Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
21-05-2024 14:37
General
-
Target
63a4f18e268767cca71f41e557b9a1d1_JaffaCakes118.exe
-
Size
23.6MB
-
MD5
63a4f18e268767cca71f41e557b9a1d1
-
SHA1
64c2fbdac8e510c6554f159eb0e890c7dd92824f
-
SHA256
2754e46e0d545ad8f6b5cbc526045732d964ebdfa18cb077d0fa91e58e659663
-
SHA512
bc0cb39d0f2e0d178ce7dfaeb64002c79b5fddd7b14ef9203b14af3e99a93fd7196d4ab144246963dffd862b344c2c786d3ebf24cd8f31187094515d2f59d804
-
SSDEEP
393216:KBRW6T1WKIo36MfMt3xHgQp7UIs2N8sZmFl6Ct9qH72+8ypHe+Usrd7wZypXIUOW:36T9I9OMV4Id8JF809qiApysrd8ZyuUt
Malware Config
Signatures
-
UAC bypass 3 TTPs 3 IoCs
-
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Registers COM server for autorun 1 TTPs 12 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 16 IoCs
-
Drops file in Windows directory 64 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
-
Kills process with taskkill 8 IoCs
-
Modifies data under HKEY_USERS 54 IoCs
-
Modifies registry class 64 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\63a4f18e268767cca71f41e557b9a1d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63a4f18e268767cca71f41e557b9a1d1_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\MarkAny\Document SAFER\temp\DRM_Delete (¼¿ï¹ÝµµÃ¼R3¿ë).exe"C:\MarkAny\Document SAFER\temp\DRM_Delete (¼¿ï¹ÝµµÃ¼R3¿ë).exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3958.tmp\DRM_Delete (¼¿ï¹ÝµµÃ¼R3¿ë).bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg.exe delete "HKEY_CLASSES_ROOT\MarkAny DocumentSAFER" /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\MarkAny" /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{18E14E7C-34E1-44C3-90AD-FFA12BF93349}" /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MarkAny" /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{18E14E7C-34E1-44C3-90AD-FFA12BF93349}" /f5⤵
-
-
C:\Windows\SysWOW64\net.exenet stop "Image Protection"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Image Protection"6⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop DSv4_DRM_Control5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DSv4_DRM_Control6⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM DSH_Service.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM DSH_Service64.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM DSU_Service.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM DSU_Service64.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM DSC_TSC.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM DSH_Loader.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM ImageSAFERSvc.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM MADRMAgent.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\MarkAny\Document SAFER\temp\DocSAFERx64.exe"C:\MarkAny\Document SAFER\temp\DocSAFERx64.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35F01A73-C6AF-4B1B-8E08-5DBAFB51DDB5}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5811BAD6-0442-442C-9D25-6A41B2BB6E06}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ACFCA881-5760-447F-A91C-55B29630EA1E}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{954DF1E5-64C4-4DF8-8B23-BC4E7D09880E}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5C2E66CA-6A42-4DDD-80DC-76CA7681D763}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2001B7A0-20AB-45B4-A562-4D99DD379356}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5659FE19-C973-47F2-BD20-9EC2C6D14576}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1AAA1FD6-9052-486C-A43B-2D7998F14B22}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{897CC764