory of 4436 3224 4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe 86 PID 3224 wrote to memory of 4436 3224 4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe 86 PID 3224 wrote to memory of 4436 3224 4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe 86 PID 4436 wrote to memory of 4648 4436 Da1MZ02.exe 87 PID 4436 wrote to memory of 4648 4436 Da1MZ02.exe 87 PID 4436 wrote to memory of 4648 4436 Da1MZ02.exe 87 PID 4648 wrote to memory of 2036 4648 uw0Ic44.exe 88 PID 4648 wrote to memory of 2036 4648 uw0Ic44.exe 88 PID 4648 wrote to memory of 2036 4648 uw0Ic44.exe 88 PID 2036 wrote to memory of 836 2036 LK3xq94.exe 89 PID 2036 wrote to memory of 836 2036 LK3xq94.exe 89 PID 2036 wrote to memory of 836 2036 LK3xq94.exe 89 PID 836 wrote to memory of 4252 836 1Xn41Yv2.exe 91 PID 836 wrote to memory of 4252 836 1Xn41Yv2.exe 91 PID 836 wrote to memory of 4252 836 1Xn41Yv2.exe 91 PID 836 wrote to memory of 4252 836 1Xn41Yv2.exe 91 PID 836 wrote to memory of 4252 836 1Xn41Yv2.exe 91 PID 836 wrote to memory of 4252 836 1Xn41Yv2.exe 91 PID 836 wrote to memory of 4252 836 1Xn41Yv2.exe 91 PID 836 wrote to memory of 4252 836 1Xn41Yv2.exe 91 PID 836 wrote to memory of 4252 836 1Xn41Yv2.exe 91 PID 2036 wrote to memory of 4424 2036 LK3xq94.exe 97 PID 2036 wrote to memory of 4424 2036 LK3xq94.exe 97 PID 2036 wrote to memory of 4424 2036 LK3xq94.exe 97 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4424 wrote to memory of 2544 4424 2NB3424.exe 100 PID 4648 wrote to memory of 4420 4648 uw0Ic44.exe 105 PID 4648 wrote to memory of 4420 4648 uw0Ic44.exe 105 PID 4648 wrote to memory of 4420 4648 uw0Ic44.exe 105 PID 4420 wrote to memory of 5092 4420 3gP60rf.exe 106 PID 4420 wrote to memory of 5092 4420 3gP60rf.exe 106 PID 4420 wrote to memory of 5092 4420 3gP60rf.exe 106 PID 4420 wrote to memory of 5092 4420 3gP60rf.exe 106 PID 4420 wrote to memory of 5092 4420 3gP60rf.exe 106 PID 4420 wrote to memory of 5092 4420 3gP60rf.exe 106 PID 4436 wrote to memory of 1548 4436 Da1MZ02.exe 109 PID 4436 wrote to memory of 1548 4436 Da1MZ02.exe 109 PID 4436 wrote to memory of 1548 4436 Da1MZ02.exe 109 PID 1548 wrote to memory of 5012 1548 4Tv950BJ.exe 110 PID 1548 wrote to memory of 5012 1548 4Tv950BJ.exe 110 PID 1548 wrote to memory of 5012 1548 4Tv950BJ.exe 110 PID 1548 wrote to memory of 5012 1548 4Tv950BJ.exe 110 PID 1548 wrote to memory of 5012 1548 4Tv950BJ.exe 110 PID 1548 wrote to memory of 5012 1548 4Tv950BJ.exe 110 PID 1548 wrote to memory of 5012 1548 4Tv950BJ.exe 110 PID 1548 wrote to memory of 5012 1548 4Tv950BJ.exe 110 PID 3224 wrote to memory of 1112 3224 4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe 114 PID 3224 wrote to memory of 1112 3224 4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe 114 PID 3224 wrote to memory of 1112 3224 4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe 114 PID 1112 wrote to memory of 4128 1112 5Cz5gG7.exe 116 PID 1112 wrote to memory of 4128 1112 5Cz5gG7.exe 116 PID 4128 wrote to memory of 392 4128 cmd.exe 118 PID 4128 wrote to memory of 392 4128 cmd.exe 118 PID 392 wrote to memory of 2304 392 msedge.exe 119 PID 392 wrote to memory of 2304 392 msedge.exe 119 PID 4128 wrote to memory of 1068 4128 cmd.exe 120 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe"C:\Users\Admin\AppData\Local\Temp\4beaa05abbc9c61649f59a90870cf295699f35a90c02b4059a220bb281ca4150.exe"1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Da1MZ02.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Da1MZ02.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uw0Ic44.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uw0Ic44.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LK3xq94.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LK3xq94.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Xn41Yv2.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Xn41Yv2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 5686⤵
