Analysis
-
max time kernel
274s -
max time network
283s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2023 16:35
Static task
static1
Behavioral task
behavioral1
Sample
clipgrab-3.9.7-dotinstaller.exe
Resource
win10v2004-20231023-en
General
-
Target
clipgrab-3.9.7-dotinstaller.exe
-
Size
2.8MB
-
MD5
0f29445baa824f6729cbda3d90b15cec
-
SHA1
572195b4193529d842653e678eeec7dc3544ee2f
-
SHA256
f980e92af3341650819ca6c985294ebe0aa78d38bdfe249536d7ec7f2efc6ecf
-
SHA512
a05bb0cb18d3c7e0ce5795397beeaee90078c272afccf5211d911eae4bc39078bed7da22c528e77ed4daea1c1b4e736c2f361cdb6e525e4132ba4793e433cc81
-
SSDEEP
49152:9qe3f6PUk/4g+H98AHaCfu6rtWBu1SSmqOIzDamifOL9T9vEXv:MSiPUk/XE9vBugtL1SNaRLh9vEXv
Malware Config
Signatures
-
Renames multiple (93) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266" unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP" unregmp2.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation QtWebEngineProcess.exe -
Executes dropped EXE 36 IoCs
pid Process 3148 clipgrab-3.9.7-dotinstaller.tmp 4336 clipgrab-3.9.7-portable.exe 4520 clipgrab-3.9.7-portable.tmp 3040 vc_redist.x86.exe 3680 vc_redist.x86.exe 4292 clipgrab.exe 3536 ffmpeg.exe 4452 ffmpeg.exe 2744 python.exe 4324 python.exe 5072 python.exe 1312 python.exe 4672 python.exe 3108 python.exe 4952 python.exe 2180 python.exe 3488 python.exe 3184 python.exe 1504 python.exe 4336 python.exe 2500 python.exe 4892 QtWebEngineProcess.exe 3888 QtWebEngineProcess.exe 2176 QtWebEngineProcess.exe 4148 python.exe 1512 python.exe 5116 python.exe 3120 QtWebEngineProcess.exe 4376 python.exe 4780 python.exe 4076 python.exe 4696 QtWebEngineProcess.exe 4520 python.exe 3520 python.exe 4928 ffmpeg.exe 924 ffmpeg.exe -
Loads dropped DLL 64 IoCs
pid Process 3148 clipgrab-3.9.7-dotinstaller.tmp 3148 clipgrab-3.9.7-dotinstaller.tmp 3148 clipgrab-3.9.7-dotinstaller.tmp 3680 vc_redist.x86.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 2744 python.exe 2744 python.exe 4324 python.exe 4324 python.exe 5072 python.exe 5072 python.exe 1312 python.exe 1312 python.exe 4672 python.exe 4672 python.exe 3108 python.exe 3108 python.exe 4952 python.exe 4952 python.exe 2180 python.exe 2180 python.exe 3488 python.exe 3488 python.exe 3184 python.exe 3184 python.exe 1504 python.exe 1504 python.exe 4336 python.exe 4336 python.exe 2500 python.exe 2500 python.exe 4892 QtWebEngineProcess.exe 4892 QtWebEngineProcess.exe 4892 QtWebEngineProcess.exe 4892 QtWebEngineProcess.exe 4892 QtWebEngineProcess.exe 4892 QtWebEngineProcess.exe 4892 QtWebEngineProcess.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini unregmp2.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ClipGrab\python\is-EQIEN.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\Qt5Positioning.dll clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-HU5MP.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-DJ8S0.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-4K3SH.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\clipgrab.exe clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\ffmpeg.exe clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-A0C7S.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-LFHGV.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\python\sqlite3.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\python\python.exe clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-7OSLQ.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-5PTCN.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-KQUN8.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\imageformats\qsvg.dll clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\iconengines\is-398UH.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-7JV88.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-0HRT0.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-MDT97.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\D3Dcompiler_47.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\opengl32sw.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\Qt5WebChannel.dll clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\position\is-VB9PQ.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\resources\is-69PCQ.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-MPDQ2.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\resources\is-G6BDP.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\imageformats\is-SQKVO.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-ALM10.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\Qt5Quick.dll clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-TH1GO.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-EUIR6.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-LCINK.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\imageformats\is-PS350.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\libcrypto-1_1.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\Qt5WebEngineWidgets.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\platforms\qwindows.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\libEGL.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\position\qtposition_serialnmea.dll clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-VH3EH.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-298AK.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-3ED59.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\styles\qwindowsvistastyle.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\imageformats\qico.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\unins000.dat clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\Qt5Qml.