Resubmissions
29-02-2024 11:03
240229-m5q8hafd86 129-02-2024 11:00
240229-m335aaeh41 629-02-2024 10:39
240229-mqdnvsec81 10Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-02-2024 10:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://roblox.xom
Resource
win11-20240221-en
Errors
General
-
Target
http://roblox.xom
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\MicrosoftWindowsServicesEtc\\xRunReg.vbs\"" wscript.exe -
Processes:
wscript.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
wscript.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1" wscript.exe -
Disables Task Manager via registry modification
-
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 1796 icacls.exe 4968 takeown.exe 1320 icacls.exe 1512 takeown.exe -
Executes dropped EXE 4 IoCs
Processes:
MrsMajor2.0.exeeula32.exeGetReady.exenotmuch.exepid process 3512 MrsMajor2.0.exe 3896 eula32.exe 3332 GetReady.exe 4556 notmuch.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 1512 takeown.exe 1796 icacls.exe 4968 takeown.exe 1320 icacls.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Microsoft\Windows\CurrentVersion\Run\MajorX = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xRun.vbs\"" wscript.exe -
Drops file in System32 directory 2 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\System32\taskmgr.exe cmd.exe File opened for modification C:\Windows\System32\sethc.exe cmd.exe -
Drops file in Program Files directory 37 IoCs
Processes:
wscript.exedescription ioc process File created C:\program files\MicrosoftWindowsServicesEtc\data\eula32.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\healgen.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\NotMuch.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\rsod.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\DgzRun.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\majorsod.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\RuntimeChecker.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\breakrule.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\breakrule.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\bsod.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\thetruth.jpg wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\GetReady.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\bsod.bat wscript.exe File opened for modification C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\CallFunc.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\Major.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\xRun.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\clingclang.wav wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\excursor.ani wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\fileico.ico wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\Major.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\majorsod.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\WinScrew.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\checker.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\majorlist.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\WinScrew.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\runner32s.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\fexec.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\majordared.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\xRunReg.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\example.txt wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\cmd.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\GetReady.