- Program crash
PID:3756
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2NB3424.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2NB3424.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 5407⤵
- Program crash
PID:3532
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 5726⤵
- Program crash
PID:4828
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gP60rf.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gP60rf.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 5725⤵
- Program crash
PID:4672
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Tv950BJ.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Tv950BJ.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:5012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 5724⤵
- Program crash
PID:2908
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Cz5gG7.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Cz5gG7.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B3DF.tmp\B3E0.tmp\B3E1.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Cz5gG7.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff9ac6f46f8,0x7ff9ac6f4708,0x7ff9ac6f47185⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2328 /prefetch:25⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:85⤵PID:2616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:15⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:15⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:15⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:15⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:15⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:85⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:85⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:15⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:15⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:15⤵PID:5836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:15⤵PID:6088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2300,17056045231720368842,481862023271500979,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2564 /prefetch:25⤵PID:2360
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/4⤵PID:1068
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9ac6f46f8,0x7ff9ac6f4708,0x7ff9ac6f47185⤵PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,7546144435821733897,14406031681948496407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:25⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,7546144435821733897,14406031681948496407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:836
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 836 -ip 8361⤵PID:3476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4424 -ip 44241⤵PID:4184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2544 -ip 25441⤵PID:2196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4420 -ip 44201⤵PID:920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1548 -ip 15481⤵PID:1828
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2912