-ABBB-461A-A644-CAB5E19655C0}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E4F801A3-7AF7-4A0B-BD26-7229C221F6BA}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B001ECC-7662-4A54-9410-7099D1C37AF0}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6753FDC7-7B90-4F04-8EE7-0BAC6A70E163}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D2E231E-B923-4A36-BB0F-D3697286B769}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B1810532-39B9-4052-BC09-F4CA900182B4}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{21E9178E-4F86-4BD2-9247-C28091062EE5}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{15939532-5304-4427-93E6-B7C7BF9D875A}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5101FA38-F198-4905-A95C-8F3B035B919F}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9921A5BC-66B2-4CEF-899B-AE0C1D98A8B3}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{748D4364-6B3B-4358-95BC-742D1ED78A01}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1FBA1641-DE14-4C4B-A3AF-76E99167FEAB}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C7C68845-B7DE-4E60-8856-9A911F525034}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D83FA0DD-B7D5-4108-BD7F-096ED79E30F9}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ABF061DA-DC60-49DA-BF3B-84A8572CE002}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ECB28D30-271F-435E-9E20-BBC07B2A7F25}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25FFD770-22C4-4BC8-B8A1-DA381196C985}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6C682057-5DFD-49E0-A765-45A34F4EF4C3}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1F1E89FB-B1F5-44FC-B91D-BBA48C3C8339}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1FC7BE60-974D-40C0-9240-FF288CA87BC4}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{247F1422-BF83-4A83-B05A-2F69A46D6F68}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6AA5722B-59B7-4413-94CC-3022971B7264}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8D420FCB-1C1B-448A-8B98-DB6F64E787F6}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A974E9EB-3E6D-4137-AA32-B388292D6FCD}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FD7D23DF-442C-40F2-A182-1CD56CA0B936}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{19CCB10C-950D-4098-9ED2-1045616C2ACB}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{181D2A66-6481-462E-BDB6-0CBE6F1E181F}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B19EB3C1-3529-49EC-AB6C-972E68C02D3D}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6B568732-68A0-4881-B820-AF03EC3A5210}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{49F29CD4-9A0E-48B5-B037-53B1DBC12ED7}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA86C9E7-96FD-43B3-A7B2-FD1BE309C1AA}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B60E6B6B-7C3B-4A30-AC7A-E13A9D12605A}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F0D63D38-EA5C-4624-96F0-14A49D11E3A4}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{87481423-DDDF-4F22-9D55-91B7616EB14E}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41F9030B-7836-4147-BD7C-D2B302CC6192}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{91A0A8A1-E8A3-4894-ACFA-B0725AE77166}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{68FE611C-1502-4BCB-908F-CA33F51522C1}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A268D99-7A5A-4355-AA7F-320667C81C56}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B46B64DB-1C85-49E5-8C5D-37A45F3C28CC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7209B91B-6F56-42DA-8507-232D6EA25F05}4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe /unregister4⤵