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\majorlist.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\runner32s.vbs wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies Control Panel 4 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani" wscript.exe Key created \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Control Panel\Cursors wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani" wscript.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "238" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe -
Modifies registry class 15 IoCs
Processes:
msedge.exewscript.exemsedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4181651180-3163410697-3990547336-1000\{8E52AED5-5446-4422-9CBF-96B972BC15E1} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile wscript.exe Key created \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe -
NTFS ADS 2 IoCs
Processes:
msedge.exe7zFM.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\MrsMajor2.0-main.zip:Zone.Identifier msedge.exe File created C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe:Zone.Identifier 7zFM.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe7zFM.exepid process 2724 msedge.exe 2724 msedge.exe 3924 msedge.exe 3924 msedge.exe 3592 msedge.exe 3592 msedge.exe 1804 identity_helper.exe 1804 identity_helper.exe 3392 msedge.exe 3392 msedge.exe 2728 msedge.exe 2728 msedge.exe 4564 msedge.exe 4564 msedge.exe 4564 msedge.exe 4564 msedge.exe 2440 7zFM.exe 2440 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
7zFM.exe7zFM.exepid process 4700 7zFM.exe 2440 7zFM.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
Processes:
msedge.exepid process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
7zFM.exe7zFM.exetakeown.exetakeown.exeshutdown.exedescription pid process Token: SeRestorePrivilege 4700 7zFM.exe Token: 35 4700 7zFM.exe Token: SeSecurityPrivilege 4700 7zFM.exe Token: SeRestorePrivilege 2440 7zFM.exe Token: 35 2440 7zFM.exe Token: SeSecurityPrivilege 2440 7zFM.exe Token: SeSecurityPrivilege 2440 7zFM.exe Token: SeTakeOwnershipPrivilege 1512 takeown.exe Token: SeTakeOwnershipPrivilege 4968 takeown.exe Token: SeShutdownPrivilege 3420 shutdown.exe Token: SeRemoteShutdownPrivilege 3420 shutdown.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
msedge.exe7zFM.exe7zFM.exepid process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 4700 7zFM.exe 4700 7zFM.exe 2440 7zFM.exe 2440 7zFM.exe 2440 7zFM.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
PickerHost.exeLogonUI.exepid process 2796 PickerHost.exe 3948 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3924 wrote to memory of 1952 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1952 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 1300 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 2724 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 2724 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe PID 3924 wrote to memory of 4684 3924 msedge.exe msedge.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.xom1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd60d13cb8,0x7ffd60d13cc8,0x7ffd60d13cd82⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:22⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:12⤵PID:3416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:12⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5456 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5032 /prefetch:82⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:12⤵PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:12⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4872 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2368
