Overview
overview
7Static
static
3Better-Cre....1.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3d3dcompiler_47.dll
windows11-21h2-x64
3ffmpeg.dll
windows11-21h2-x64
3libEGL.dll
windows11-21h2-x64
3libGLESv2.dll
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3swiftshade...GL.dll
windows11-21h2-x64
3swiftshade...v2.dll
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
3vulkan-1.dll
windows11-21h2-x64
3Better-CrewLink.exe
windows11-21h2-x64
7LICENSES.c...m.html
windows11-21h2-x64
3d3dcompiler_47.dll
windows11-21h2-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
1resources/elevate.exe
windows11-21h2-x64
3swiftshade...GL.dll
windows11-21h2-x64
1swiftshade...v2.dll
windows11-21h2-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3Uninstall ...nk.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
-
max time kernel
191s -
max time network
179s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-09-2024 21:21
Static task
static1
Behavioral task
behavioral1
Sample
Better-CrewLink-Setup-3.1.1.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
d3dcompiler_47.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
ffmpeg.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
resources/elevate.exe
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
swiftshader/libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
swiftshader/libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
vk_swiftshader.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
vulkan-1.dll
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
Better-CrewLink.exe
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
LICENSES.chromium.html
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
d3dcompiler_47.dll
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
ffmpeg.dll
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
resources/elevate.exe
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
swiftshader/libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
swiftshader/libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
vulkan-1.dll
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
Uninstall Better-CrewLink.exe
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-en
General
-
Target
Better-CrewLink-Setup-3.1.1.exe
-
Size
184.0MB
-
MD5
8542023462fa6ad957d7350842e28d1d
-
SHA1
7b42580f5b636d697314632a503a5db0f95621e7
-
SHA256
299f540f9bfc0fe589ceff868b65107e0e8421116bbcff8f859f4b242105281c
-
SHA512
35a26bcdb8f7dd2cd7c3ecffdcd2db4ac1e8aee57125a5230d5dce3719e4540fa96df135f2f72b895fb88c346a56cd5a871b52cdebf3804a48106588ae622858
-
SSDEEP
3145728:/kIwoSOiRXHBdMqop0G2Sk6y8WqvTNFQOT9mgwoaFC8Y4Zj3dGM4Q9l1I6Ea8WIM:hSdRRdpop12SoqpFQ6m6spdGMDj1I5at
Malware Config
Signatures
-
Executes dropped EXE 19 IoCs
Processes:
Better-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink-Setup-3.1.3.exeold-uninstaller.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exepid process 4588 Better-CrewLink.exe 5088 Better-CrewLink.exe 5116 Better-CrewLink.exe 5056 Better-CrewLink.exe 4832 Better-CrewLink.exe 1052 Better-CrewLink.exe 1264 Better-CrewLink.exe 2056 Better-CrewLink.exe 4788 Better-CrewLink.exe 2476 Better-CrewLink.exe 1932 Better-CrewLink-Setup-3.1.3.exe 1752 old-uninstaller.exe 3724 Better-CrewLink.exe 4576 Better-CrewLink.exe 4564 Better-CrewLink.exe 2720 Better-CrewLink.exe 2148 Better-CrewLink.exe 1032 Better-CrewLink.exe 648 Better-CrewLink.exe -
Loads dropped DLL 50 IoCs
Processes:
Better-CrewLink-Setup-3.1.1.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink-Setup-3.1.3.exeold-uninstaller.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exepid process 5112 Better-CrewLink-Setup-3.1.1.exe 5112 Better-CrewLink-Setup-3.1.1.exe 5112 Better-CrewLink-Setup-3.1.1.exe 5112 Better-CrewLink-Setup-3.1.1.exe 5112 Better-CrewLink-Setup-3.1.1.exe 5112 Better-CrewLink-Setup-3.1.1.exe 5112 Better-CrewLink-Setup-3.1.1.