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe /regserver4⤵
-
-
C:\Windows\vcredist_x86.exeC:\Windows\vcredist_x86.exe /q4⤵
- Executes dropped EXE
-
\??\f:\ff42b01a46c770e4028fc41c69161170\install.exef:\ff42b01a46c770e4028fc41c69161170\.\install.exe /q5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe /unregister4⤵
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe /regserver4⤵
-
-
C:\Windows\vcredist_x64.exeC:\Windows\vcredist_x64.exe /q4⤵
- Executes dropped EXE
-
\??\f:\120629a92e8c86c4c6ce86\install.exef:\120629a92e8c86c4c6ce86\.\install.exe /q5⤵
- Executes dropped EXE
-
-
-
C:\MarkAny\Document SAFER\MADepUninstaller2_x64.exe"C:\MarkAny\Document SAFER\MADepUninstaller2_x64.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set NX AlwaysOFF5⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\ImageSAFERSvc.exeC:\Windows\ImageSAFERSvc.exe -stop4⤵
- Executes dropped EXE
-
-
C:\Windows\ImageSAFERSvc.exeC:\Windows\ImageSAFERSvc.exe -remove4⤵
- Executes dropped EXE
-
-
C:\Windows\ImageSAFERSvc.exeC:\Windows\ImageSAFERSvc.exe -install4⤵
- Executes dropped EXE
-
-
C:\Windows\ImageSAFERSvc.exeC:\Windows\ImageSAFERSvc.exe -start4⤵
- Executes dropped EXE
-
-
C:\MarkAny\Document SAFER\expsc.exe"C:\MarkAny\Document SAFER\expsc.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc.exe config "Image Protection" start= auto5⤵
-
C:\Windows\SysWOW64\sc.exesc.exe config "Image Protection" start= auto6⤵
- Launches sc.exe
-
-
-
-
C:\MarkAny\Document SAFER\DSU_Service64.exe"C:\MarkAny\Document SAFER\DSU_Service64.exe" stop4⤵
- Executes dropped EXE
-
-
C:\MarkAny\Document SAFER\DSU_Service64.exe"C:\MarkAny\Document SAFER\DSU_Service64.exe" uninstall4⤵
- Executes dropped EXE
-
-
C:\MarkAny\Document SAFER\DSU_Service64.exe"C:\MarkAny\Document SAFER\DSU_Service64.exe" install4⤵
-
-
C:\MarkAny\Document SAFER\DSU_Service64.exe"C:\MarkAny\Document SAFER\DSU_Service64.exe" start4⤵
-
-
C:\MarkAny\Document SAFER\SetSite.exe"C:\MarkAny\Document SAFER\SetSite.exe" 192.168.1.1524⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\MAShlMgr64.dll" /s4⤵
-
C:\Windows\system32\regsvr32.exe"C:\MarkAny\Document SAFER\MAShlMgr64.dll" /s5⤵
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\AcapIcon64.dll" /s4⤵
-
C:\Windows\system32\regsvr32.exe"C:\MarkAny\Document SAFER\AcapIcon64.dll" /s5⤵
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\AcapIconEtcDRM64.dll" /s4⤵
-
C:\Windows\system32\regsvr32.exe"C:\MarkAny\Document SAFER\AcapIconEtcDRM64.dll" /s5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\ZipExt64.dll" /s4⤵
-
C:\Windows\system32\regsvr32.exe"C:\MarkAny\Document SAFER\ZipExt64.dll" /s5⤵
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\DSU_Web64.dll" /s4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\masdms01.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\masdms01_2007.dll" /s4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\DSP_01_2010.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\masdms02.dll" /s4⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\masdms02_2007.dll" /s4⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\DSP_02_2010.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\masdms03.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\masdms03_2007.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\DSP_03_2010.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\VDIConnect.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\MarkAny\Document SAFER\AcapIcon.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\Windows\SysWOW64\DrmSSO.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\Windows\SysWOW64\DSUtilityAX.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\Windows\SysWOW64\MADWC.dll" /s4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe "C:\Windows\SysWOW64\MAFileUpload.dll" /s4⤵