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2844
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:660
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_MrsMajor2.0-main.zip\MrsMajor2.0-main\MrsMajor2.0.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4700
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_MrsMajor2.0-main.zip\MrsMajor2.0-main\MrsMajor2.0.rar"1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe"C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe"2⤵
- Executes dropped EXE
PID:3512 -
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\32CE.tmp\32CF.vbs3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- System policy modification
PID:4284 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd\&cd "C:\Users\Admin\AppData\Local\Temp" & eula32.exe4⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\eula32.exeeula32.exe5⤵
- Executes dropped EXE
PID:3896
-
-
-
C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"4⤵
- Executes dropped EXE
PID:3332 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\6586.bat "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe""5⤵
- Drops file in System32 directory
PID:3376 -
C:\Windows\System32\takeown.exetakeown /f taskmgr.exe6⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Windows\System32\icacls.exeicacls taskmgr.exe /granted "Admin":F6⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1796
-
-
C:\Windows\System32\takeown.exetakeown /f sethc.exe6⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
C:\Windows\System32\icacls.exeicacls sethc.exe /granted "Admin":F6⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1320
-
-
-
-
C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"4⤵
- Executes dropped EXE
PID:4556
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 54⤵
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
-
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2796
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a2c055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3948
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD557f3795953dafa8b5e2b24ba5bfad87f
SHA147719bd600e7527c355dbdb053e3936379d1b405
SHA2565319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725
SHA512172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98
-
Filesize
152B
MD53b1e59e67b947d63336fe9c8a1a5cebc
SHA15dc7146555c05d8eb1c9680b1b5c98537dd19b91
SHA2567fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263
SHA5122d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0
-
Filesize
152B
MD50e10a8550dceecf34b33a98b85d5fa0b
SHA1357ed761cbff74e7f3f75cd15074b4f7f3bcdce0
SHA2565694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61
SHA512fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD58ef0032dcd302a18c286bba431e8b05e
SHA1dc1716b2cc7ac3587400a134eadb7115b64600f0
SHA2568d10671e366b2db661b24256a218f5b833840d7c71e412e1018f680a6b85e213
SHA512e7be67715eddb9b5bcc95917339fb7f0fbd7b725b107d535dd3c08736c1b9197e6e267597aabd17f39fd11568b34340dc375b6074ae88547614bf88550913a0e
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
930B
MD53210349a8156169355ac723578dd08e8
SHA19ebd7b535720339e3aaf5438a7281706f46c262a
SHA256aef38743be9f5587fcd8155f68863b79777abbd3af74191e528b40f7939b023b
SHA512c3962d730a685891fb423e1bb9498c56c02c71951fda9e18bb978605c7796d303d8d9f85f8dd29fdead1afe8a780404bb653f48bd782547c17132d03ffd0746b