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 5088 Better-CrewLink.exe 5116 Better-CrewLink.exe 5056 Better-CrewLink.exe 5088 Better-CrewLink.exe 5088 Better-CrewLink.exe 5088 Better-CrewLink.exe 4832 Better-CrewLink.exe 4832 Better-CrewLink.exe 4832 Better-CrewLink.exe 4832 Better-CrewLink.exe 4832 Better-CrewLink.exe 1052 Better-CrewLink.exe 2056 Better-CrewLink.exe 1264 Better-CrewLink.exe 4788 Better-CrewLink.exe 2476 Better-CrewLink.exe 1932 Better-CrewLink-Setup-3.1.3.exe 1932 Better-CrewLink-Setup-3.1.3.exe 1932 Better-CrewLink-Setup-3.1.3.exe 1932 Better-CrewLink-Setup-3.1.3.exe 1752 old-uninstaller.exe 1752 old-uninstaller.exe 1752 old-uninstaller.exe 1932 Better-CrewLink-Setup-3.1.3.exe 3724 Better-CrewLink.exe 3724 Better-CrewLink.exe 3724 Better-CrewLink.exe 3724 Better-CrewLink.exe 3724 Better-CrewLink.exe 4576 Better-CrewLink.exe 4564 Better-CrewLink.exe 4576 Better-CrewLink.exe 4576 Better-CrewLink.exe 4576 Better-CrewLink.exe 2720 Better-CrewLink.exe 1032 Better-CrewLink.exe 2148 Better-CrewLink.exe 648 Better-CrewLink.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
Processes:
tasklist.exetasklist.exetasklist.exepid process 768 tasklist.exe 1828 tasklist.exe 2760 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
old-uninstaller.execmd.exetasklist.exeBetter-CrewLink-Setup-3.1.1.exefind.exetasklist.execmd.exetasklist.execmd.exeBetter-CrewLink-Setup-3.1.3.exefind.exefind.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language old-uninstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Better-CrewLink-Setup-3.1.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Better-CrewLink-Setup-3.1.3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe -
Modifies registry class 2 IoCs
Processes:
Better-CrewLink.exeBetter-CrewLink.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2842058299-443432012-2465494467-1000\{114E18FA-36F5-44FD-9C9A-9A6C58C43583} Better-CrewLink.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2842058299-443432012-2465494467-1000\{78266256-B3FB-4521-B536-7812CFD3F87A} Better-CrewLink.exe -
Processes:
Better-CrewLink.exeBetter-CrewLink.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Better-CrewLink.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Better-CrewLink.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Better-CrewLink.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Better-CrewLink.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Better-CrewLink.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Better-CrewLink.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Better-CrewLink-Setup-3.1.1.exetasklist.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exeBetter-CrewLink.exepid process 5112 Better-CrewLink-Setup-3.1.1.exe 5112 Better-CrewLink-Setup-3.1.1.exe 768 tasklist.exe 768 tasklist.exe 5116 Better-CrewLink.exe 5116 Better-CrewLink.exe 5056 Better-CrewLink.exe 5056 Better-CrewLink.exe 5056 Better-CrewLink.exe 5056 Better-CrewLink.exe 5056 Better-CrewLink.exe 5056 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 1264 Better-CrewLink.exe 1264 Better-CrewLink.exe 4788 Better-CrewLink.exe 4788 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 2476 Better-CrewLink.exe 2476 Better-CrewLink.exe 2476 Better-CrewLink.exe 2476 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe 4588 Better-CrewLink.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
Better-CrewLink.exeBetter-CrewLink.exepid process 4588 Better-CrewLink.exe 3724 Better-CrewLink.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
tasklist.exeBetter-CrewLink-Setup-3.1.1.exeAUDIODG.EXEtasklist.exetasklist.exeBetter-CrewLink-Setup-3.1.3.exedescription pid process Token: SeDebugPrivilege 768 tasklist.exe Token: SeSecurityPrivilege 5112 Better-CrewLink-Setup-3.1.1.exe Token: 33 3952 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3952 AUDIODG.EXE Token: SeDebugPrivilege 1828 tasklist.exe Token: SeDebugPrivilege 2760 tasklist.exe Token: SeSecurityPrivilege 1932 Better-CrewLink-Setup-3.1.3.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Better-CrewLink.exeBetter-CrewLink.exepid process 4588 Better-CrewLink.exe 3724 Better-CrewLink.