- Modifies registry class
-
-
C:\MarkAny\Document SAFER\DSC_TSC.exe"C:\MarkAny\Document SAFER\DSC_TSC.exe" -install4⤵
-
-
C:\MarkAny\Document SAFER\DSC_TSC.exe"C:\MarkAny\Document SAFER\DSC_TSC.exe" -start4⤵
-
-
C:\MarkAny\Document SAFER\DSH_Service64.exe"C:\MarkAny\Document SAFER\DSH_Service64.exe" -stop4⤵
-
-
C:\MarkAny\Document SAFER\DSH_Service64.exe"C:\MarkAny\Document SAFER\DSH_Service64.exe" -remove4⤵
-
-
C:\MarkAny\Document SAFER\DSH_Service64.exe"C:\MarkAny\Document SAFER\DSH_Service64.exe" -install4⤵
-
-
C:\MarkAny\Document SAFER\DSH_Service64.exe"C:\MarkAny\Document SAFER\DSH_Service64.exe" -start4⤵
-
-
C:\MarkAny\Document SAFER\MADRMAgent.exe"C:\MarkAny\Document SAFER\MADRMAgent.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\MarkAny\Document SAFER\WIN7Old_CCF.exe"C:\MarkAny\Document SAFER\WIN7Old_CCF.exe"4⤵
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "0000000000000000" "00000000000003DC" "0000000000000580"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\ImageSAFERSvc.exeC:\Windows\ImageSAFERSvc.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ImageSAFERStart_X86.exe"ImageSAFERStart_X86.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\ImageSAFERStart_X64.exe"ImageSAFERStart_X64.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\MarkAny\Document SAFER\DSU_Service64.exe"C:\MarkAny\Document SAFER\DSU_Service64.exe"1⤵
-
C:\MarkAny\Document SAFER\DSC_TSC.exe"C:\MarkAny\Document SAFER\DSC_TSC.exe"1⤵
-
C:\MarkAny\Document SAFER\DSH_Service64.exe"C:\MarkAny\Document SAFER\DSH_Service64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\MarkAny\Document SAFER\DSH_Loader.exe"C:\MarkAny\Document SAFER\DSH_Loader.exe"2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\MarkAny\Document SAFER\DSH_Inj64.exe"C:\MarkAny\Document SAFER\DSH_Inj64.exe" 1180 "C:\MarkAny\Document SAFER\DSH_Ex64.dll"3⤵
-
-
-
C:\MarkAny\Document SAFER\DSH_Loader64.exe"C:\MarkAny\Document SAFER\DSH_Loader64.exe"2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\MarkAny\Document SAFER\DSH_Inj64.exe"C:\MarkAny\Document SAFER\DSH_Inj64.exe" 1180 "C:\MarkAny\Document SAFER\DSH_Ex64.dll"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5f0591bdb89d4e809ab2cddb1a2dd81a9
SHA1685ff8473e1c2d8730cc87a175f1907fb131293a
SHA256a12842729b7f426e89423249e1a1ce8653ef050692e6e0eb7cde48f8fbfce1b1
SHA512549d6936801caa7721399c8921571d4ecd34751e3db36d7304e3d41f63edd6a360a8094350c2f8bda54d20318eb29f81ac11f802d038846bd2ab9eb3d98316e6
-
Filesize
107KB
MD5e7b2327737246f255a8dcdda65c600c9
SHA12f17a81161aebe910c8315d9d73259414474fda6
SHA256d57ad67dc3998fd833296eacbbbc9f8bdd238554746f01405870ed57f9f058a0
SHA512026521b8ed000570b9d35e75ced54c82e10642010e3266fdbdc2650b0572b85dc3db778eee509c9dd16e8b764617d239e7428ecf5c2340637ed652b9714f3b4b
-
Filesize
260KB
MD551ed03edc431b9f90375b06c879c129b
SHA1a1306cdaa00b23488ad5831a4e30d2b2e128754e
SHA256de1cfbaff1e639bcc99a407d91bf9a7e41355d80abfd28e36a217cb1071f80b0
SHA5128262b55a8dc8cbc9b7e5fb4843081c5724aa9b7cae3bd5c5f45bec0f8aa816531c0a6264bafe00c039fb0a3c8b5391551138dc8810eb86800c5ce7ebb27e5772
-
Filesize
49KB
MD58fff51566d86f6bdaab9624393795253
SHA10317cbbf89e9b2bbb2a58117f7d264f8fe0f4ae7
SHA256cac9bbb6538ff1bbe81b1c11f9113f4a86e7c35de62479f00e512d5343e300c5