-
Filesize
5KB
MD59f42597eb07b06fe57fc05781fa964d6
SHA16dc4040aa662dc1614c9fd2b73f4e3fff122d16d
SHA2569f641ce10fef154ae204acd52756632aa4547862e80846c5eff0fad390a95b48
SHA512bf4d48677bff9faf41c28971886c2b82d3d9b105434f3ff4ba48cb669afb68cd1cca8ebffa7c0227ffa57d699c36339f300c9572e06069d8eb8b8a3acf01f55b
-
Filesize
6KB
MD5fad1ffcc0ae5e32d02f935cf0dba855d
SHA151ab956811959140546da5c6589c688e6318da39
SHA256314d7aef0102a8284a114921fad6f069bcf7badd26fb67d10e7d8692197f2677
SHA5129da3c32f5349e3c596d5943d55f7b260709ffe243d3e65a1a5544af0a022ec65862b34161fb0d67b23e5497e5f0504316b26ab06413012c2760e55fdfca94a67
-
Filesize
6KB
MD56df4c73b70a29a8fd4bff45f1a2a68b6
SHA1f307bb4200fe18ff236358e07a45ae02b6a38e51
SHA256d0f098c169b47b1d9d9318b7e296a003588a249740b9567f119e6f6279fbada1
SHA512b0ea1c50efb7b5cceafeba223fae238f536fd14107b4901852406f430a123da8d579212bae62008fcb75bda7bc6a1d37345c83da11b8ebab8689764475cec8d2
-
Filesize
5KB
MD5fd59f6b31ae95230c7f25adb559b9aa9
SHA1a244f99efb17b6c73428ea85bdf6ab6b3fa5e13e
SHA256ba5ec705d06cc80419f583e8a62d326c2d5b6f99e8b40cf9f17e194c269161f3
SHA512fb76ac9a22be76d1f20daa69e475159e12aed06f8e8e2bbc15daa1a77adb1b4ad553855fe5ac26f36969a5bd48981a8790376ad278d28e83b9609a92808d7c37
-
Filesize
1KB
MD5e6de2bc24c74ea0cec6200cea0febc5c
SHA1c8769f2a381ce2efacc2345082ad09da3c713636
SHA2569f9f5c8d41fc373c32dc3e44983d5ff2665ed55fb7d2e07cbe359081106a8bff
SHA51249ac218183ab2839651ea2615d645ff64154f5c31b7f34e757ed26f479ad52037437cc82913bf9de12f9175b9c755c2098acdfc5140a238ef2d675ada96225f8
-
Filesize
1KB
MD52a44069bfb35d8355af1907f985b5673
SHA11b3c0206bf76a193aba41cab2910c202a9db538f
SHA256698b3190aadfa1ccac0ba22e4af60f9482f41097939fc6b8c6e1cd3450626b8f
SHA51219c08e6ad497896d13b156f64765fafb778c52cfb68bab0ef4ee32e64b880cbf9ca58f16af4b8dbd77acc27c00fde2d0e6d6087d8a30730ace50a5ea0f3df55f
-
Filesize
1KB
MD5456051402f032d2b1b4056c01ce586e4
SHA139fc89ba0bf3a6c3702ba1e82945269be3a1e57c
SHA256eff228d40a8a2417485bb8596e7261d7732c47d2a271f623c127ea7afa5abe0a
SHA512957d0a100ee81c7b51a98bed54a9f79394db1e9b0d2c055d4b6c279638ee7922c1942aa0dc0c86dd09c6034d8e9067bbca41f1c8c2c3ed9794ea9c0efe3e35f6
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5b69117777dc9ec01aad9635c05415349
SHA117e291ae2d1d7e5243cc0f18996912c6d0625f4d
SHA2567f2194056bd57bd6e465eb68a0c0358511e8397ab635982ebca0807d62c8775f
SHA5122caf358998abbbff12ced16923e425d6e16cb4f2045dabaac7a21e43e12f4e0f10dd70a79f41ceb3f633ed71b89626608974c0d96e32296fb5e36fe42afa04b8
-
Filesize
12KB
MD5dc80776cb171c7dd46796fb356f6d994
SHA114b03c08c57f4251e59ddaae8b807a8eca9f3d04
SHA25659b04b007f65e3ad2be5ceaf8653e65666cfd293daa6d9ff3328439e098959f0
SHA5125af79d860c2afc7dcf98c0af598685c55b730cd8d87ab1a707cde4c3bc7af0818aaa588e0051fb9381fa566ed04c54efcc6561b20ed6230e383eb0abf9d1fcd5
-
Filesize
2KB
MD5fd76266c8088a4dca45414c36c7e9523
SHA16b19bf2904a0e3b479032e101476b49ed3ae144a
SHA256f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f
SHA5123cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072
-
Filesize
671B
MD5d4e987817d2e5d6ed2c12633d6f11101
SHA13f38430a028f9e3cb66c152e302b3586512dd9c4
SHA2565549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
SHA512b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
-
Filesize
388B
MD55f9737f03289963a6d7a71efab0813c4
SHA1ba22dfae8d365cbf8014a630f23f1d8574b5cf85
SHA256a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275
SHA5125f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a
-
Filesize
341B
MD5a91417f7c55510155771f1f644dd6c7e
SHA141bdb69c5baca73f49231d5b5f77975b79e55bdf