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\E05.exeC:\Users\Admin\AppData\Local\Temp\E05.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DH9Lx8ok.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DH9Lx8ok.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\co6Sd1dr.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\co6Sd1dr.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hJ3Oc2fM.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hJ3Oc2fM.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ML1NB2bV.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ML1NB2bV.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1jC59Tl6.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1jC59Tl6.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5288 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:5500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 5408⤵
- Program crash
PID:5696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 1407⤵
- Program crash
PID:5564
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Tv540Ka.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Tv540Ka.exe6⤵
- Executes dropped EXE
PID:5556
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1171.exeC:\Users\Admin\AppData\Local\Temp\1171.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1362⤵
- Program crash
PID:5356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1385.bat" "1⤵PID:3616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login2⤵PID:5724
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ac6f46f8,0x7ff9ac6f4708,0x7ff9ac6f47183⤵PID:5752
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/2⤵PID:5876
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ac6f46f8,0x7ff9ac6f4708,0x7ff9ac6f47183⤵PID:5888
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4204 -ip 42041⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\1626.exeC:\Users\Admin\AppData\Local\Temp\1626.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5272 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 4162⤵
- Program crash
PID:5744
-
-
C:\Users\Admin\AppData\Local\Temp\179E.exeC:\Users\Admin\AppData\Local\Temp\179E.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:5452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5288 -ip 52881⤵PID:5520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5272 -ip 52721⤵PID:5588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5500 -ip 55001⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\1AFA.exeC:\Users\Admin\AppData\Local\Temp\1AFA.exe1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5248 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F3⤵
- DcRat
- Creates scheduled task(s)
PID:5148
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit3⤵PID:5632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:452
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"4⤵PID:5748
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"4⤵PID:3808
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E4⤵PID:5828
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:5500
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E4⤵PID:5540
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:4996
-
-
-
C:\Users\Admin\AppData\Local\Temp\21D1.exeC:\Users\Admin\AppData\Local\Temp\21D1.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5976 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F3⤵
- DcRat
- Creates scheduled task(s)
PID:5268
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit3⤵PID:2880
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵PID:3220
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:N"4⤵PID:6080