SHA5120e1e57ff56eea9f7ce29eccb7167fdf5b05782d1b6ebe9834ca99c27d306ed557fd2aa24e8a1db24675b71b1536cbaf74d4c685968e9ca908fd7fb9e8c4ea88c
-
Filesize
1KB
MD5666c1ebbaabc3809e53fca3c3f2cb45c
SHA146726c2fcb24036b2d5b58bb6b9151e6305a2fcd
SHA256a919a55c73d33e23bbe8528dbca814b982b31a07d356e38ce64f0fb02914d074
SHA512f603154c7415eb57d390143aa160773eae926b29822706f9d27d521fa6d8db1a48eb0b375a047054640b973dd4d80248f24e51d0febec6902c282750e645f455
-
Filesize
1.6MB
MD5a041f0609a4da4073e1a7aeb462e42c4
SHA19021cf8a89996c13621dbb715b6f786d2b839b33
SHA25613d865b9452c9f1fa315aabfda8d66a7a0afde646bdcd432eccc87539557f031
SHA512985857f62df2cce6f5bed9ce4b3649f6a6eecb840805acd9fbba6b7da907f60f06d1ebd7e1a5b257f04d32eec1967749fe5098d779daff5c92d9a0725972f1c0
-
Filesize
20KB
MD500cc18daebb96d748c1d3b0aae524a6c
SHA1cad67226d6f51f39b8ff076845a3fce5dc89d153
SHA256fdbdf1c5f90cab72b530c8694f9cfc4ab238c69dff67045c8a84fde59718baac
SHA5128ab3332321fb45e260979ebce50411258c6f106bf035198d4901cbb42f38c07a592b07ef03258346d7babc07a89bc4c5933498364c685c5b10fa57a05da0900a
-
Filesize
55KB
MD52990678a8cd8c1ca1e3051d8cadcb274
SHA1d2037167b8e93a8b7ace1ad7eb8b6333ecc103a7
SHA256e194f18fc4154d27e51664b455224f9ca00542972a021ed8bae9be75b7a989cf
SHA51250825bbc5d858f7ae858125141e9da03973028829633913ac2fdd45188319d4c179d96f1b1352e9286ef4d566a3cfa8d110ac4277db6c24d555c00bb89e4a10f
-
Filesize
12KB
MD5c777588ae5ed25e8c556398f7dd4b2cf
SHA11124f50220bd92b082fff2529153d7103941d122
SHA256d3832867ba1b6d5b40a31c0c4647cdd7c960f44dd58f983d1786f3262e885c60
SHA512bad750afc1242184ad2b5cf62bb0fe19742f84e518387254a541114e035a96c6747a92678a6176ff3b092803c585f9fe252a29105b777af99e0056bec84e51fc
-
Filesize
48KB
MD56df3130c92adb75bb69a1e239d4c8f41
SHA14718dcce7208503dc96ff782bd34666b5615751c
SHA256a5576cd265f6f680a002934debe70f671121c76e899c37e08bf857c86dac44b5
SHA512e8f9dff618515267825dc014a9fb0220a4df9b72e5d48f34fa2e1cffff1a48bfd5400976b1cb24271354e82d562ad757976a8c659bf3ca8c93913aaa8d6bc3c8
-
Filesize
302KB
MD5c2d96d98ae05a7c062999b433c24e8a2
SHA18ac0d519c676c03210ec0ee8a37c3204a25d767a
SHA256507fa4e1d95b43008629e0e8eb33364bce571ec1069efe69da85302115336268
SHA512427a1ae951a80d4cf7ef9ec53d3d5cc5636252f534529a3c6659962b89081553b0d2526ffe00b78b783979bd06a686fffd73db0ed4d5a5050fa8ed536e479834
-
Filesize
302KB
MD5e174726590d5dae75e162e42e3cbe65a
SHA1589639965dfda32d4ad715d2e5a4c7ceb0af8360
SHA2562c4b55fc91743ff1a14f62af5e11edecebbb7e7577bc23af41a46e1fcf6e95a3
SHA5120f4da3223f17e6455ff4a7124c61d19d33a242cf56ed5828f75d04343896b42061b53054c8837b1c3bdb5c30d9e9bdf6b61bd340577562df0158041d9d9774fd
-
Filesize
24.8MB
MD5fe45559b9dbbadbca1ede71fe24ae937
SHA1b122550ccc65144a5f7a7649f46eb1412a5a98af
SHA256f4548d69e0c8e812d08434af59897298201223be4bad408467b3e14441fbc58c
SHA512620d3d1a249be8abe7428608d29390632ed5476ed507eee9a1d7a8c04cdddb2c7263152c1965a6c0a02d953cafa9c74471b37720f67bcb163edc616ff4cc5670
-
Filesize
13KB
MD573e70a6b9354e80237c8e2b3170830a0
SHA1b4c8777ce9c2d2fff4c0c914825cbe698feaadaf
SHA256316577cf74d3545d632b0de55513a3511d654849655157cb84821b871ec081e9
SHA512f15e736e7c0b55437b39869a0bbce15d5365f04c70be23fc373d83ce0e99e0a806244c1c44cd298dc4970d20af6cb1198a9d84749f5d5ac02162c261b1460ed7
-
Filesize
730KB
MD586664b6451494d2ecb831592d401572d
SHA1553fe8bc9c1a193c1e74c27ec943b726641d9453
SHA2562fa94bffc20fe4c888de080f54bcfc390923702aee87df8b7b94264890f43505
SHA51216f3c393736a4263ca63781cc35d04c3425b0dbca6429d2a631d968c174af4c69c783a6c1bae6a86f0fd31e062a76c266672867d9dd655547579a45469b5ce5e
-
Filesize
636B
MD5320a6a945a17143fcf7681397f1881b5
SHA1c02b56d7bcfb67e4d22ff606322424bcf65ea78d