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\Qt5PrintSupport.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\Qt5Core.dll clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-G7LL1.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-K4LNV.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-NB5RT.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-FODUH.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\position\qtposition_winrt.dll clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-NBCCS.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\resources\is-JB4G7.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\resources\is-UIUAG.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-UE7T8.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-RTGD1.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\python\vcruntime140.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\imageformats\qgif.dll clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\python\libcrypto-1_1.dll clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\is-NDB7K.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\translations\qtwebengine_locales\is-OC2RS.tmp clipgrab-3.9.7-portable.tmp File created C:\Program Files (x86)\ClipGrab\python\is-OK5GP.tmp clipgrab-3.9.7-portable.tmp File opened for modification C:\Program Files (x86)\ClipGrab\Qt5QuickWidgets.dll clipgrab-3.9.7-portable.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 clipgrab-3.9.7-dotinstaller.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ clipgrab-3.9.7-dotinstaller.tmp -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} clipgrab.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" clipgrab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" clipgrab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867} unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" clipgrab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF} unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg clipgrab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff clipgrab.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags clipgrab.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff clipgrab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ clipgrab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 780031000000000057575c7a1100557365727300640009000400efbe874f7748685792842e000000c70500000000010000000000000000003a0000000000b1e5060155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler" unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 explorer.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 19000000010000001000000060e2dc65295f1062e558f3fef235ed3c030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e1d000000010000001000000054e2cd85ba79cda018fed9e6a863aa461400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b276200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f553000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000132020004700320000000f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b052000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 clipgrab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E clipgrab.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b050b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f51400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa46030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 clipgrab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 clipgrab.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 clipgrab.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 clipgrab.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 4292 clipgrab.exe 2052 explorer.exe 4812 vlc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4520 clipgrab-3.9.7-portable.tmp 4520 clipgrab-3.9.7-portable.tmp 4892 QtWebEngineProcess.exe 4892 QtWebEngineProcess.exe 2176 QtWebEngineProcess.exe 2176 QtWebEngineProcess.exe 3888 QtWebEngineProcess.exe 3888 QtWebEngineProcess.exe 3120 QtWebEngineProcess.exe 3120 QtWebEngineProcess.exe 4696 QtWebEngineProcess.exe 4696 QtWebEngineProcess.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 4292 clipgrab.exe 2104 OpenWith.exe 4812 vlc.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: 35 2744 python.exe Token: 35 4324 python.exe Token: 35 5072 python.exe Token: 35 1312 python.exe Token: 35 4672 python.exe Token: 35 3108 python.exe Token: 35 4952 python.exe Token: 35 2180 python.exe Token: 35 3184 python.exe Token: 35 1504 python.exe Token: 35 4336 python.exe Token: 35 2500 python.exe Token: 35 4148 python.exe Token: 35 1512 python.exe Token: 35 5116 python.exe Token: 35 4780 python.exe Token: 35 4376 python.exe Token: 35 4520 python.exe Token: 35 3520 python.exe Token: SeShutdownPrivilege 4452 unregmp2.exe Token: SeCreatePagefilePrivilege 4452 unregmp2.exe Token: SeShutdownPrivilege 828 wmplayer.exe Token: SeCreatePagefilePrivilege 828 wmplayer.exe Token: 33 212 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 212 AUDIODG.EXE Token: 33 4812 vlc.exe Token: SeIncBasePriorityPrivilege 4812 vlc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3148 clipgrab-3.9.7-dotinstaller.tmp 4520 clipgrab-3.9.7-portable.tmp 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 828 wmplayer.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4292 clipgrab.exe -
Suspicious use of SetWindowsHookEx 46 IoCs