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:R" /E4⤵PID:1464
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:4120
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵PID:5288
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:5504
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\26C4.exeC:\Users\Admin\AppData\Local\Temp\26C4.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:5544
-
-
C:\Users\Admin\AppData\Local\Temp\3116.exeC:\Users\Admin\AppData\Local\Temp\3116.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 8042⤵
- Program crash
PID:5276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5436 -ip 54361⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
PID:6004
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:5468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321B
MD5baf5d1398fdb79e947b60fe51e45397f
SHA149e7b8389f47b93509d621b8030b75e96bb577af
SHA25610c8c7b5fa58f8c6b69f44e92a4e2af111b59fcf4f21a07e04b19e14876ccdf8
SHA512b2c9ef5581d5eae7c17ae260fe9f52344ed737fa851cb44d1cea58a32359d0ac5d0ca3099c970209bd30a0d4af6e504101f21b7054cf5eca91c0831cf12fb413
-
Filesize
152B
MD56351be8b63227413881e5dfb033459cc
SHA1f24489be1e693dc22d6aac7edd692833c623d502
SHA256e24cda01850900bdb3a4ae5f590a76565664d7689026c146eb96bcd197dac88b
SHA51266e249488a2f9aa020834f3deca7e4662574dcab0cbb684f21f295f46d71b11f9494b075288189d9df29e4f3414d4b86c27bf8823005d400a5946d7b477f0aef
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5b9e4430fb4638e89e3a2dbd61566d47f
SHA16c76a2155d15c65e878480d30a8de4afbc902402
SHA256b819521b50627c16aab94e74bb09b2622fb48074fc522917caf7d7498cc3623b
SHA5129c8ea97d9b6e6a448e26f755089ffc2aa76a461c48f5b1019561a6caaad5d8caede3adddf411a1d58f4889135a63434208be0cc85cda3c103865c5422efc86dc
-
Filesize
1KB
MD54d5cb6be1c4eb53d9f17841eee48651d
SHA191ba76e28f2f11b6c18351d62e22e3ba282eafea
SHA256a8cf022402cdb07dbb9ce779d8166fc25dbdd45ffc20384d4160fb4f227beafa
SHA512ef05b123dae5505a0556e0675a25c43057724e28d5bd36ce51172d3d019c7f75056f391fd157c7f733f0db496a790b97a658dbec7a9ca3f5a453376e2a38c4f2
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD581b46861eddd5c97570f08249c82207b
SHA1e796d669835d668c082f9191ccecaa4cd08e9928
SHA256fa9dfe98a5026d8e185f9185f48979eddda1b09ab45ff96a8cd33da74a367d8b
SHA512897e98cc4b54a8b35f992a45157f1c9c6ea26b3338d957d79b6167e03b81b04923c17fd6d3b7e36f70d78edb60ac18cf634d45382345250219121ae6e0dd50a9
-
Filesize
6KB
MD5ab47eccbc7c13b13bed309c806beadc3
SHA1b88928fe6e908aeab510ea38e003b85fa4090c6d
SHA256ea813e2cdb3adc2fcb1102714e1317b7109d85a6d0d3ba0593296449489dbd09
SHA512866df850e06a2f2922cc09e9b0dd3a6aa6e8a0f687c48474cbabe340c5e0eda70f11bc1a7b7a0d7e743bb45ad8160fdd0e0ae0d0ab5b9197efb24406a7837549
-
Filesize
6KB
MD5e91ea8927b60b80b4c13270fb0cf2c25
SHA1a72688b446e44ba9452a973b659a9e65408398b0
SHA256d3b5998567bee1c184631e9b8fb812268df9ed3afa9b3c69eefcb6c8ab72f030
SHA512ce814f9219272648e2f2fdc20dca0a756b5e353c32e2bf00cc8df7e3075a81ae6ee24ba065fd82daa5d464a2a3579af562fbd803817e0fcf42163cb3d3e21994
-
Filesize
5KB
MD51831c87baabfe0bb12e56d2a049453ea
SHA1e5801a61b27b1ba276c8a6035c3bba9a5e46cfcd
SHA2563588b289b10009b9608ba52d85aa5c9b07176e3a3439c083b1dac882f89b9529
SHA512a2d46f5ed7de084e81f6f244690ca8a58e2f7c10b2bafc7a14a7e32cf9f6313f03b126702180e13b14a8de578a9783c1480d04b7d23de8d7aea85e3bef11dcd4
-
Filesize
24KB
MD5699e3636ed7444d9b47772e4446ccfc1
SHA1db0459ca6ceeea2e87e0023a6b7ee06aeed6fded
SHA2569205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a
SHA512d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51
-
Filesize
864B
MD50d30af6035f6023fe273ad8efc2dfb8b