SHA2564a9c184c592f42d3123568f84291146cc4b2f0a6f58ab6866da9fb1fd005a0f7
SHA5124f064e637cfcccaf4b4e3c63c9079b75fbab2906b55cc4f9b13c086cffd0b5c68c9b863f9e915c9bd65454fb8175391c51697a5a6e8061fa3b86da93509c48d6
-
Filesize
2KB
MD5c6aef56e44a576b41716cd7a90111b0a
SHA187030702d254a661b8aa3a1c88fc3e6ab193c25f
SHA256c5071f8097db9b8451019ccc1ae31ceb388a7f2bdc8d05191cb17dea30fd4fc6
SHA512d5f320680e61df1b32e76ab7fb56da7384863214b8caed70887f418e46c03d8399bff1546c146fdacc59b7bfef2f070d43d5c5a72a1b5b127866d0bddd6d605b
-
Filesize
64KB
MD5e6b1795561bc6ebc91fdcab1f2bab9bc
SHA1b117aa95a787540789655000c2ccd33bcd3d509f
SHA25698dbea65ebd98f6410c26ef8e0bcd2d9be4922fc60ba903ff81d6aafe2c6e4c7
SHA51244b4bdf7a892d122c7a6278978ddc033b0716380f17910140f813ef0c433133be3100228cecadc84a5de6fdd60f62e883f2c517451eec5b4d6b2869088c5e1c7
-
Filesize
64KB
MD58c421ade817f8056cce56309cdfa8649
SHA1f556ef728c26516b48a5d8b847d9f7280ec8ea28
SHA2569d550236978f8c62eec7b9c02744a4f9c86b757c1da5e82620355a8b378336b8
SHA512e2ca329b696173c7b444d6e7d9ae9eb15cbefdbda8b303a7af417baf7998f02b3a1ecb904f555230ae4dd073568e5d1cb710c90ec039dcbfd55a25f85edda3c0
-
Filesize
64KB
MD5b6f413c991e253ef8b093537fa62c44e
SHA114032779ff9c4b502dc814db9805b54ee6265cc7
SHA2569db6605e47bd60d1cb12bd4af59ed2247cbb9584e0ee340cde0d9258e9ce5568
SHA51222b8413be9b5f6fe44dc45f5f9c2aa21247370f6022cd7688fa5cde8fe3d9fa7c48b750bd29afa3e38418063ea5e149836e85622a53f8d5f9221ee20d0e90967
-
Filesize
64KB
MD511d268ad59ed0b9f430015b8b88734f9
SHA1141a9b402ae716ecaec8bd571bab0c1fefda82fb
SHA25694ce28bca9afe600e49c09701d6ead18bee44e6e7af5cd74ae59750f7be93303
SHA512a157d8a9d6c75e885630aa9f7331ca4fa72fe37e805060e989d711bd6d064b115497e3d75d0ab6d95bd3e959167fab51a9720a4870ad89578ae53a8576c7d93a
-
Filesize
64KB
MD53762924ae8291d55e5cf55bc917aff2e
SHA10f4af6f3717bc2082de4afe96b61560a1a96abd9
SHA2566a64d52b464ec55900ee5a4c48ea96c5b67bc296cde0afeb839452e94e73a5cc
SHA512c80e10882b744c7cbe0f7c94ca7a538310ebb4b21cce3d0e70e744a9188392787b20a21d02d702470314fd479dc9b7ed878af0a60df2c986fb18389fffb1262d
-
Filesize
959B
MD5414c64a755d7bf516a4ff82a75bc954b
SHA1a8ffb14c164fad08324f21f63ecdb6737f131847
SHA2568db5e1084e6f2a983fc808774195e2762fbea328534ecd3a671481a57db91279
SHA512b214f10f25262f5cfb4e76b393d264560a81d8a8f9159d3133ad45343044d3733a33c8e8abe07b9391350c2c87e157acb1ca68725dcf0d137cc633f1df0c4e8e
-
Filesize
392B
MD5dc7941d65bf1102ec39e4a483b2bcaae
SHA147713aebcb7681fccdc3b50b678cd47a7cf822d3
SHA256097c34e02955a7d1e07cbbf456e10d59656cef41fab2741f5140a7cc1825edac
SHA512ec0cc22c6d88c2b5f98305068ee53c04a789db3d57337be1c3d1fc16d26920dcc92774f1dc8e42195cfae91d3a9eb9e611afce8b1ed1953594fd24aded4b06fd
-
Filesize
4KB
MD5b9380b0bea8854fd9f93cc1fda0dfeac
SHA1edb8d58074e098f7b5f0d158abedc7fc53638618
SHA2561f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244
SHA51245c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c
-
Filesize
21KB
MD5be345d0260ae12c5f2f337b17e07c217
SHA10976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA256e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
SHA51277040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
-
Filesize
58KB
MD5ccb842864020cd89216ad4dd002d9567
SHA13f92ad5a1313c93a7ada79651aa5754a1b4967a3
SHA25671d53af84bbffca25af052c4897eaab7bb93b970ddbe72fdf6ab1d7ed636615f
SHA51230178b32dfe6bd19002df3dc091449c9ad4cfcf21174ae32db2909e61b42fa9c4cdc2b9f1135a00e0a91352b2fcd8ff2cec2e107de85b35d6af27adbbc311930
-
Filesize
789KB
MD5057b1ff1ecc105372f0d3a9bec2d6df2
SHA1775d1a40dc3c3b0bf8a5411a74cd1ea0d763d189
SHA25607b7c931ed6d31f1f9786519aa2601c7d47f7f7136d4346cb2c239e034639b02