pid Process 3148 clipgrab-3.9.7-dotinstaller.tmp 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 4292 clipgrab.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2104 OpenWith.exe 2052 explorer.exe 2052 explorer.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4292 clipgrab.exe 4292 clipgrab.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 3148 4260 clipgrab-3.9.7-dotinstaller.exe 85 PID 4260 wrote to memory of 3148 4260 clipgrab-3.9.7-dotinstaller.exe 85 PID 4260 wrote to memory of 3148 4260 clipgrab-3.9.7-dotinstaller.exe 85 PID 3148 wrote to memory of 4336 3148 clipgrab-3.9.7-dotinstaller.tmp 99 PID 3148 wrote to memory of 4336 3148 clipgrab-3.9.7-dotinstaller.tmp 99 PID 3148 wrote to memory of 4336 3148 clipgrab-3.9.7-dotinstaller.tmp 99 PID 4336 wrote to memory of 4520 4336 clipgrab-3.9.7-portable.exe 100 PID 4336 wrote to memory of 4520 4336 clipgrab-3.9.7-portable.exe 100 PID 4336 wrote to memory of 4520 4336 clipgrab-3.9.7-portable.exe 100 PID 4520 wrote to memory of 3040 4520 clipgrab-3.9.7-portable.tmp 107 PID 4520 wrote to memory of 3040 4520 clipgrab-3.9.7-portable.tmp 107 PID 4520 wrote to memory of 3040 4520 clipgrab-3.9.7-portable.tmp 107 PID 3040 wrote to memory of 3680 3040 vc_redist.x86.exe 109 PID 3040 wrote to memory of 3680 3040 vc_redist.x86.exe 109 PID 3040 wrote to memory of 3680 3040 vc_redist.x86.exe 109 PID 3148 wrote to memory of 4292 3148 clipgrab-3.9.7-dotinstaller.tmp 110 PID 3148 wrote to memory of 4292 3148 clipgrab-3.9.7-dotinstaller.tmp 110 PID 3148 wrote to memory of 4292 3148 clipgrab-3.9.7-dotinstaller.tmp 110 PID 4292 wrote to memory of 3536 4292 clipgrab.exe 111 PID 4292 wrote to memory of 3536 4292 clipgrab.exe 111 PID 4292 wrote to memory of 3536 4292 clipgrab.exe 111 PID 4292 wrote to memory of 4452 4292 clipgrab.exe 113 PID 4292 wrote to memory of 4452 4292 clipgrab.exe 113 PID 4292 wrote to memory of 4452 4292 clipgrab.exe 113 PID 4292 wrote to memory of 2744 4292 clipgrab.exe 115 PID 4292 wrote to memory of 2744 4292 clipgrab.exe 115 PID 4292 wrote to memory of 2744 4292 clipgrab.exe 115 PID 4292 wrote to memory of 4324 4292 clipgrab.exe 117 PID 4292 wrote to memory of 4324 4292 clipgrab.exe 117 PID 4292 wrote to memory of 4324 4292 clipgrab.exe 117 PID 4292 wrote to memory of 5072 4292 clipgrab.exe 119 PID 4292 wrote to memory of 5072 4292 clipgrab.exe 119 PID 4292 wrote to memory of 5072 4292 clipgrab.exe 119 PID 4292 wrote to memory of 1312 4292 clipgrab.exe 121 PID 4292 wrote to memory of 1312 4292 clipgrab.exe 121 PID 4292 wrote to memory of 1312 4292 clipgrab.exe 121 PID 4292 wrote to memory of 4672 4292 clipgrab.exe 123 PID 4292 wrote to memory of 4672 4292 clipgrab.exe 123 PID 4292 wrote to memory of 4672 4292 clipgrab.exe 123 PID 4292 wrote to memory of 3108 4292 clipgrab.exe 126 PID 4292 wrote to memory of 3108 4292 clipgrab.exe 126 PID 4292 wrote to memory of 3108 4292 clipgrab.exe 126 PID 4292 wrote to memory of 4952 4292 clipgrab.exe 129 PID 4292 wrote to memory of 4952 4292 clipgrab.exe 129 PID 4292 wrote to memory of 4952 4292 clipgrab.exe 129 PID 4292 wrote to memory of 2180 4292 clipgrab.exe 130 PID 4292 wrote to memory of 2180 4292 clipgrab.exe 130 PID 4292 wrote to memory of 2180 4292 clipgrab.exe 130 PID 4292 wrote to memory of 3488 4292 clipgrab.exe 132 PID 4292 wrote to memory of 3488 4292 clipgrab.exe 132 PID 4292 wrote to memory of 3488 4292 clipgrab.exe 132 PID 4292 wrote to memory of 3184 4292 clipgrab.exe 134 PID 4292 wrote to memory of 3184 4292 clipgrab.exe 134 PID 4292 wrote to memory of 3184 4292 clipgrab.exe 134 PID 4292 wrote to memory of 1504 4292 clipgrab.exe 136 PID 4292 wrote to memory of 1504 4292 clipgrab.exe 136 PID 4292 wrote to memory of 1504 4292 clipgrab.exe 136 PID 4292 wrote to memory of 4336 4292 clipgrab.exe 138 PID 4292 wrote to memory of 4336 4292 clipgrab.exe 138 PID 4292 wrote to memory of 4336 4292 clipgrab.exe 138 PID 4292 wrote to memory of 2500 4292 clipgrab.exe 140 PID 4292 wrote to memory of 2500 4292 clipgrab.exe 140 PID 4292 wrote to memory of 2500 4292 clipgrab.exe 140 PID 4292 wrote to memory of 4892 4292 clipgrab.exe 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\clipgrab-3.9.7-dotinstaller.exe"C:\Users\Admin\AppData\Local\Temp\clipgrab-3.9.7-dotinstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\is-US755.tmp\clipgrab-3.9.7-dotinstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-US755.tmp\clipgrab-3.9.7-dotinstaller.tmp" /SL5="$C005E,1907617,1111552,C:\Users\Admin\AppData\Local\Temp\clipgrab-3.9.7-dotinstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\is-55CFH.tmp\clipgrab-3.9.7-portable.exe"C:\Users\Admin\AppData\Local\Temp\is-55CFH.tmp\clipgrab-3.9.7-portable.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\is-GN65O.tmp\clipgrab-3.9.7-portable.tmp"C:\Users\Admin\AppData\Local\Temp\is-GN65O.tmp\clipgrab-3.9.7-portable.tmp" /SL5="$14005C,72952445,791040,C:\Users\Admin\AppData\Local\Temp\is-55CFH.tmp\clipgrab-3.9.7-portable.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\is-AU501.tmp\vc_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-AU501.tmp\vc_redist.x86.exe" /install /passive /silent /norestart5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\Temp\{CC90E180-B911-41C1-948E-9BAD027C078C}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{CC90E180-B911-41C1-948E-9BAD027C078C}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-AU501.tmp\vc_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=648 /install /passive /silent /norestart6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3680
-
-
-
-
-
C:\Program Files (x86)\ClipGrab\clipgrab.exe"C:\Program Files (x86)\ClipGrab\clipgrab.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Program Files (x86)\ClipGrab\ffmpeg.exeffmpeg -v quiet4⤵