SHA14ae6f568b136f2e1c24b8f499a86563b44a50a9e
SHA25666d6184453f8c68f9f98cd650429a95822e25dee7235e9624e3d8191e6f21cf9
SHA51221d72bec08c752f65ea52baa322660f462b304c1111042b0dd7737c4a0a0cdc9775abbfc181853e3aa8d3f44cc1335bfdeec68194478448700ed06381eca2000
-
Filesize
862B
MD5b56bc9e24b5b547139744c6efa5c7e66
SHA1b16c383b1399e2c671cd2085f2bbd0533b923ce5
SHA256c3ca9f7ef05b464ab5e9fdadcb0835ed48efc7079d5251a9e026ce65f0a4e701
SHA5122e694a1fc6b2d801cb883d6d10aad404449cf914f882e3cf2bc8358aa16368037b93838c4e3b03ca95d83184115d015b4e1d55932159aa41aa8eb6fd3d659aff
-
Filesize
862B
MD503ee926f583d02eb240be1c964029dbd
SHA1cc75608f1ef038d87a6efc573083f5c350278b2d
SHA2566922ac76789286d873b0276adbdf6f63c805eda3c9f3da7d76f5368b25bffb14
SHA51202af58b8687b5adc5b8c39551120d76e23c4b2dbe43a6cbacbd2ff4212bb153c2b19027d48fbf793ad72c0a85d34845ae99e2574da50bc53982b5136e487c705
-
Filesize
862B
MD51ac6d4e8cd70cddb322e115f07d75bd4
SHA1f4e2fd722efcc00536047e77277dc0b0c0e23ab6
SHA2565ff5497ee872d8fd3e82f7a52ea32674c22bafb0169a511f7887ba49a6fe56f5
SHA51201f6b13666f67ca15277b5796c3df36776052e2ebec9322a023f84aff53080fc747bd90b76b2c78cf96a786e171184f94d1a02b783d3cedc1df2a66ff653f497
-
Filesize
862B
MD5d428065361500418ba9b776293b65038
SHA1fb4e8e8855bad68ef432f4b29f34598cdddd84ab
SHA256585471546d5949902e8ba036911140af59c83767ef1649cf9f229cb809c9accb
SHA512c42799a7d54b6390f94779899b0fedce03bc6f668becc024b5744b141df988fdfa8fdaba9b8bbe43886f221a1ef65b494fc515c6794abfe7511a3e210eec301d
-
Filesize
864B
MD5015239700476efe79a40df61090d7c4f
SHA114d0466f1b71c9895911b671cedd468789422f65
SHA25634567752ab543733aae5a995e812852817d181ba9f117ab65d6de965674a1fd8
SHA51219e6ae0961b72fe228add4bdbc2723a95e81332880b4394c23728cc96bc6c4aea55feeb75eda897368baa0eb630001a27a174ca2897e7116c507fc6bff142c8e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5db68e7c9719a659e7cd8840fd2d3186e
SHA13ccecc10ddef761930335388eba599c7af12211f
SHA256b20367c57b3acfd0ea46d0c2b4d0b4f531cecb389f73e1180f2f26e0620de98f
SHA512fd3334ffce4fd5daccdbf992e42ff7633ac9e11b33b3b9549028cb317ab76a9bb47c7685a8964c4473656c7e79f4d4613a40c929398278763101694963681504
-
Filesize
2KB
MD5d2369f1f105559699a66dab8b2e678d7
SHA1a20b08de573d3f06ce3180d6af260f50cc18e6c6
SHA25687793a5dacf78bc0f367ef847da7af708366ed74b3cc50327ea1a4f3e965b700
SHA512f5bbe3746c8b12e65d3922fda69d686571fc03dd6f19875664e7ee6bb4575ba98c51fcac2879472a3290a7e05f79859203403b6e19144f8724c349d8f54d7a3c
-
Filesize
2KB
MD5d2369f1f105559699a66dab8b2e678d7
SHA1a20b08de573d3f06ce3180d6af260f50cc18e6c6
SHA25687793a5dacf78bc0f367ef847da7af708366ed74b3cc50327ea1a4f3e965b700
SHA512f5bbe3746c8b12e65d3922fda69d686571fc03dd6f19875664e7ee6bb4575ba98c51fcac2879472a3290a7e05f79859203403b6e19144f8724c349d8f54d7a3c
-
Filesize
10KB
MD5fac52f3372457511ab7656597aa0a81e
SHA1a369a8690ac1936966704493525506def9c5cf6d
SHA256257ca90044b7eabaae8068a111effb74977bdf4665c4f91dc9a7781e3e59c9e4
SHA5124442c6dbc1abb627254e9940dd3975dc2197a9f3e9f9d6e77fed72b8b58b5676cd774f2ccc1fb4fd95621f7a7b25fdd58a5070159bd4acbdc2a4ff04dc01a082
-
Filesize
378KB
MD5f9734f65a321134d9f1352856bc28365
SHA18ffbb8a5f1b1c9f1f46fd2cff999799e05d2ec5b
SHA2566d79af8bd57ad1b21072611118f704f70425eb73173ba1d827c080eabf2e8ca4
SHA512fb8644b806d0d4a77c20b790588c907842fb2d9a3ba1be5daec22142c4ac086f5280b41359beb8b2be97df46ed7616ba63a5b4ee9b9540134772bc748f162c6c
-
Filesize
378KB
MD5f9734f65a321134d9f1352856bc28365
SHA18ffbb8a5f1b1c9f1f46fd2cff999799e05d2ec5b
SHA2566d79af8bd57ad1b21072611118f704f70425eb73173ba1d827c080eabf2e8ca4