SHA512935bbc4a41930117463777391c165294bfee36a1d8dadabfcee52a230a084622f4ccb3c8eb46e15eca633c09d2874a7b6ac983980c41422abff8fa410cad5c85
-
Filesize
241KB
MD52dc66af27507f919d0448a6fd475eb52
SHA153158d62d48493615176b4a223e28ffb2434c891
SHA256fdc0c743279649696b7e3bfa610fd61a9e25697a3d208d9a67eeb15ea74b77bd
SHA5121c5a4b35e73b147ff67ea22925612e4104b78808843dc0552d8d4bfd8e02b21d398416a7f8e732d9fd2db9593e7b95981b8f80a0edc816e93cfb03747bad1282
-
Filesize
2KB
MD56a60ee426fda234a208ab611eae9f96e
SHA19f4d942dfd9cd9d1f89437720220708b839af98d
SHA256dda115cc431c8673e3118bdf6f899ee33fc04cf04fe05b08a0144cc3df89e88e
SHA512d99985add449810a07879925f23e1641c1cfb8c1f4d24e7f03d801bfe264a7ee23b3df4ebb71e2b61f004c4d02a9242d4b5299f62ba6a5186e341a65facb3d4b
-
Filesize
84B
MD51eb6253dee328c2063ca12cf657be560
SHA146e01bcbb287873cf59c57b616189505d2bb1607
SHA2566bc8b890884278599e4c0ca4095cefdf0f5394c5796012d169cc0933e03267a1
SHA5127c573896abc86d899afbce720690454c06dbfafa97b69bc49b8e0ddec5590ce16f3cc1a30408314db7c4206aa95f5c684a6587ea2da033aecc4f70720fc6189e
-
Filesize
38B
MD5d1bda1cbb8e18bc2977c5c29bac13891
SHA1418093a89c55c38e6014e7a4b1300c40314de04f
SHA2564586a347528185485758d2ea2d49e9893d6dc3df26afd70a611e1eeb31e303fc
SHA51280b578a2b27e10ca89612164aa1b48bbf343eb2c59b267aaeb4415d04680496e33a8988b09d0f0d02f0bb745b4e2b204f20abdec43aefcc72f19e14e9154c366
-
Filesize
540KB
MD5d1bb47446802afd706f2babed529db80
SHA147919e77e8868ac2df4fd7342ca0d0a72766f680
SHA256b674d17a6cd5f472328f0f3620c5df73b3e40fbdf8e0435082bc5585d44d85b5
SHA512dd551bb14d8a44a8713a6fe7758caa6632e085881cb9631e6cd5a61d21e2a87095d14e67fcb1fca29c748621bee2080381375a459ba362d6bb27156cdf5426d2
-
Filesize
12KB
MD5889877fa28258b0b090ed237f13ed913
SHA13855323a745849c2ad9e977e550b852a2b14547c
SHA256c1e99d89bbcd86560beb3ee91b5903a73e6de7da838d0350f355dcf44657ca4c
SHA5125e5ca3a3b63c35d743303dce0c1bbf94ca15ca96a2e6f8cc84e8649f611793c8e4c1fb2a3d3fe8c5a4074c468159193dfd7f8df1b569405c3fee604ab4840fe4
-
Filesize
262KB
MD55ecda0a54c4d9babcdb177d54f2e733d
SHA1e98aa5abf7cc44b50fe6ca7c6b110bb04541fe5b
SHA256e0926d6cbb4b4bbe673eec59325646ae8f2702e87584bf31dee28c385f45a32c
SHA51245cb28462f6114765fcf831e2ae4ffc5fee1f59746e9e749106b7cf00b7967a788e5591da2a4e0a6e3ae52d60395d1d66be6112026709c33261c4ca839211616
-
Filesize
232KB
MD5fe6ce5653b2a3fb957a81b3f25a9af0d
SHA149e63520058854f5022948d24772010ab08c50cc
SHA256a601934cc639c232c03e1b42dac730e14b922b21f12be805d98cb5ae02308c1b
SHA512af438cdc02babd7dd948ff807f9948f42a9c548877ad9aebaf562452af1af505a27ae36648cfe1f547f4491aa4c1bfcf60b08b8c38e326042d76c0f11a78fc68
-
Filesize
227KB
MD56e17361f8e53b47656bcf0ed90ade095
SHA1bce290a700e31579356f7122fb38ce3be452628a
SHA2568811e5fe167223d906701bc8deb789de0a731e888e285834bcae164b03d43c96
SHA512a566fc8bbb4d354db32f13de2fde73a1210c61b1c30a1be22b16c7e98b8d51c673259c57a924b04035cb9f0bf4a087a3e8b32221e7ff87032cddc840ffe3ed2f
-
Filesize
231KB
MD58d3da743a83b2652ae18bed6877d89f4
SHA1031a0ea53fa75f097fc5aa5639b7df414bf1409e
SHA2562090a9008b98f74f820e06553e0d06ee21e74b1da064fefb1f811f8bb6ef73a7
SHA512d4c1f8fcbf90fc73d8d9b81ee712e9901613cad52722720c6a94777e3a5917e4ddba061c683f5e1a504add2d8a23870ec3beb7d3dd866bc6c40543a62d7447d7
-
Filesize
35KB
MD5de3d87b2cd9076f7806243c9a9ae56f1
SHA123bcb1ecd3f2ffe3eed99f5b116a8d77d9f1a61f
SHA256fb14e057ff933e6f196510fd8f6d35a3b4ab517773306e63094a27b03f347b35
SHA51225798b8514bba551bc045456f7d8f030d85b9762673602eda51ab9332a6be5e3580cc9c2e2233f458264d72437e44fcc761666b21f696e806b351b88bcb1824d
-
Filesize
1KB
MD5029626e8a06994a05e66100a4d0f551e
SHA128a967d83b2d86e7e5e2c28ef2330e90d2b3a06f
SHA256854dade484745df11edb20e7e6860fa66e3c6a165578ab40e83d3edbcac17608