- Executes dropped EXE
PID:3536
-
-
C:\Program Files (x86)\ClipGrab\ffmpeg.exeffmpeg -formats4⤵
- Executes dropped EXE
PID:4452
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" -J https://www.youtube.com/playlist?list=PL6B3937A5D230E335 --yes-playlist --flat-playlist4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4672
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3488
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe"C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations --disable-features=MojoVideoCapture,SurfaceSynchronization,UseModernMediaControls,UseVideoCaptureApiForDevToolsSnapshots --disable-databases --disable-gpu-compositing --service-pipe-token=2450320084235667026 --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=2450320084235667026 --renderer-client-id=2 --mojo-platform-channel-handle=2440 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4892
-
-
C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe"C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations --disable-features=MojoVideoCapture,SurfaceSynchronization,UseModernMediaControls,UseVideoCaptureApiForDevToolsSnapshots --disable-databases --disable-gpu-compositing --service-pipe-token=13812915356090712808 --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=13812915356090712808 --renderer-client-id=4 --mojo-platform-channel-handle=2976 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2176
-
-
C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe"C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations --disable-features=MojoVideoCapture,SurfaceSynchronization,UseModernMediaControls,UseVideoCaptureApiForDevToolsSnapshots --disable-gpu-compositing --service-pipe-token=8311026131163439776 --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=8311026131163439776 --renderer-client-id=3 --mojo-platform-channel-handle=2964 /prefetch:14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3888
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" "" --version4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" C:/Users/Admin/AppData/Roaming/ClipGrab/ClipGrab/yt-dlp --version4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" C:/Users/Admin/AppData/Roaming/ClipGrab/ClipGrab/yt-dlp --version4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" C:/Users/Admin/AppData/Roaming/ClipGrab/ClipGrab/yt-dlp -J https://www.youtube.com/playlist?list=PL6B3937A5D230E335 --yes-playlist --flat-playlist4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
-
C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe"C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations --disable-features=MojoVideoCapture,SurfaceSynchronization,UseModernMediaControls,UseVideoCaptureApiForDevToolsSnapshots --disable-databases --disable-gpu-compositing --service-pipe-token=4003375133813516882 --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=4003375133813516882 --renderer-client-id=5 --mojo-platform-channel-handle=3760 /prefetch:14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3120
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" --version4⤵
- Executes dropped EXE
PID:4076
-
-
C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe"C:\Program Files (x86)\ClipGrab\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations --disable-features=MojoVideoCapture,SurfaceSynchronization,UseModernMediaControls,UseVideoCaptureApiForDevToolsSnapshots --disable-databases --disable-gpu-compositing --service-pipe-token=13140319816474194015 --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=13140319816474194015 --renderer-client-id=6 --mojo-platform-channel-handle=3732 /prefetch:14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4696
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" C:/Users/Admin/AppData/Roaming/ClipGrab/ClipGrab/yt-dlp -J --no-playlist https://www.youtube.com/watch?v=WhWc3b3KhnY4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
-
C:\Program Files (x86)\ClipGrab\python\python.exe"C:\Program Files (x86)\ClipGrab\python\python.exe" C:/Users/Admin/AppData/Roaming/ClipGrab/ClipGrab/yt-dlp --newline --no-playlist --no-mtime -o C:/Users/Admin/AppData/Local/Temp/cg-youtube-dl-%(id)s-%(format_id)s.%(ext)s -f 620+140 https://www.youtube.com/watch?v=WhWc3b3KhnY4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3520 -
C:\Program Files (x86)\ClipGrab\ffmpeg.exeffmpeg -bsfs5⤵
- Executes dropped EXE
PID:4928
-
-
C:\Program Files (x86)\ClipGrab\ffmpeg.exeffmpeg -y -loglevel repeat+info -i file:C:\Users\Admin\AppData\Local\Temp\cg-youtube-dl-WhWc3b3KhnY-620+140.f620.mp4 -i file:C:\Users\Admin\AppData\Local\Temp\cg-youtube-dl-WhWc3b3KhnY-620+140.f140.m4a -c copy -map 0:v:0 -map 1:a:0 -movflags +faststart file:C:\Users\Admin\AppData\Local\Temp\cg-youtube-dl-WhWc3b3KhnY-620+140.temp.mp45⤵
- Executes dropped EXE
PID:924
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe /select,C:\Users\Admin\Desktop\Spring - Blender Open Movie.mp44⤵PID:4120
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2104 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Desktop\Spring - Blender Open Movie"2⤵PID:556
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Desktop\Spring - Blender Open Movie"3⤵PID:2160
-
C:\Windows\SysWOW64\unregmp2.exeC:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary4⤵PID:456
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT5⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Modifies registry class
PID:512
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play "C:\Users\Admin\Desktop\Spring - Blender Open Movie"4⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:828