SHA512fb8644b806d0d4a77c20b790588c907842fb2d9a3ba1be5daec22142c4ac086f5280b41359beb8b2be97df46ed7616ba63a5b4ee9b9540134772bc748f162c6c
-
Filesize
79B
MD5403991c4d18ac84521ba17f264fa79f2
SHA1850cc068de0963854b0fe8f485d951072474fd45
SHA256ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576
-
Filesize
459KB
MD5ae514bfefaa4b1a33b40230662866f92
SHA13d9c608b6ec73e8aee31cd138f6da728d91ca19d
SHA256d50cdb7224f93ccf883674e201fcc4f1e5d121516499b666b29fa33d2dbbc31c
SHA5128348de98980131b9930bdf6749682469a93dab6827018a45c70a52884cf63a9b2e0b05ac5910b2db58c20106b96869475b957d6067e747fe66b562eac2646fd3
-
Filesize
459KB
MD5ae514bfefaa4b1a33b40230662866f92
SHA13d9c608b6ec73e8aee31cd138f6da728d91ca19d
SHA256d50cdb7224f93ccf883674e201fcc4f1e5d121516499b666b29fa33d2dbbc31c
SHA5128348de98980131b9930bdf6749682469a93dab6827018a45c70a52884cf63a9b2e0b05ac5910b2db58c20106b96869475b957d6067e747fe66b562eac2646fd3
-
Filesize
19KB
MD5cb71132b03f15b037d3e8a5e4d9e0285
SHA195963fba539b45eb6f6acbd062c48976733519a1
SHA2567f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a
-
Filesize
19KB
MD5cb71132b03f15b037d3e8a5e4d9e0285
SHA195963fba539b45eb6f6acbd062c48976733519a1
SHA2567f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
90B
MD55a115a88ca30a9f57fdbb545490c2043
SHA167e90f37fc4c1ada2745052c612818588a5595f4
SHA25652c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA51217c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe
-
Filesize
1.2MB
MD584e65b50dcd02747f3cf83fce92b417d
SHA115f6c5f944d7ade1889cb90f8ee4a744d4d07873
SHA2565294276635e02af58a6f5046c48c19f25ecfc8fc8550cfc13a3e451fd51e7329
SHA512009db5b620faf56386e37bb64fcd4e5d0989813e2fc1281e1c67b3a0d96b311b60e32a0f961f735c829bb1163be4e9fc212732dda481ecd64df80038528a07d7
-
Filesize
1.2MB
MD584e65b50dcd02747f3cf83fce92b417d
SHA115f6c5f944d7ade1889cb90f8ee4a744d4d07873
SHA2565294276635e02af58a6f5046c48c19f25ecfc8fc8550cfc13a3e451fd51e7329
SHA512009db5b620faf56386e37bb64fcd4e5d0989813e2fc1281e1c67b3a0d96b311b60e32a0f961f735c829bb1163be4e9fc212732dda481ecd64df80038528a07d7
-
Filesize
100KB
MD5309a45b1d7bcfc975d7a4c53a8a5f842
SHA1582e8a7e6b304b671209fab9a74fbd76cf559024
SHA256bf654298dbfe77545c00ba2bccf3eda0841d124d26e7d30bba39ce18bc381d3f
SHA5125579e3f66bcb3d1b2e088814c33128cb30a3f758713acd933117360ed10dc3027b7485c7055fdcc6eea6e68f0b97052f32f5d29e841201a376d0c33ea177d642
-
Filesize
100KB
MD5309a45b1d7bcfc975d7a4c53a8a5f842
SHA1582e8a7e6b304b671209fab9a74fbd76cf559024
SHA256bf654298dbfe77545c00ba2bccf3eda0841d124d26e7d30bba39ce18bc381d3f
SHA5125579e3f66bcb3d1b2e088814c33128cb30a3f758713acd933117360ed10dc3027b7485c7055fdcc6eea6e68f0b97052f32f5d29e841201a376d0c33ea177d642
-
Filesize
100KB
MD594bec28341c3e6cafc74db8bc7035ac2
SHA1624c8f7073ef2899768ea12fdd15f806cf9eff5f
SHA256ed7b50b1d95507a482752a0999429941cf547dc951c1a17c3cba5dc38f6e94bb
SHA5125664ff745c706432fd190e5d733f89f405fd5985dd4d2dbebccf16a2434652d65c9c7c06bc84cbdfc0cff7affd4aa02ef945a22859f4e9ceb93e467b88f1799e
-
Filesize
1.0MB
MD528c7f310218c7fc89535c0d4edbc7c25
SHA1911ac47567b48e730f8c4861d99a1e6a428290b8
SHA2561e8ea34e47b8c5cca9baf5c6f0322ab43c5235296156e76de0539c6354131a29
SHA512e1f668730c79fa3a6952b397929ec4637bec30aa9facae55670b0606f676f053a784f5fceabbcbf58d5fa736ca779527dcb6d6bd117fc349e64ce83cc7ff169a
-
Filesize
1.0MB
MD528c7f310218c7fc89535c0d4edbc7c25
SHA1911ac47567b48e730f8c4861d99a1e6a428290b8
SHA2561e8ea34e47b8c5cca9baf5c6f0322ab43c5235296156e76de0539c6354131a29
SHA512e1f668730c79fa3a6952b397929ec4637bec30aa9facae55670b0606f676f053a784f5fceabbcbf58d5fa736ca779527dcb6d6bd117fc349e64ce83cc7ff169a
-
Filesize