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Better-CrewLink-Setup-3.1.1.execmd.exeBetter-CrewLink.exeBetter-CrewLink.exedescription pid process target process PID 5112 wrote to memory of 4808 5112 Better-CrewLink-Setup-3.1.1.exe cmd.exe PID 5112 wrote to memory of 4808 5112 Better-CrewLink-Setup-3.1.1.exe cmd.exe PID 5112 wrote to memory of 4808 5112 Better-CrewLink-Setup-3.1.1.exe cmd.exe PID 4808 wrote to memory of 768 4808 cmd.exe tasklist.exe PID 4808 wrote to memory of 768 4808 cmd.exe tasklist.exe PID 4808 wrote to memory of 768 4808 cmd.exe tasklist.exe PID 4808 wrote to memory of 1752 4808 cmd.exe find.exe PID 4808 wrote to memory of 1752 4808 cmd.exe find.exe PID 4808 wrote to memory of 1752 4808 cmd.exe find.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5088 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5116 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5116 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5056 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4588 wrote to memory of 5056 4588 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe PID 4832 wrote to memory of 1052 4832 Better-CrewLink.exe Better-CrewLink.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Better-CrewLink-Setup-3.1.1.exe"C:\Users\Admin\AppData\Local\Temp\Better-CrewLink-Setup-3.1.1.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Better-CrewLink.exe" | find "Better-CrewLink.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Better-CrewLink.exe"3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768 -
C:\Windows\SysWOW64\find.exefind "Better-CrewLink.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1752
-
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=gpu-process --field-trial-handle=1492,16365507920065283791,15298427250900431008,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1500 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5088 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1492,16365507920065283791,15298427250900431008,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1912 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5116 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=renderer --field-trial-handle=1492,16365507920065283791,15298427250900431008,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\bettercrewlink\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5056 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1492,16365507920065283791,15298427250900431008,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2504 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1492,16365507920065283791,15298427250900431008,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2660 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1264 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=renderer --field-trial-handle=1492,16365507920065283791,15298427250900431008,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\bettercrewlink\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4788 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=gpu-process --field-trial-handle=1492,16365507920065283791,15298427250900431008,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2268 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2476 -
C:\Users\Admin\AppData\Local\bettercrewlink-updater\pending\Better-CrewLink-Setup-3.1.3.exeC:\Users\Admin\AppData\Local\bettercrewlink-updater\pending\Better-CrewLink-Setup-3.1.3.exe --updated --force-run2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Better-CrewLink.exe" | find "Better-CrewLink.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4408 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Better-CrewLink.exe"4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1828 -
C:\Windows\SysWOW64\find.exefind "Better-CrewLink.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\nsn8CC.tmp\old-uninstaller.exe"C:\Users\Admin\AppData\Local\Temp\nsn8CC.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /currentuser --keep-shortcuts --updated _?=C:\Users\Admin\AppData\Local\Programs\bettercrewlink3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Better-CrewLink.exe" | find "Better-CrewLink.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Better-CrewLink.exe"5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2760 -
C:\Windows\SysWOW64\find.exefind "Better-CrewLink.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3508
-