-
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon3⤵PID:2100
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT4⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:3352
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2052 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\Spring - Blender Open Movie.mp4"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4812
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4912
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x440 0x4b81⤵
- Suspicious use of AdjustPrivilegeToken
PID:212
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5357cf7f517757f0689030f196dd7edc0
SHA1248ae43e160e80c81718a9f26544be4e535cf20a
SHA256fd3dd9dcc286e6d36cb7b3fc90c8f7f683d2e9eb449e0433af70118e726d3fe1
SHA512f938d4e81c46bb2d4cea587a9040e6a9eac44942654e07f6b17b3e4d27d31d03b3b5226004a2e981e6c9eaf0c2faf42957607f278c9978f6033c901c93217b7f
-
Filesize
4.9MB
MD5357cf7f517757f0689030f196dd7edc0
SHA1248ae43e160e80c81718a9f26544be4e535cf20a
SHA256fd3dd9dcc286e6d36cb7b3fc90c8f7f683d2e9eb449e0433af70118e726d3fe1
SHA512f938d4e81c46bb2d4cea587a9040e6a9eac44942654e07f6b17b3e4d27d31d03b3b5226004a2e981e6c9eaf0c2faf42957607f278c9978f6033c901c93217b7f
-
Filesize
5.1MB
MD5c8bb97d7265ae7327eab7432c6496cf3
SHA1c8ecab5cc7872a08ebb81edd00e95db85d56d6b5
SHA256bd149755a4b0b7d721f9a355717855f488b16d8cbe177d0d88d9990359f5d4d5
SHA512ec8c71336ff97e54252b3f8558a0471f8a14821ae91f90a32f1e9284eddfba6106d85eff25d5cf19d5273acaedb9ec23daf84e273ec0d6939e3c694e5da47085
-
Filesize
5.1MB
MD5c8bb97d7265ae7327eab7432c6496cf3
SHA1c8ecab5cc7872a08ebb81edd00e95db85d56d6b5
SHA256bd149755a4b0b7d721f9a355717855f488b16d8cbe177d0d88d9990359f5d4d5
SHA512ec8c71336ff97e54252b3f8558a0471f8a14821ae91f90a32f1e9284eddfba6106d85eff25d5cf19d5273acaedb9ec23daf84e273ec0d6939e3c694e5da47085
-
Filesize
1.0MB
MD508b5fcf0369a4923befb05a3e7b91998
SHA14d44449f027120d59bd0c9725dcfe02102acc82e
SHA256de3ef3d9ac16b03a6da9cc076bba081142ccd4a306777b6d1bbaa60980e20723
SHA512629a3c3b3fd6c36a0a9ec93bbd325bd78e5044279720a32eb79041b08989f575c99992f352d710c167b79c19498fa002ae85afbb080302fb001ed0b44465eb06
-
Filesize
1.0MB
MD508b5fcf0369a4923befb05a3e7b91998
SHA14d44449f027120d59bd0c9725dcfe02102acc82e
SHA256de3ef3d9ac16b03a6da9cc076bba081142ccd4a306777b6d1bbaa60980e20723
SHA512629a3c3b3fd6c36a0a9ec93bbd325bd78e5044279720a32eb79041b08989f575c99992f352d710c167b79c19498fa002ae85afbb080302fb001ed0b44465eb06
-
Filesize
259KB
MD592aa5c44793603758874f87ecc5c88ce
SHA1f368193467f61e0edb4864422085e70770c88d76
SHA256798cc99af70288093bfd09a5addfd55a80f9652e7dc79f0b51f7760c47de2c9e
SHA512459b97983c236ad76438615dad7174aa64561c9a0d9fcda7f290411237d97411f503d2dbb2d90f0c61fc229a872971a96ab61bf7b9bfb8b1ea840f4621d10910
-
Filesize
259KB
MD592aa5c44793603758874f87ecc5c88ce
SHA1f368193467f61e0edb4864422085e70770c88d76
SHA256798cc99af70288093bfd09a5addfd55a80f9652e7dc79f0b51f7760c47de2c9e
SHA512459b97983c236ad76438615dad7174aa64561c9a0d9fcda7f290411237d97411f503d2dbb2d90f0c61fc229a872971a96ab61bf7b9bfb8b1ea840f4621d10910
-
Filesize
267KB
MD5c9d5c7d715bbf74c31aab14893698778
SHA1ee62edb71acb9eda4cb5f213a0b94940b972d7b3
SHA25612717098b4d3f5f09ec19d091d1beb26d6df35e586bee511b9138be42d644e4a
SHA512ee67880a737d1ec7c14cf84f20994bd34d8c8e39fc1763b634c311bc200ab6153f2f6760b217517a6190ccdf8076f4f9055062a011b3115c653c0ae4c5837330
-
Filesize
267KB
MD5c9d5c7d715bbf74c31aab14893698778
SHA1ee62edb71acb9eda4cb5f213a0b94940b972d7b3
SHA25612717098b4d3f5f09ec19d091d1beb26d6df35e586bee511b9138be42d644e4a
SHA512ee67880a737d1ec7c14cf84f20994bd34d8c8e39fc1763b634c311bc200ab6153f2f6760b217517a6190ccdf8076f4f9055062a011b3115c653c0ae4c5837330
-
Filesize
3.2MB
MD5b92764b31b080972ad0682a0ba794db1
SHA1a4b3b253da4078a0b9d536873a6e79a4ba070ad2
SHA2564706a5ef8f1092da9d60af8722546ce8f23c98db7450c3f72521d4651aeb2a52
SHA512077c7c285c038cec271fe21a2b77eaadf3ec7d6a288d24234d6e351bead294b7bb903ea2759cb852d8e3d0354fbac926292639375d82d4dbeb85e4c515ef4369
-
Filesize
3.2MB
MD5b92764b31b080972ad0682a0ba794db1
SHA1a4b3b253da4078a0b9d536873a6e79a4ba070ad2
SHA2564706a5ef8f1092da9d60af8722546ce8f23c98db7450c3f72521d4651aeb2a52
SHA512077c7c285c038cec271fe21a2b77eaadf3ec7d6a288d24234d6e351bead294b7bb903ea2759cb852d8e3d0354fbac926292639375d82d4dbeb85e4c515ef4369
-
Filesize
3.0MB
MD57a517d5ee706c979876b97c789be8968
SHA17efc77f592389f94aa6980ecd3da7d39c960765f
SHA256beb08a06b24ae1668441d47fbd434daa40ef6c4c45963351a0a6acdcd550bc31
SHA5122656d980b31c5f6c34fae8b9ea719c06481195af6ff8b93a6297cae74783a2eaf6b808d539add7a1490e159ee19d2889308adb48491d719097d5459a7f798287
-
Filesize
3.0MB
MD57a517d5ee706c979876b97c789be8968
SHA17efc77f592389f94aa6980ecd3da7d39c960765f
SHA256beb08a06b24ae1668441d47fbd434daa40ef6c4c45963351a0a6acdcd550bc31
SHA5122656d980b31c5f6c34fae8b9ea719c06481195af6ff8b93a6297cae74783a2eaf6b808d539add7a1490e159ee19d2889308adb48491d719097d5459a7f798287
-
Filesize
64KB
MD542ce360f532e7e835ee94ee1226e1c19
SHA16c596c32575f081c86524742fcb11aa5e44ad213
SHA2566b12b555d3bc465e106a26603b4bead895134ecd90b3201773415eab64cc69ac
SHA5128f2772be5a6e375f06439f58c4b26277f93b8b777c950640c4699de6e0b0a99f7f33ebc6eac4b3a87a1e1b644c573b7ae5de9289d399fa41d732867c1bf95508
-
Filesize
64KB
MD542ce360f532e7e835ee94ee1226e1c19
SHA16c596c32575f081c86524742fcb11aa5e44ad213
SHA2566b12b555d3bc465e106a26603b4bead895134ecd90b3201773415eab64cc69ac
SHA5128f2772be5a6e375f06439f58c4b26277f93b8b777c950640c4699de6e0b0a99f7f33ebc6eac4b3a87a1e1b644c573b7ae5de9289d399fa41d732867c1bf95508
-
Filesize
96KB
MD52a65f4f49a88417222bcf109b59247ef
SHA1a165ff1b21ff45c11783b63f2f4e9f270f84f05e