1.7MB
MD5b237ee777ed80e71fcaac3db3003cc57
SHA13b3f8be131b830655c6620c46bfeeef91c231e19
SHA256900e1db8b6ba7515204c06a41fb53a3b58b593bdcdd1d5fb70c5136716bd4390
SHA5120cdfc345187fe6c9cecd09d33d01917922527c8d40c52ada13840a6b67cc18bd175fc74ecd9762bec8e47dfbf7e67b49d7105496c299030d0eb42b7163f36f9a
-
Filesize
1.7MB
MD5b237ee777ed80e71fcaac3db3003cc57
SHA13b3f8be131b830655c6620c46bfeeef91c231e19
SHA256900e1db8b6ba7515204c06a41fb53a3b58b593bdcdd1d5fb70c5136716bd4390
SHA5120cdfc345187fe6c9cecd09d33d01917922527c8d40c52ada13840a6b67cc18bd175fc74ecd9762bec8e47dfbf7e67b49d7105496c299030d0eb42b7163f36f9a
-
Filesize
1.8MB
MD56776394bea61d2b175a2f5d35ec21067
SHA1bcc21b2b8835a31c69a36942e38377ca06172844
SHA256a91e1641ed8f2ae37c1bf8da980876e6334d57b86e43e7dc260b8b6e0b08b209
SHA51224f45116bedc88f875547524a4e114e679ac9775d9a746935bf0557c9ff50fc2dfaa5ff40af9fb0058a52f3731f93e80d8582fc8d8eecd75d823fab4f20c4767
-
Filesize
1.8MB
MD56776394bea61d2b175a2f5d35ec21067
SHA1bcc21b2b8835a31c69a36942e38377ca06172844
SHA256a91e1641ed8f2ae37c1bf8da980876e6334d57b86e43e7dc260b8b6e0b08b209
SHA51224f45116bedc88f875547524a4e114e679ac9775d9a746935bf0557c9ff50fc2dfaa5ff40af9fb0058a52f3731f93e80d8582fc8d8eecd75d823fab4f20c4767
-
Filesize
1.2MB
MD5c9ce1186e23400bb11d422517d716bea
SHA185a6c17373c8094f2bb156f4fc2c158ed3e0ffda
SHA256c197bdf0a605c34d9bc3e966b9095b39247b83aa4c444199476ab837788daca3
SHA51204664aa30b70b6b783d36f8fbc9118f912d6c28df3dafa60a83d95a6aa6b64364f8fbdba23c3a802f71e16195ee6a4fceb5794d600abd9a772da634eebecbdf1
-
Filesize
1.2MB
MD5c9ce1186e23400bb11d422517d716bea
SHA185a6c17373c8094f2bb156f4fc2c158ed3e0ffda
SHA256c197bdf0a605c34d9bc3e966b9095b39247b83aa4c444199476ab837788daca3
SHA51204664aa30b70b6b783d36f8fbc9118f912d6c28df3dafa60a83d95a6aa6b64364f8fbdba23c3a802f71e16195ee6a4fceb5794d600abd9a772da634eebecbdf1
-
Filesize
1.6MB
MD538225f8b29d463d60365ce7d219112cc
SHA143cd60720cb8c0a8b5bf7980fc9fd18154b07934
SHA25656638ca157bcd2e5911a9147ffee9e5d46daf4680054251644235cdbc13aefbd
SHA51219da1107afd87b90f60d3b5b97c62b1015569b2e8667181296ba7d0615daa24019e0b71dfab4cac112c0df1b5df5149a62374010909ed0d1eb683b0965a7d3fb
-
Filesize
1.6MB
MD538225f8b29d463d60365ce7d219112cc
SHA143cd60720cb8c0a8b5bf7980fc9fd18154b07934
SHA25656638ca157bcd2e5911a9147ffee9e5d46daf4680054251644235cdbc13aefbd
SHA51219da1107afd87b90f60d3b5b97c62b1015569b2e8667181296ba7d0615daa24019e0b71dfab4cac112c0df1b5df5149a62374010909ed0d1eb683b0965a7d3fb
-
Filesize
732KB
MD52548cd0e30f2677ba53186fa823fe50f
SHA1e7ce80a16236e7e4b2bfd368f458c97117261b0a
SHA2565ac65aac9135ecb3b310bcbfe8ff6f332e9091dc7ff4c1191688f6ad60d0d84a
SHA5127585df08d9b9ecb49f942a2728f17bbe1d33d2798c3c01613d0d7ea95466c34732afb63049adde8a2590f0672bad2940c8b0e0cbe1c6196b1400513a8da4f3d5
-
Filesize
732KB
MD52548cd0e30f2677ba53186fa823fe50f
SHA1e7ce80a16236e7e4b2bfd368f458c97117261b0a
SHA2565ac65aac9135ecb3b310bcbfe8ff6f332e9091dc7ff4c1191688f6ad60d0d84a
SHA5127585df08d9b9ecb49f942a2728f17bbe1d33d2798c3c01613d0d7ea95466c34732afb63049adde8a2590f0672bad2940c8b0e0cbe1c6196b1400513a8da4f3d5
-
Filesize
884KB
MD55c55b97203f5fcb9f170938695fe7609
SHA12770b4922b6609019cf8b165e26f0cefab1d326b
SHA25626ef71c5e24b44c85830dcb5255b8d6250b514985da5eb86780da126a19b201d
SHA51239f6ab888fcc70ca1b9512e140c75d90a4ea46c1d1e2e90a79ebf12ef7ccc17fe3e21f7ec2d813535c0d149b856bf909b15e8e796683d7ddf71b4589412243e6
-
Filesize
884KB
MD55c55b97203f5fcb9f170938695fe7609
SHA12770b4922b6609019cf8b165e26f0cefab1d326b
SHA25626ef71c5e24b44c85830dcb5255b8d6250b514985da5eb86780da126a19b201d