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=gpu-process --field-trial-handle=1480,5303094605057446398,3354427678270932147,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1488 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E01⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --updated1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3724 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=gpu-process --field-trial-handle=1480,11911587288236546931,17652381893452040315,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1500 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4576 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1480,11911587288236546931,17652381893452040315,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1884 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:4564 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=renderer --field-trial-handle=1480,11911587288236546931,17652381893452040315,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\bettercrewlink\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1480,11911587288236546931,17652381893452040315,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2612 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1480,11911587288236546931,17652381893452040315,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2588 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2148 -
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"C:\Users\Admin\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" --type=renderer --field-trial-handle=1480,11911587288236546931,17652381893452040315,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\bettercrewlink\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
MD560439acbeba63c34906cc0f0ab59ae96
SHA1aa8578ce9a818ecda1939ca242c48d66234d02b5
SHA2560b120c3e81296fd111c2cfb26be3bdff5592a96f90c83c0fe035173723c1bc51
SHA512e62a1f54c26e4ba295b63a91f30d8a42319ea2b9a1c9373daef7b34b25d71285935950aa7d499691f8aba721eb6c783d6ea257b1a16a2b7c3344be7a228450e1
-
Filesize
376KB
MD523736aee583670357e966f7dd24b2277
SHA1cfb2c3ee81d5f75efd3e915ca1e65f14fbfcaefb
SHA256551d4db796bef07afcfebe03526d40eb6f64f52bb6db53f7bc6374eed0b05cd9
SHA512f1c6b310ebe9c1e58105baae83c6ef41ef0450237a1f77dc1415efbac0f881121f223338a6faa6264872e2f4e5f13f785d256432003960e63163804040645ac1
-
Filesize
121KB
MD506baf0ad34e0231bd76651203dba8326
SHA1a5f99ecdcc06dec9d7f9ce0a8c66e46969117391
SHA2565ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189
SHA512aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91
-
Filesize
181KB
MD557c27201e7cd33471da7ec205fe9973c
SHA1a8e7bce09c4cbdae2797611b2be8aeb5491036f9
SHA256dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b
SHA51257258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4
-
Filesize
4.3MB
MD57641e39b7da4077084d2afe7c31032e0
SHA12256644f69435ff2fee76deb04d918083960d1eb
SHA25644422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA5128010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
-
Filesize
2.7MB
MD5eabfc10d56cb44a86493cb2f8ca7aab2
SHA109d7e87f43527333cd021329d6c2f4e8bd8ddab5
SHA25642a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6
SHA512ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec
-
Filesize
10.0MB
MD5ad2988770b8cb3281a28783ad833a201
SHA194b7586ee187d9b58405485f4c551b55615f11b5
SHA256df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108
SHA512f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01
-
Filesize
438KB
MD5660a9ae1282e6205fc0a51e64470eb5b
SHA1f91a9c9559f51a8f33a552f0145ed9e706909de8
SHA256f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85
SHA51220bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263
-
Filesize
7.3MB
MD5bc45db0195aa369cc3c572e4e9eefc7e
SHA1b880ca4933656be52f027028af5ef8a3b7e07e97
SHA256a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10
SHA512dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f
-
Filesize
83KB
MD5bd8f7b719110342b7cefb16ddd05ec55
SHA182a79aeaa1dd4b1464b67053ba1766a4498c13e7
SHA256d1d3f892be16329c79f9a8ee8c5fa1c9fb46d17edfeb56a3d9407f9d7587a0de
SHA5127cd1493e59e87c70927e66769eb200f79a57e1eb1223af4eb4064088571893d3e32cbc4b5ece568fd308992aad65684aa280dc9834f2b5d327bdee514b046e5e
-
Filesize
4.8MB
MD5d13873f6fb051266deb3599b14535806