SHA256632a5d720f3f6371721f94e4665ac13988afde722d155aaa5364a27cbd46d3ac
SHA512c260fdb3454994e15582feec31b63e8418c9b1d705ee06ac09aa4ac77782ac79f722c9c883714e462ef919834ddd569ea7fff2b7d616a2b210966013c8ad9add
-
Filesize
96KB
MD52a65f4f49a88417222bcf109b59247ef
SHA1a165ff1b21ff45c11783b63f2f4e9f270f84f05e
SHA256632a5d720f3f6371721f94e4665ac13988afde722d155aaa5364a27cbd46d3ac
SHA512c260fdb3454994e15582feec31b63e8418c9b1d705ee06ac09aa4ac77782ac79f722c9c883714e462ef919834ddd569ea7fff2b7d616a2b210966013c8ad9add
-
Filesize
56.7MB
MD5cfa7e9d45cff6a9db2735ad94a1fac03
SHA1f2b5ca141315a2bc064ea61df186f85b0d141eb5
SHA2564ae899629fc79404bd166219bdde96a5cd169b7470375fb0f9c845c652402a65
SHA512ed11a789437d3aca2036fbe364649f0b079f79d72fa6810063a0f12bf8a5b6e99dbe9af4d73202af2790e2569261f434a92a089984f15a820bea63ce6095b561
-
Filesize
56.7MB
MD5cfa7e9d45cff6a9db2735ad94a1fac03
SHA1f2b5ca141315a2bc064ea61df186f85b0d141eb5
SHA2564ae899629fc79404bd166219bdde96a5cd169b7470375fb0f9c845c652402a65
SHA512ed11a789437d3aca2036fbe364649f0b079f79d72fa6810063a0f12bf8a5b6e99dbe9af4d73202af2790e2569261f434a92a089984f15a820bea63ce6095b561
-
Filesize
56.7MB
MD5cfa7e9d45cff6a9db2735ad94a1fac03
SHA1f2b5ca141315a2bc064ea61df186f85b0d141eb5
SHA2564ae899629fc79404bd166219bdde96a5cd169b7470375fb0f9c845c652402a65
SHA512ed11a789437d3aca2036fbe364649f0b079f79d72fa6810063a0f12bf8a5b6e99dbe9af4d73202af2790e2569261f434a92a089984f15a820bea63ce6095b561
-
Filesize
187KB
MD59c30ad3a2ba28362ac506f50221e881d
SHA102497e8d0544d91318a2b6619b7c154cebee1073
SHA256ce773742d6d80df75e9e462bd38bf237508541b3243dad57c48b4eb24f4ff3f1
SHA51250bb8ac0f02bebe6aaa09554bfe8dd575681810239edeeb696b8170a8f4c3457a4ff3bf2e7ad9ed1b6a6c54f81201988c8e347f1fbff4e2ea2d348a72ca9aa70
-
Filesize
187KB
MD59c30ad3a2ba28362ac506f50221e881d
SHA102497e8d0544d91318a2b6619b7c154cebee1073
SHA256ce773742d6d80df75e9e462bd38bf237508541b3243dad57c48b4eb24f4ff3f1
SHA51250bb8ac0f02bebe6aaa09554bfe8dd575681810239edeeb696b8170a8f4c3457a4ff3bf2e7ad9ed1b6a6c54f81201988c8e347f1fbff4e2ea2d348a72ca9aa70
-
Filesize
4.3MB
MD5db7034b133d238447a6f3704b65bbceb
SHA1c834d45162f38f461a8eafe737301eb22056e913
SHA25653d9f928141382a5ef60039562b200e03d18e8720f16fb0ee8072b45e94202a7
SHA512837b7e675b752c372973ecb4a53de568fc087e5f3896916614d504405a0a1ae78d1be59f173c2a0b28b4b139924736208de2eb6ee767c78894b7834fae9bf9f1
-
Filesize
4.3MB
MD5db7034b133d238447a6f3704b65bbceb
SHA1c834d45162f38f461a8eafe737301eb22056e913
SHA25653d9f928141382a5ef60039562b200e03d18e8720f16fb0ee8072b45e94202a7
SHA512837b7e675b752c372973ecb4a53de568fc087e5f3896916614d504405a0a1ae78d1be59f173c2a0b28b4b139924736208de2eb6ee767c78894b7834fae9bf9f1
-
Filesize
149KB
MD5fd0f95e872b99b61f0b7276e0ff76c28
SHA1a90b20be2f436362782ac18182637f8dca1e9719
SHA2569150d32aa158f9c555cc3b845fc8f776684f11ec014b47a96d498faad67e7a31
SHA51225a4e5d74315f64171c16929da0fa049db9dd835cb912e2909bf442fc6383a424cdd52aec58c6eb6d335697651deff16f688ecac8c11310a1fe7383996bdcd94
-
Filesize
149KB
MD5fd0f95e872b99b61f0b7276e0ff76c28
SHA1a90b20be2f436362782ac18182637f8dca1e9719
SHA2569150d32aa158f9c555cc3b845fc8f776684f11ec014b47a96d498faad67e7a31
SHA51225a4e5d74315f64171c16929da0fa049db9dd835cb912e2909bf442fc6383a424cdd52aec58c6eb6d335697651deff16f688ecac8c11310a1fe7383996bdcd94
-
Filesize
1.1MB
MD557cdd2bc92aee7d3d213561188e565d4
SHA1fb34ba0178b5764b6ccc9d228796196ee172980e
SHA25610770da581cc85d55a286d42a0428accafe6c7910bc640cc4264da7fb26dafa4
SHA512ac00f5021cbc34b7ca160364cdde0a404353d8fc9e6a46866884268880c7b753e91741c48b413d6f7a5ff28a4e3d98bd7485550b46009a7c5b42dd0a877f3856
-
Filesize
1.1MB
MD557cdd2bc92aee7d3d213561188e565d4
SHA1fb34ba0178b5764b6ccc9d228796196ee172980e
SHA25610770da581cc85d55a286d42a0428accafe6c7910bc640cc4264da7fb26dafa4
SHA512ac00f5021cbc34b7ca160364cdde0a404353d8fc9e6a46866884268880c7b753e91741c48b413d6f7a5ff28a4e3d98bd7485550b46009a7c5b42dd0a877f3856
-
Filesize
1.1MB
MD557cdd2bc92aee7d3d213561188e565d4
SHA1fb34ba0178b5764b6ccc9d228796196ee172980e
SHA25610770da581cc85d55a286d42a0428accafe6c7910bc640cc4264da7fb26dafa4
SHA512ac00f5021cbc34b7ca160364cdde0a404353d8fc9e6a46866884268880c7b753e91741c48b413d6f7a5ff28a4e3d98bd7485550b46009a7c5b42dd0a877f3856
-
Filesize
49.8MB
MD5bf955dfb106a42076aed62fc99ae73d9
SHA1026353b9f9a1d4fd365bdf0890a16c1d6f2a64c6
SHA256e79d9b4bd7b0420b974eb58eb15d6f072ee939f98acc93314a4cc750c6b7099d
SHA512c86c8027087fecc0317bfdd6db9bccdf6bd42fc1eac77da400cfefe7f9aed9bf06ed5817f2dad02e423e4f33b6bd522598a3eb52e56c2a31bf58d811e26b952f
-
Filesize
49.8MB
MD5bf955dfb106a42076aed62fc99ae73d9
SHA1026353b9f9a1d4fd365bdf0890a16c1d6f2a64c6
SHA256e79d9b4bd7b0420b974eb58eb15d6f072ee939f98acc93314a4cc750c6b7099d
SHA512c86c8027087fecc0317bfdd6db9bccdf6bd42fc1eac77da400cfefe7f9aed9bf06ed5817f2dad02e423e4f33b6bd522598a3eb52e56c2a31bf58d811e26b952f
-
Filesize
49.8MB
MD5bf955dfb106a42076aed62fc99ae73d9
SHA1026353b9f9a1d4fd365bdf0890a16c1d6f2a64c6
SHA256e79d9b4bd7b0420b974eb58eb15d6f072ee939f98acc93314a4cc750c6b7099d
SHA512c86c8027087fecc0317bfdd6db9bccdf6bd42fc1eac77da400cfefe7f9aed9bf06ed5817f2dad02e423e4f33b6bd522598a3eb52e56c2a31bf58d811e26b952f
-
Filesize
33KB
MD50a8e8b38e75ce6b65e31e93175717030
SHA12ebb52d5373feb5a137188d98645b87b03cd89dd
SHA25606b1d5a15af5bdb413b9335a508084383a6db6a52b80773a5ca762d4d060ff2e
SHA512ddc6e40a1c1c76a385bad06e9a653da6e8c2515292b2e0c6fb8e7fe005ccdbd2cd6c83c3f7960feb72862d89b10e20762ad6c142451e73afa5651f4eb725b8ad
-
Filesize
30KB
MD5bc3a9bedb27c0985e5b406715546b289
SHA1b20ba051b0bc966649493f6bda675002000d0632
SHA25616190622ddbb8c604233cc8f6ac97768fadc645aca3d6ec81f61149804cfe031