SHA51239f6ab888fcc70ca1b9512e140c75d90a4ea46c1d1e2e90a79ebf12ef7ccc17fe3e21f7ec2d813535c0d149b856bf909b15e8e796683d7ddf71b4589412243e6
-
Filesize
1.8MB
MD554d6ada673609443faad54246d0c0c99
SHA1c8b385d71ebf088b46e399c4a6d999d4e9444a99
SHA256ed8f66ae5cd968ea6fcdaeeb568132abd2cbd337cbd9cb58b97b1d91a5337ddb
SHA512db4555a5aa2ae534bd3e09bcda31bf1c7d7bc0cb869968ac5eda09e8bea6dc01d747e568fd5c76ac559c209fd460bd1e60e388cc30dce36bc63a8c06457b8b71
-
Filesize
1.8MB
MD554d6ada673609443faad54246d0c0c99
SHA1c8b385d71ebf088b46e399c4a6d999d4e9444a99
SHA256ed8f66ae5cd968ea6fcdaeeb568132abd2cbd337cbd9cb58b97b1d91a5337ddb
SHA512db4555a5aa2ae534bd3e09bcda31bf1c7d7bc0cb869968ac5eda09e8bea6dc01d747e568fd5c76ac559c209fd460bd1e60e388cc30dce36bc63a8c06457b8b71
-
Filesize
1.7MB
MD55b0787c54a31a26f2f81d268a49fe39a
SHA17fd6fa696697a7425123b4dfe84692413cbf05e4
SHA256233698d41a81979033b55ec745335cef4ada3b9d00b105d6fba45e3e68d090a1
SHA5123adf5f783e9f542a42e2026973b64d22bf76323a1e3b8bf28fad61946edf1836a7b38f528c67909ef4b69da165d55607bb0359c74310e486715bdfff983ef211
-
Filesize
1.7MB
MD55b0787c54a31a26f2f81d268a49fe39a
SHA17fd6fa696697a7425123b4dfe84692413cbf05e4
SHA256233698d41a81979033b55ec745335cef4ada3b9d00b105d6fba45e3e68d090a1
SHA5123adf5f783e9f542a42e2026973b64d22bf76323a1e3b8bf28fad61946edf1836a7b38f528c67909ef4b69da165d55607bb0359c74310e486715bdfff983ef211
-
Filesize
589KB
MD50e4657616a684544634ef745335e74de
SHA10ac17d83c5c07fe8f087da00c4166767cc164c43
SHA256bc9484a47c4dae32a4c28682c5a5068ce718a586c43c5463280f03cb692f8dad
SHA512f8b67a3e52a43f4e380f4bf33c00d39dfc057fac01bfce60db5c208a49f9bba4b03cba89c33871f3b8aa46c26d8ff88bc9547a268876a493cefc67f6bb3d7344
-
Filesize
589KB
MD50e4657616a684544634ef745335e74de
SHA10ac17d83c5c07fe8f087da00c4166767cc164c43
SHA256bc9484a47c4dae32a4c28682c5a5068ce718a586c43c5463280f03cb692f8dad
SHA512f8b67a3e52a43f4e380f4bf33c00d39dfc057fac01bfce60db5c208a49f9bba4b03cba89c33871f3b8aa46c26d8ff88bc9547a268876a493cefc67f6bb3d7344
-
Filesize
417KB
MD5978b6ef9b3ed23f06d4fcf33280f56ad
SHA1beb21488083d538a5b4a6a116dad13ffc43ae940
SHA25620e1edd20271b192ebd8c880f04982aee0d28e6275bb2ce2ad553c1a5637fcbd
SHA5127e8e5d5975e5e3e605fee10d154208aec096283f97bd7632762d2f1fb9ef11aaf6f091c88b8173e90c841db59a9e7c48078333f3cd1b0175b54063b86f2dc5f4
-
Filesize
417KB
MD5978b6ef9b3ed23f06d4fcf33280f56ad
SHA1beb21488083d538a5b4a6a116dad13ffc43ae940
SHA25620e1edd20271b192ebd8c880f04982aee0d28e6275bb2ce2ad553c1a5637fcbd
SHA5127e8e5d5975e5e3e605fee10d154208aec096283f97bd7632762d2f1fb9ef11aaf6f091c88b8173e90c841db59a9e7c48078333f3cd1b0175b54063b86f2dc5f4
-
Filesize
378KB
MD5ee44d9b14c4f61c1576f85b48cdf83ef
SHA12a198c538f7198068bca9718e7361288a3718b88
SHA2568373c92287deabf57a66e9546873732743c331ac187da723107d9edf448d8147
SHA51248a671a6896a635d47a635111b7f01d9bd3b3a9fddf4592fc570f827fc20b6a56b5111ad264122e9a12f45a3c8773bc44fe30f6bf423cf373bb9a953bdeb4cdf
-
Filesize
378KB
MD5ee44d9b14c4f61c1576f85b48cdf83ef
SHA12a198c538f7198068bca9718e7361288a3718b88
SHA2568373c92287deabf57a66e9546873732743c331ac187da723107d9edf448d8147
SHA51248a671a6896a635d47a635111b7f01d9bd3b3a9fddf4592fc570f827fc20b6a56b5111ad264122e9a12f45a3c8773bc44fe30f6bf423cf373bb9a953bdeb4cdf
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
227KB
MD569d468f64dc451287c4d2af9e7e1e649
SHA17799b32a7a3c0e8679dade16ff97e60324e8b93c
SHA256e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451
SHA512b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd
-
Filesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
Filesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9