SHA256729f7540887cf32a5d4e1968a284c46cf904752821c734bd970ecd30a848477a
SHA512f786699c1ab9d7c74dd9eb9d76a76728980b29e84999a166a47b7ee102d8e545901ed0fcb30331712490a36de2d726115b661ad3900cdc2bfcfc601d00b76b07
-
Filesize
60KB
MD5d604c29940864c64b4752d31e2deb465
SHA1c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3
SHA256da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d
SHA51289a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54
-
Filesize
122KB
MD587a43b15969dc083a0d7e2ef73ee4dd1
SHA1657c7ff7e3f325bcbc88db9499b12c636d564a5f
SHA256cf830a2d66d3ffe51341de9e62c939b2bb68583afbc926ddc7818c3a71e80ebb
SHA5128a02d24f5dab33cdaf768bca0d7a1e3ea75ad515747ccca8ee9f7ffc6f93e8f392ab377f7c2efa5d79cc0b599750fd591358a557f074f3ce9170283ab5b786a1
-
Filesize
58KB
MD5cd58990b1b7f6c68f56244c41ab91665
SHA17ccca9958d6aebbe3883b55f115b041b827bd2e7
SHA25651f59e877a1c2a1c2760c677def7395ef2868c2ee3e56ffdc3ace570afa50428
SHA512011bdd417ec3bf72daa2b32d3816b696be8b87423740dc2a0182e23515651deeb870a94f3415a73480145f9f5e36c1a3a492410b77ca95d7fab8b9826e9198cc
-
Filesize
52KB
MD51aaafedd9f259acca75708f4af10b5be
SHA1f6b4ea28d304e1f9205c1c0b970d60ee989402f2
SHA256429e01b0e06b02a55bafb1527629f8d4c5f64d9b21ac9f81484a3928fdce6dc9
SHA512a995ebf4d142452aabb419f0cacfa5412d03532840cb08c37dd7c00001dee521bf9d0da66ac4346b07dffd91fe01fa3115fa05811acbd43d380320dca1be4aa8
-
Filesize
58KB
MD5bcb0ac4822de8aeb86ea8a83cd74d7ca
SHA18e2b702450f91dde3c085d902c09dd265368112e
SHA2565eafebd52fbf6d0e8abd0cc9bf42d36e5b6e4d85b8ebe59f61c9f2d6dccc65e4
SHA512b73647a59eeb92f95c4d7519432ce40ce9014b292b9eb1ed6a809cca30864527c2c827fe49c285bb69984f33469704424edca526f9dff05a6244b33424df01d1
-
Filesize
1.2MB
MD58f6a3b2b1af3a4aacd8df1734d250cfe
SHA1505b3bd8e936cb5d8999c1b319951ffebab335c9
SHA2566581eeab9fd116662b4ca73f6ef00fb96e0505d01cfb446ee4b32bbdeefe1361
SHA512c1b5f845c005a1a586080e9da9744e30c7f3eda1e3aaba9c351768f7dea802e9f39d0227772413756ab63914ae4a2514e6ce52c494a91e92c3a1f08badb40264
-
Filesize
151B
MD5f59801d5c49713770bdb2f14eff34e2f
SHA191090652460c3a197cfad74d2d3c16947d023d63
SHA2563382484b5a6a04d05500e7622da37c1ffaef3a1343395942bc7802bf2a19b53f
SHA512c1c3a78f86e7938afbe391f0e03065b04375207704e419fe77bf0810d1e740c3ef8926c878884ad81b429ec41e126813a68844f600e124f5fa8d28ef17b4b7bc
-
Filesize
1.2MB
MD5b97bc9baa13a0c5b82ea1bb412564462
SHA11190ed91a3990400aa509a8e9c3b9e28607546bf
SHA2568b6aeca8ff8019618fc266968537f1481c8f73459a40fb569bb343bb8f02dc8a
SHA5127d52f93d3151afe5bcc059eaa22b34256c0b6bd3dd3fe39e060b6c1f162051bceeac27103b0be9e827ad94a59c87e7718d0d4344fb969aa9c2deb8da5d8aed46
-
Filesize
1.2MB
MD5cbc127fb8db087485068044b966c76e8
SHA1d02451bd20b77664ce27d39313e218ab9a9fdbf9
SHA256c5704419b3eec34fb133cf2509d12492febdcb8831efa1ab014edeac83f538d9
SHA512200ee39287f056b504cc23beb1b301a88b183a3806b023d936a2d44a31bbfd08854f6776082d4f7e2232c3d2f606cd5d8229591ecdc86a2bbcfd970a1ee33d41
-
Filesize
17KB
MD5289624a46bb7ec6d91d5b099343b7f24
SHA12b0aab828ddb252baf4ed99994f716d136cd7948
SHA256b93b0cb2bb965f5758cb0c699fbc827a64712d6f248aaf810cde5fa5ef3227eb
SHA5128c77696fe1c897f56ea3afdecf67ad1128274815942cd4c73d30bf0a44dd1a690d8c2f4b0be08e604853084e5515020c2e913d6e044f9801b6223c1912eec8f8
-
Filesize
38KB
MD5a62eeca905717738a4355dc5009d0fc6
SHA1dd4cc0d3f203d395dfdc26834fc890e181d33382
SHA256d13f7fd44f38136dae1cdf147ba9b673e698f77c0a644ccd3c12e3a71818a0cd
SHA51247ffac6dc37dac4276579cd668fd2524ab1591b594032adbeb609d442f3a28235a2d185c66d8b78b6827ac51d62d97bdc3dffc3ffbaa70cf13d4d5f1dc5f16c2
-
Filesize
58KB
MD587815289b110cf33af8af1decf9ff2e9
SHA109024f9ec9464f56b7e6c61bdd31d7044bdf4795