SHA51264878b67f478fb2f205d781a9287723239d09303ef7fa0a1ecdd3f7dfa6017f06dfa3e924b7ff8078f8081d50e9dfe181e2e8e2f8741d703b5c099e5bdd9404a
-
Filesize
30KB
MD59dba627908eac32a713b1c6e897be3ec
SHA10eadaed43503e05aadee9695adf7e1c64b0379e7
SHA25613a3cc5e68d4f5e5449c10e88476660d4d49a5e00eee8b942011a5ac49592eb6
SHA5129041a82e0378a7ec9e289d46a49109d97e1e0fdb3d53a4ef650488dfcff9cbc7973eeb09f692c3d47347e2d79df48f47aad58d00b2fe31584216cb10648de552
-
Filesize
361KB
MD5cc91e7b735389b1e2d312606056065aa
SHA1f82c4881f37b28e8da5c4732f0f02c87e178931d
SHA2560247fc16049a322f34407ab5eef4870e24a033e8042d6271b4e8a6c7c6fe8bdf
SHA51200ba39fdf121dc9f84fb24fd455c9459b9126b6efd2db2ee31866422f57eba3cb341ca8d5d172d3b32206794de2b498ef115f965ad5c55a669717439ba43ad4c
-
Filesize
26KB
MD5c5891397f0c8daae3dc5f4f701980802
SHA18e2a1f1891036d59aaf068ff9cdd3ee1ba8638e2
SHA2567b066fb4d52ae0f4dd05569a1049329fd17dd461675543443c924ca1be26aad7
SHA5126827de90f1351505c301b414de464b291d2b1eeccb5694191de6a9d2233dfff6ade6165c4b8c43a523f3ea0b30ba67366d9e4419c6e359af42030c91f83e2635
-
Filesize
24KB
MD5da5c04a80b552b274a8e01729c65aff2
SHA1c9f0ca9c3b0fd5cd3a420a8122f99bc74b802caf
SHA256265626b75d68ecefe32d8edb228afce5a0ece33a7bf3b63497cea29b17e27eac
SHA512e0e69a6406ccd2b3e382d01f9544a5124b305b5776c68df75983b330ca0615b424fe668b1c32a796990afab299c4caa6611dc134b825ee89088c8dd041313e90
-
Filesize
410KB
MD5a3b4161c22f15fbc0d1d04b933a31537
SHA1f11c6ef92c5355de26a0f1bb92b84118146f0fd0
SHA256c71f62c2184960343299768f6c6e080a68e864e1db70c9816844afa53b4ca778
SHA51247a9cec46ee86e2d9be5e7af4a56e78837af50300fef316cdf091ba1e3a93979d99ad481ce351bdd078b23113b9f6f242c70f9f1fa5dbc0c80e1a576a85bb061
-
Filesize
21KB
MD555813372944c5acaca0e38c22902a6e6
SHA18c3fbdcacecc971aac8823a52eb83082669220a3
SHA256fc219ad27720cfb1b223d748c1b5bdd78886235f4254bfe8e0adaf168c7e9849
SHA51273f504a1f7cda4082f370387304db701672d95409886362dd70f8599fc17a5b577d2b37dd8f012cecb6d6dffe4321906c2a07cdd7e12e2d31bb9df0fb2e97a7f
-
Filesize
21KB
MD555813372944c5acaca0e38c22902a6e6
SHA18c3fbdcacecc971aac8823a52eb83082669220a3
SHA256fc219ad27720cfb1b223d748c1b5bdd78886235f4254bfe8e0adaf168c7e9849
SHA51273f504a1f7cda4082f370387304db701672d95409886362dd70f8599fc17a5b577d2b37dd8f012cecb6d6dffe4321906c2a07cdd7e12e2d31bb9df0fb2e97a7f
-
Filesize
2.7MB
MD502c59344a65e9893d7d2d0d79b570429
SHA1d07d73aab1beaeeef57c03330add64afa5f20160
SHA256adba2649650fa580fb301b69a74aa4ad0b8796a6b35179ff0a938be510db1b7d
SHA512222ffdb94f4df18d25e5d77cb76ff95c0704dbd696796880bdc7c23c930546435ac5060233f3be9a5b2c058a721c15ffc542b9ba84aafe28dfc77498037f21df
-
Filesize
2.7MB
MD502c59344a65e9893d7d2d0d79b570429
SHA1d07d73aab1beaeeef57c03330add64afa5f20160
SHA256adba2649650fa580fb301b69a74aa4ad0b8796a6b35179ff0a938be510db1b7d
SHA512222ffdb94f4df18d25e5d77cb76ff95c0704dbd696796880bdc7c23c930546435ac5060233f3be9a5b2c058a721c15ffc542b9ba84aafe28dfc77498037f21df
-
Filesize
2.4MB
MD5c58b2589b88c5da34df20f737b7ac50c
SHA105ed6edafd5342b546fb5d5a6162695f11f5d4da
SHA25649b26d14cf68a370de47f8f3724e46e61bff98aba7dd7b8a7c1f87e83bb44064
SHA5124e2db4133fdb69dcc7a03201810b10cf9519dd7cdea8ff3fc496779d84556502cdb562d67f60a0503493705b622d1cb772fc9acb4935aa4fb6a6cbdf7b4b211f
-
Filesize
2.4MB
MD5c58b2589b88c5da34df20f737b7ac50c
SHA105ed6edafd5342b546fb5d5a6162695f11f5d4da
SHA25649b26d14cf68a370de47f8f3724e46e61bff98aba7dd7b8a7c1f87e83bb44064
SHA5124e2db4133fdb69dcc7a03201810b10cf9519dd7cdea8ff3fc496779d84556502cdb562d67f60a0503493705b622d1cb772fc9acb4935aa4fb6a6cbdf7b4b211f
-
Filesize
518KB
MD56464921a380a4aca2966912286a07161
SHA1bb5b62f6be640aa217c4193e283a1e58d0d0d815
SHA256194473a59a69e72655015dc582f1e1db7476b598c07cd94839d500e0c7135265
SHA512b73f4d8897efac5f7d2bc65f32d3d46e54b691c60828fa10605a46c872e3920fd78f17727ff5721fec89d53e6214f07e8002972fe65e502cb0522efc63599fd2
-
Filesize
518KB
MD56464921a380a4aca2966912286a07161
SHA1bb5b62f6be640aa217c4193e283a1e58d0d0d815
SHA256194473a59a69e72655015dc582f1e1db7476b598c07cd94839d500e0c7135265
SHA512b73f4d8897efac5f7d2bc65f32d3d46e54b691c60828fa10605a46c872e3920fd78f17727ff5721fec89d53e6214f07e8002972fe65e502cb0522efc63599fd2
-
Filesize
1.2MB
MD5b190c721612ac9d169f8b3a8f8b48a29
SHA1206442dd161e878f1a6f83f3ebdb9208b56abfff
SHA256ccb562f817d7015c78da4098bc576e7eaf3df1ebd55afb58d75f12dace9c761f
SHA512951bc91302fcb1a28b7093f6867b379a90188733cec329efedb465ae27ae1a526a2d5f997816b26ed123d2401a9aa2854d26a003a65318f50e3a695d7948f6b7
-
Filesize
1.2MB
MD5b190c721612ac9d169f8b3a8f8b48a29
SHA1206442dd161e878f1a6f83f3ebdb9208b56abfff
SHA256ccb562f817d7015c78da4098bc576e7eaf3df1ebd55afb58d75f12dace9c761f
SHA512951bc91302fcb1a28b7093f6867b379a90188733cec329efedb465ae27ae1a526a2d5f997816b26ed123d2401a9aa2854d26a003a65318f50e3a695d7948f6b7
-
Filesize
95KB
MD5083f4389a5cb405d0ab6a85952ea14f9
SHA1ac1aad1677c95b9de407f517cbc9432943c7f432
SHA256ca9f2a394ea9a7e0ee58cc39c7f2dceb4d539223dfbada1124a215921b0d767d
SHA5127e7a71b7ca969008d2718a43862504e747644617bd27f64fb21228c6a0d8aa5f75bebab7827b0d2fe88d3d04ea22eaf0799d6635f1b1609b946440cd4dcd040d
-
Filesize
125KB
MD5c1cc204987a532be5e7f22b2bec82815
SHA103ea72517453ab137c3b85194cbf8bf08c05d032
SHA256f08b95bac860f6292342e5e2e3e506a603cd8d7f4a0e4a1b5d8fafa7c30cd65d
SHA512684d653a777361d732b7383a7b699809e8c1e74bb04eff2b74a92ec860c305290014f5627eb56597ea1f3d1d5ed0e4167c0c62778e176d2d8615fe07404290af
-
Filesize
125KB
MD5c1cc204987a532be5e7f22b2bec82815
SHA103ea72517453ab137c3b85194cbf8bf08c05d032
SHA256f08b95bac860f6292342e5e2e3e506a603cd8d7f4a0e4a1b5d8fafa7c30cd65d
SHA512684d653a777361d732b7383a7b699809e8c1e74bb04eff2b74a92ec860c305290014f5627eb56597ea1f3d1d5ed0e4167c0c62778e176d2d8615fe07404290af
-
Filesize