SHA512febfb21f70c7880cd6d01a7d4554b26904649b016f927fa80d9e8bd574e4e62c91ea686f5d5e071efba8ceb846555d613f54a82043bc0832f8aa15d1fbd1e786
-
Filesize
61KB
MD593d49b9cf00e1174da8a39b37aa86784
SHA1be36a1a90e620bca0e208da302725cdb5e6f1ca1
SHA256468d2b8845d50b1f0e10f0a8feb9b45a50f585e3e66665e2ad72fb28a4055fe0
SHA512d32b2a12fd92e66a771d3003278cfa8972e0a057175537b72718363cc34320c17209cdd39076a5e0dbabe15b2fb16e554cf71f95db04637c7b4d10fc389b38eb
-
Filesize
181KB
MD54ac5ebd8c9a060c8802d47701fedb53f
SHA1cd2c7ce3fef7bc099342f97b825da9716f5fe33f
SHA2563d542968ba44aea0fb2ccb1c628ddc3a5382dca877ee2dff80e860babfb08cbd
SHA512f6933adec0c44ad6032d293c2559c30155a1ad8618ae37be6197afc42235f19743e01b0c1e2f682566019c2450d58877696742ef9aa997df17e05ea4a2d1fd6b
-
Filesize
5KB
MD554d1acabe4b39fd198bfe92ed34af7ce
SHA17a8617027945c12fb3350672d1d84bbb3f566da7
SHA25689c643b23a3956b88b13c001c70f25b1def8cb820dcbe24c443fc384b245d424
SHA5125df5e7835f037c33e4d20a1b5e6a135e8f9a35125fc5d0759704bd2c7a837eb57dd1743b090df0b13b49ee036126332618391b0e84ce2badeedad45634c9a362
-
Filesize
312KB
MD50963bf78ceddfdb1d1953a0f796290dd
SHA1e644a66755da2e6465bb2f1b7fb653bfca9f7a36
SHA25629a1ed6bb84724b4bba345b42325e7601d66ecbf2db3770869f45e0dedf0fd1a
SHA512fe1508d28bc085f5af0be068fa2e80079069827cff4fece23ecf4285707d5b105739bb6565de9cf7112abd09437b610e115a050b8ff16e9ab615fdc14846d56f
-
Filesize
4.7MB
MD543dd623d2af3f36a12dee9d01963aefe
SHA13159ed4067fba68f1ddf981f39624fa608367e32
SHA256ff95944c5d89a795161ea4b6554d49b1c74a8e642c497164580c72a6b24e2906
SHA5128fb7583fb9c306f9c1fd818d28de24d87efc4802e0803df16a5b6c0df72bcb32ecfaaf92d6e9f50cc5f9eb11cabcc8dcf204aa85ecf4850fee7c7bf58e576569
-
Filesize
4.0MB
MD55689d43c3b201dd3810fa3bba4a6476a
SHA16939100e397cef26ec22e95e53fcd9fc979b7bc9
SHA25641f45a46ee56626ff2699d525bb56a3bb4718c5ca5f4fb5b3b38add64584026b
SHA5124875134c664503242ec60717232f2917edca20286fc4b675223edbbe5dc0239ebfaf8f67edd76fedcaa2be5419490dc6f47930ca260e6c9988ccf242416c204b
-
Filesize
835KB
MD587603ea025623b19954e460add532048
SHA1d27fc9abbeccb60906d22906ef9a73bd05da2b7a
SHA2568d08136a1964c72b6b450b11d9bf2b3d3d289c26dfadfc9f021114eac2cea1ca
SHA512f2af8c8eab805a39ccd3ccc3b8d1c3401c81f1b3d2dbe719aa39f6fcc28af955d778465aec8b699460e6897629f758b7986b5f7fb4705ba174911c3736c4f520
-
Filesize
61KB
MD5515173853f81eeecb1e5cd9131883828
SHA125d51da0c4ac5fc7b047a571e589c3384c7a1f4c
SHA2560c49009c4dda6486543563bc9c732ac85f8349e999e120d8e1628d8d27776e7e
SHA51234f2364a4719d858926f2c0d237451f286f43931d8be0ed50a8b9b7bedbe37f09a2a43a892a1fbb3b79f64cae56558c38aef69eaf942b9576e9e55ec257441a0
-
Filesize
610KB
MD5547b43e7c3a9fccfe33a0d1f630b4024
SHA19115ce93b4bdae29f3139e2dcca380ecbbfb8c9c
SHA256b83d2753d39343fb75f1ce3b81664569a5558fd097ca8d75a43c7adee544ed1f
SHA5123cc5f09c3dff8d993ca617b6de9d0f2978fdd650d71b7220c5d951afee1fd0c68e89237908fc3d37193dc4df0cb005afee4a9f0ed0407d0dbe482a3716edddf1
-
Filesize
148KB
MD5962b85d5bc8945d80b4839e47efe8fdd
SHA13291792ee90594baa9083ef544779d6b550d3fec
SHA2561b220c5a2f74162d7162ba241ad6c594aaf009cc1329429dcf2112e10477e2b5
SHA5126a2c104a45cb9f11e9a6e2ba2674c03a8b1102ad2be25f1df3bde6af4933db475a6537b54a8d4086867a655f4067980b99dc4844230f7d2727af45dcf5a794ff
-
Filesize
88KB
-
Filesize
388KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
1.9MB
-
Filesize
160KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
548KB
-
Filesize
1.9MB
-
Filesize
20KB
-
Filesize
92KB
-
Filesize
20KB
-
Filesize
120KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
108KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
20KB
-
Filesize
64KB