SHA256a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4
SHA5128d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc
-
Filesize
483KB
MD57907845316bdbd32200b82944d752d9c
SHA11e5c37db25964c5dd05f4dce392533a838a722a9
SHA2564e3baea3d98c479951f9ea02e588a3b98b1975055c1dfdf67af4de6e7b41e476
SHA51272a64fab025928d60174d067990c35caa3bb6dadacf9c66e5629ee466016bc8495e71bed218e502f6bde61623e0819485459f25f3f82836e632a52727335c0a0
-
Filesize
302B
MD58837818893ce61b6730dd8a83d625890
SHA1a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
SHA256cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
SHA5126f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
-
Filesize
751KB
MD5500c33e3e83631c47b3d95e9367828e1
SHA1f79655633cdbc9f19c329ac8a8956fc81be4aca6
SHA256e7c911eb2883eddeaded5ad9d59390a1e3887fcbe09f42d958b0491d3570db2d
SHA5122fd86ff19fb81810877c532cb94e40bdf85812c684511d4c8540d816b7a517324c90c783cdc6bb3df37d8a61ee96af61d11cf49734b4a9e6db728ffa72341abe
-
Filesize
51KB
MD5230970ec5286b34a6b2cda9afdd28368
SHA1e3198d3d3b51d245a62a0dc955f2b1449608a295
SHA2563cdafc944b48d45a0d5dc068652486a970124ebe1379a7a04e5cf1dcf05c37c8
SHA51252912b6b2ba55c540316fcfc6f45d68771d1c22ddf4eb09c2cc15fb8ddd214812c18fd75cd61b561c29f660e2bf20290a101b85da1e0bbf8dfbf90b791892b57
-
Filesize
58KB
MD5b561c360c46744f55be79a25e1844e3c
SHA1ed0f7eb00b4f1ae6cf92ad75e5701014f3d03d56
SHA256d1094e91960ded15444c6f50756adc451a7c0b495b2ea28319b7184ba96236f7
SHA5120a3a75d08f1d7afcd7a476fc71157983e04b0c26b00ace4d505aa644e5da3e242dd0f6afdb3c93f29ba0b08d2702d0e96b49acba4ed260330068b13f93973e9f
-
Filesize
74KB
MD591a0740cfb043e1f4d8461f8cbe2ff19
SHA192e1ad31c34c4102e5cb2cc69f3793b2a1d5304e
SHA256dcaabfd6955d3fec26a86217d1b1ab7e979c301d498473e4d885145ce031fc3b
SHA512c60067655e5f191708af9b25382869e3ce65cd3ea2d6cac70f8cae4132942cfd6a8aa9dde1e2b7f3f12997d6d7411e21dc73ab4cd83ec555d74b82b86778a613
-
Filesize
345B
MD53dbccaadafb7f0227c1839be5ca07015
SHA1bd636f73235d52d172ad8932a8e4a6a8b17389a0
SHA25633a0c62f3f66bce3fc1beb37aca8ad731bfa5590177d933d9d4eae016019242a
SHA512d981670f9d492d97931ab260a7d7d27d4f97621a1ef3e20246d4be2a9b4cfc01e01174a1d46432b4a3d937ad135c97eec9ef7bbc7da46034388843887df4637e
-
Filesize
2KB
MD59192fd494155eab424110765c751559e
SHA1b54fcc1e29617b3eee1c7bb215c048498881b641
SHA256cbd3b0f294e8f11592a3ad80d1070d81746f806a48183b93c345251422ccbf0d
SHA512b8c48916535f3721e7f47be6af671765c3befefcd407c6ea5fabcf9ada119747408d662f61fb436f98a7c33050b6674da54dddf25e683429204a96555ec6e801
-
Filesize
440B
MD5fe44b78a465853c0ac0744c6ab05ea40
SHA1f32dacd91b9547fce9a8a2846a4e17c33295aab3
SHA256989d947c51c878bcefecb53d867a3c182c2d67129a87a5f6773eb6ef2bbf9b2e
SHA5126b945e16786833c2e2e9867315b8859c413687fc72d4c8576b9c0a1aed2dc65249468317dd49f2ecf777e27c9969b7a7abc72b4d9b7c182dc7999051377515db
-
Filesize
336B
MD504067ca733ee8b2ab2f068edc8b75a0f
SHA1973cb577f6ab2463040918c3661333553a3132c8
SHA2563aef33c03777abe62feef0a840ac6a087caafc05adfe801464fd1c52eac656a0
SHA5125423a1e668211f269a3d787548e11d18de7365d6c2525c2de61014854f1ab5a51b5de9eda70fb21d6ebe356cb52e93b3f406c71ed7fbcaedd2b023b6fa9c13f8
-
Filesize
108B
MD52609fde7a9604c73be5083e4bcfa0e20
SHA1068c89f703fb11663143b9927f2a0c9f9f59c0e3
SHA25617d014cb4abbaced3acce9b6d7a1b595cd6e2dd814e41f06ceddcdc08e93eebe
SHA512439fee7cc198cb3fef4ef14693141e52c305579a4ff2da0842323f57dcffade03f3b01ac288080fed423511937a4c1e2080f5a79f967a963fe34253f541824cb
-
Filesize
133B
MD5c94bb8d71863b05b95891389bed6365e
SHA107bb402d67f8b1fc601687f1df2622369413db3b
SHA2563900e3b60b4691311e050c4cf8fac82ff178a06e3d04d5d6b2d7ea12cf5d53d1