64KB
MD5fc240c081ec382df4b74d591d7d37a45
SHA1396e9d8accb2ff8b32e6c3957808cb87d23ad47c
SHA2568cfeb277627a0fc9f2596c83dc37f9a3d8871293cd88dadd08f32098bf936038
SHA512d8f83773c330b88b43f9ebc6220aa98368854e44a75b73a8575e7171f6c32e784d404e5a2e2e7787d3c71c0cfecdbb983631b639d9fee879b374d498d2ef0ab7
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
140.6MB
MD5d929b8237afaecab54e85cb716595687
SHA18d5c5f8aab07ff952f276fedff34b74c23af713d
SHA2563b1d9a7eebfa5502ac8fc203a4b5cf894826ecd09f5cb8d54947bd7a4f9a04f3
SHA51280c253c85347ade9237f86fe3ff61f67f189cfca551a313fcd0342f49908e79c003df397276db54038ec499e08051c97e8ce1e7dd35118eedce337c9f453239b
-
Filesize
74KB
MD5cd09f361286d1ad2622ba8a57b7613bd
SHA14cd3e5d4063b3517a950b9d030841f51f3c5f1b1
SHA256b92a31d4853d1b2c4e5b9d9624f40b439856d0c6a517e100978cbde8d3c47dc8
SHA512f73d60c92644e0478107e0402d1c7b4dfa1674f69b41856f74f937a7b57ceaa2b3be9242f2b59f1fcf71063aac6cbe16c594618d1a8cdd181510de3240f31dff
-
Filesize
33KB
MD5db6c259cd7b58f2f7a3cca0c38834d0e
SHA1046fd119fe163298324ddcd47df62fa8abcae169
SHA256494169cdd9c79eb4668378f770bfa55d4b140f23a682ff424441427dfab0ced2
SHA512a5e8bb6dc4cae51d4ebbe5454d1b11bc511c69031db64eff089fb2f8f68665f4004f0f215b503f7630a56c995bbe9cf72e8744177e92447901773cc7e2d9fdbb
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
70.3MB
MD5962d6f9e7331b8f3eb2fa4acb15f5f61
SHA12e1a7e9ec7159e564814a599657d42dc01ef9858
SHA2560ae8656f4c65673d75544cff54721cbfc586edd6e8b4b2a2070930684920411e
SHA512f8721fc68703d6a6ab9188bce1d64774447f02f378dd4b4d267f7fb4b01d42c4520feede2855ab426d92dfc538a1d272d7a88e65871015a95654c3d8f321d3be
-
Filesize
70.3MB
MD5962d6f9e7331b8f3eb2fa4acb15f5f61
SHA12e1a7e9ec7159e564814a599657d42dc01ef9858
SHA2560ae8656f4c65673d75544cff54721cbfc586edd6e8b4b2a2070930684920411e
SHA512f8721fc68703d6a6ab9188bce1d64774447f02f378dd4b4d267f7fb4b01d42c4520feede2855ab426d92dfc538a1d272d7a88e65871015a95654c3d8f321d3be
-
Filesize
2KB
MD57afaf9e0e99fd80fa1023a77524f5587
SHA1e20c9c27691810b388c73d2ca3e67e109c2b69b6
SHA256760b70612bb9bd967c2d15a5133a50ccce8c0bd46a6464d76875298dcc45dea0
SHA512a090626e7b7f67fb5aa207aae0cf65c3a27e1b85e22c9728eee7475bd9bb7375ca93baaecc662473f9a427b4f505d55f2c61ba36bda460e4e6947fe22eedb044
-
Filesize
10KB
MD5f23a523b82ad9103a9ac1dcc33eca72f
SHA15363bb6b51923441ef56638576307cc252f05a71
SHA25659853c413b0813ded6f1e557959768d6662f010f49884d36b62c13038fac739c
SHA512514ec63f7ed80d0708f7e2355fad8a558b4dcf2d0122ff98fe7c3ca1f40e7cd04e8869ca7a3b95622c0848c0d99306d7e791b86ca69b9e240beae959ca6285be
-
Filesize
9KB
MD52c050a55ade91ca10c94c41fdceaa8cb
SHA1178fd0ee1c184fe681d89bff0ff8b89392723a67
SHA25643262c9cc6328d67007b97a8eb36c924d05d45a383349e61b067f35677e1ad6e
SHA512425825cbe2a417f10832c37fc0e571ca3e3f9b940f93f9f8ec8fcff2df896a52ff753386c30e03836d588b6bf355323dbea2e3a0cbf756f8f3c7065335cbfeac
-
Filesize
2.0MB
MD5e1f18a22199c6f6aa5d87b24e5b39ef1
SHA10dcd8f90b575f6f1d10d6789fe769fa26daafd0e
SHA25662c56c8cf2ac6521ce047b73aa99b6d3952ca53f11d34b00e98d17674a2fc10d
SHA5125a10a2f096adce6e7db3a40bc3ea3fd44d602966e606706ee5a780703f211de7f77656c79c296390baee1e008dc3ce327eaaf5d78bbae20108670c5bc809a190
-
Filesize
14.0MB
MD5310f8aadd8055f8b8eba1a6528be7d10
SHA13ee9622151e4b50837fcdfac1b085430f0181f4e
SHA25654ad46ae80984aa48cae6361213692c96b3639e322730d28c7fb93b183c761da
SHA5122872a30939f7ee20b494806574cf5b8b5a0976f8fe69bdbd77dde2483ce2a9e5458ff3636147e49a449e941a44ca2d79239e3da62fddb69fc5bced8ee1004ee5
-
Filesize
14.0MB
MD5310f8aadd8055f8b8eba1a6528be7d10
SHA13ee9622151e4b50837fcdfac1b085430f0181f4e
SHA25654ad46ae80984aa48cae6361213692c96b3639e322730d28c7fb93b183c761da
SHA5122872a30939f7ee20b494806574cf5b8b5a0976f8fe69bdbd77dde2483ce2a9e5458ff3636147e49a449e941a44ca2d79239e3da62fddb69fc5bced8ee1004ee5
-
Filesize
2.5MB
MD5ae7b203e80eaa5afb50768049bb3de50
SHA1cc0b5d64c2af21a3b24e167352df8ae93acd30d3
SHA256ffe5d85efc5b75b4c99b07f5819d1fb3b9b1b42e67c903ef86f013bdedad7112
SHA512a94cc199a4fa8a67496169de972bef84dd0e411502c5f74438ec0e7d18626ef3278d9c3aae1b0d025776849dbed5ec8e06d714b4bd48a43e48e2a167f7d52748
-
Filesize
2.5MB
MD5ae7b203e80eaa5afb50768049bb3de50
SHA1cc0b5d64c2af21a3b24e167352df8ae93acd30d3
SHA256ffe5d85efc5b75b4c99b07f5819d1fb3b9b1b42e67c903ef86f013bdedad7112
SHA512a94cc199a4fa8a67496169de972bef84dd0e411502c5f74438ec0e7d18626ef3278d9c3aae1b0d025776849dbed5ec8e06d714b4bd48a43e48e2a167f7d52748
-
Filesize
3.2MB
MD5aadc16c8ad4312196df3aa1d9f6386d3
SHA1ff4d78923e0d957e6a66b3c06efecc435c396c7a
SHA25604fade43204ecbbb378114a023b3db4a3aebe8258ff3b3846156e80a9c5cf4a3
SHA51251621ec71d530d75e4a537381edf03bc48b234dd861547c950573febf5709a1716ee797368854512edf1950a4e1f4f8bbe292417a0dd238600338a39e2454e04
-
Filesize
177KB
MD5f1a281f74d3e91d16dd26d1f313cd8a9
SHA1ddb2ca9032c5a9c091eac53b679f6ba428077b00
SHA256f79108a254f876e0f6bbcb05a9effbe25dc252e7ea256bfe3fd28ceb79737f25
SHA512484c5ca26275427e1fb74d3217a22a0e4aac409aba973e78d7ad68834e7ad1d86c7855d34b227925200f941d288dfc09477b2d7dfe0856810c6c847297b8d625
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
881KB
MD59df0848b2753e9255f1a6b4cdc9a5a3e
SHA1051469cd9e786b720ef6b70c35a1e184a643f520
SHA25659089badd61acb47a07748c9018d3a959cf58f07de9902b0c45dffae3e566090
SHA512518a78e77515b2fb21c5f66a760473a1f8ab5050e9bc65a4715ab178e568079f11f65fc173db59dd021b69fe0b606c42e50bf5f09a34ba2009a7b71e88033452
-
Filesize
881KB
MD59df0848b2753e9255f1a6b4cdc9a5a3e
SHA1051469cd9e786b720ef6b70c35a1e184a643f520
SHA25659089badd61acb47a07748c9018d3a959cf58f07de9902b0c45dffae3e566090
SHA512518a78e77515b2fb21c5f66a760473a1f8ab5050e9bc65a4715ab178e568079f11f65fc173db59dd021b69fe0b606c42e50bf5f09a34ba2009a7b71e88033452