SHA51200e7ab3a91862faaf5ac5ca3de6dbf2cbb8aac4aba277e1e14b2ecf4650eea2e68134e0df549dca35ab715ed46e36fa9cfee1ba7bb3520511723bf567566682d
-
Filesize
11B
MD5b181d5a4055b4a620dd7c44c5065bbe7
SHA136320f257026b923b923ad2c0e7fa93a257806e0
SHA2564d2639e890d6d5988eb9cb6f8cb50647048bbfeeb83fc604c52567e7381c876c
SHA5120bec0cf2e5b93065701c5458c1d7e047312971d7bbed3ce5444db710654fa0d84eabb7d7c243130e3cb2dae38eb05874929b5b08547174a6065f8accd4e0433d
-
Filesize
105B
MD54cc606c63f423fda5324c962db709562
SHA1091250ffc64db9bea451885350abed2b7748014c
SHA256839301ef07178c100e7f4d47874faf995ae5d11dfd527dda096a284c8114671b
SHA512f29ef2bc694f497499545d1fa4e14ca93c06049fff582af3a6caf3885153491a1cd9e96ab5a6746051aa972421f876c008e5d5b671bd34c3922b61c84151097f
-
Filesize
126B
MD5fecb9e50c1f01d9d6101f273cb860260
SHA118c413f577c289004db6156bd133e5db70258044
SHA2568863b595563e92d73b29090ff83191b2fa1297507be588aa7e1cf910e77c7feb
SHA5122c30641b099d5b6c3af40cb41e70160c1f4294bb30dc3162b018e9552b48fc899d1a63d3e366bfb71fcf6803bcc518cf8d504ce60684ce221028a9bf2bc07f9d
-
Filesize
383B
MD55f427dc44f33906509423d24fa0590c0
SHA1b896f7667381a594d3751e05f258925b81c231c0
SHA2569aae0707b1d5d3b7ed3bf5cc8fbb530aebd195e3e2f18312f3f7f1aa43e031b4
SHA512bd28c386772062ef945f24c8ad7a25f158856af36e31d2c9b14674cedfd34b4f48ed531cd40a7eb291384d83665ffe154f0786c1a7ee1616256cf30125120961
-
Filesize
93B
MD526ec8d73e3f6c1e196cc6e3713b9a89f
SHA1cb2266f3ecfef4d59bd12d7f117c2327eb9c55fa
SHA256ed588fa361979f7f9c6dbb4e6a1ae6e075f2db8d79ea6ca2007ba8e3423671b0
SHA5122b3ad279f1cdc2a5b05073116c71d79e190bfa407da09d8268d56ac2a0c4cc0c31161a251686ac67468d0ba329c302a301c542c22744d9e3a3f5e7ffd2b51195
-
Filesize
25.6MB
MD5247a35851fdee53a1696715d67bd0905
SHA1d2e86020e1d48e527e81e550f06c651328bd58a4
SHA2565dd4ea169cabf9226f54bb53e63ea6a1b5880a0d1222242aee378efb6255b57d
SHA512a173801aaef4fab608d99b52223b5b2400d69b91edcbf33c21fcb47bd832eef9d771dfd36da350a502a371ed1739c869a7c2b4dca456c93f2feed9ac9c647c7c
-
Filesize
8.1MB
MD5239841cf32c1594b1c0bc6b89f889bb5
SHA1f47b09b92b4b0b960cade2dfe587216d1f0ba0a6
SHA2565fe707bac0332be2a83ba988af30d71c1350f9cd47fe433ee89d62ae521e6176
SHA512f5df403906b989d7de0e57f8a8cb948e826b9e6cdb938b45b6f55b546c6324ce1431cf01424bcb5c8f023023fbfb637fa80d6c219865ae3c187d34f6bcc88ac0
-
Filesize
7.5MB
MD52b3b44f0c914eaf21a86e49cd6d2ee02
SHA126a693885aaedd7d6bbc6041201c00595a9f9fbe
SHA256878f6df40d3e97f7ee6344b9b3cb26d86e54d97169fd0647625d6520efe36ac9
SHA5128740136026583c49a81680de224b45bf2dc5e6025f4421583fa24c81468c3afa19970b3f8822e76ebf882a063f6f8f5bd982e1845a118b090ce8fc843025a425
-
Filesize
85B
MD568863b6ebfc53960b1af3b06aacddd4e
SHA132f0111ccf96e245b4f2b674823ffd1ba46b3298
SHA256dbbdc5a8f1b0c6237bd85887d879564c5664ee4167e9cb78b17f9e21920eb3c1
SHA51208b9927180ee44317eb1414203ed4a0d4be8d250975c5eda01204fd775af4b2236929260fef7da8d057e32b0ed9757864a9e88430ebb2ee41ee669572bb0ab67
-
Filesize
19.4MB
MD51aa0ebbddc2fea09466a9ffb449f7c24
SHA112f5606558998fc937578df869ad548017df06c3
SHA2568ad8042bf2af867c9cbef40e2a0317e9bafb894697d43829a7635b4cc76b70a0
SHA5128a3889fc81c0ec68fc92868153f909b3025ff6f405ab1f941ce07c083752527a20575df367bbe82f37805d784069859b63c63c721a0093ab7fc030bb5e91ce45
-
Filesize
19.7MB
MD589aa6864c707f6f807714ab587c6557b
SHA1c7ab8a280c95b45fedb236eaa7f83bd844be118e
SHA256c859e7b6801f5b595b0aa77b3e03476888f0242044514af63c50f8fd8cb4eb26
SHA512092e52498e19b844e7d877c5795c3e2d1a2e2f72e97f9b5978abcb3da7299308108de896f130c5dba6c382df31ecf14b3fc798d26fca3b9ee05d73fe42fbf139
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e