SHA1143782c0ce5a5773ae0aae7a22377c8a6d18a5b2
SHA2567b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506
SHA5121ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939
-
Filesize
98B
MD50a3ae323e08ed941f643db395eca5a32
SHA1e6046fe60ab894db2e1e4630277185966176b788
SHA256d71d6ee5dfc92148981eae3f4003bb652a70afaef3317f58086381a956362a2e
SHA512e51280adc4026b3efe32ae581063455b7d79f9ed44b2293db5019d1d0b95a1267a75547f62059640c99dc6e970e244a504c27a70b184bd85cf380e43fae6972d
-
Filesize
3KB
MD5f08fc50072fe61ad1064d1c90517322c
SHA173c4e8f37b7de7f8906bcb1343176f11b9ded60b
SHA256e7f83c9fc336d949b1c0e34dc318270da82a9d80318e74df15b220bbf4c66f2d
SHA512c008dc7c17da88ca93454b00a6363861f673b0632857001529acdae29aafbd679b1a4dae9b7283c129d1f88210a308c91bc1c196b7c67485c2fe6615230ece09
-
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\resources\static\images\logos\sizes\1024-BCL-Logo-shadow.png
Filesize116KB
MD58df49f099cb48f680c6b87695670b957
SHA1d4c0a682465f383c1d222d461d2e0491aa741b92
SHA256c47d248e56fef8207fb97a0097f505b9f2c8fb7e791c173df87937bb6e1383ae
SHA512072485d80574c5fb185384066a913c6103c99c9141f15500cee1271ab6c93536301cbcae6c37986873b73e693f2577e04de100de4cd3a963f766cf0971cfa199
-
C:\Users\Admin\AppData\Local\Programs\bettercrewlink\resources\static\images\logos\sizes\128-BCL-Logo.png
Filesize404KB
MD5962e6af6faf9a5a4809fae306c770313
SHA1df2dcafb4042beab5d9715944c3c95e6f7da5623
SHA256f4f04bb088d74efb58688a21507421103f808b8481c87f98a825d38e3648aaac
SHA5129ad6e6ecf245676922288a745b4f42ba6e789ff127c53423c1397a1f57c1f53b9aa7cf042a04289cf930245c47e127849dea8debb5e13410d4eb43b01c7e24a0
-
Filesize
5KB
MD5b901ae3c7a6263e469c11581f9467bf9
SHA15112aee468f1e330858aacca861161d259aacc2e
SHA2566352b0d68e6f7a43d36f5038074503adebc54c544b6d013273bebbe818c6853c
SHA5125981ec07861cd6dfc660ca14d5513caf534144b80bba4fc2c6ab6f477aeec2aa17b722c9f5821117901efbb64bfc2b5b3d201b5caeab9b9240da45a708f9436c
-
Filesize
168KB
MD5c2208c06c8ff81bca3c092cc42b8df1b
SHA1f7b9faa9ba0e72d062f68642a02cc8f3fed49910
SHA2564a67de195878d290f49b503b83e415917b8bbcbd9936b07a5d33b48e9bc6e0a3
SHA5126c3c370dd086a976c44d4059a315bd3bcbb50961aa34734e65a40d861cffca9090d47cec74575afe23952e394e4845bda2d8798eebe01fb54a7a6288bce238f5
-
Filesize
116KB
MD5a81237a15d311941416a20d6d431cd6d
SHA1617065b1e56d4bd915c4d5b9525bf447d94e38a2
SHA25648afbd43cd077fb2cfab92c31f550dbc11e49d9584f599667d5b9fc2d771bbd9
SHA512f29d5074af1f6a78946bb26cc690b87b26171176ac68774527d19c1a091fd5e9dd3d7b855a452922cb567dde5c987d820334c8034e8e4d847a65be8f9f306c5d
-
Filesize
134KB
MD579b8e161c45b27de0f317af0a641c47a
SHA1e772c3fb59ad50cdcae0c9a49ce75900afe3c6a0
SHA2567fce92ad3f4165f7465e5f1fd84091922df448495c9337f20d6d9601b297c289
SHA5123f5a385f109cb55a5d035a11b1943ef32234ed7927c4122b1cdf2593513d45026bb15b610a55c4fe0f032bd3c618b186fab3b6619469cb14c2ca2766f72f6f24
-
Filesize
613KB
MD5174c50bb9795f9d23b87158da5cfa977
SHA1f5d963f733d9a82490bd828051b45c2b322b032b
SHA25677ad8327ae7fb12e0d6b8f3d806311be07d2c34cca0da720cab2af4cb8c30435
SHA512bf9bb12ac5b4a38fba44736ddefd48afb98ba3b5ce9ee262ea24ae7d41b8d4a41cb5a8c66336218e40cc20c2df75166b11587ea4c4a6764e5942a7cfa110b769
-
Filesize
208KB
MD5914127d4327b5b6c8bd939e1be5bc350
SHA1cc665ad9ac714a4f6d933192a894ac92f1b9fac6
SHA25683e818beb4c8aaefebd3ef4bbf2b03614c58a13787993539d17e5414ce584c26
SHA5120825d51cfa8b9339bf509101407c90386e7625dd74bc37e5d67b3237b0163fc10e6df9990d890dcd15c5a37847c11ad8a70386b2e6e0d6b9bbff114be4598c9c
-
Filesize
9KB
MD517309e33b596ba3a5693b4d3e85cf8d7
SHA17d361836cf53df42021c7f2b148aec9458818c01
SHA256996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA5121abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
Filesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
59B
MD578bfcecb05ed1904edce3b60cb5c7e62
SHA1bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA256c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
SHA5122420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
-
Filesize
57B
MD558127c59cb9e1da127904c341d15372b
SHA162445484661d8036ce9788baeaba31d204e9a5fc
SHA256be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA5128d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
-
Filesize
132B
MD5c574670a8bdbf9e6b0442997f9738db7
SHA16029c09bc3e1a7d0ff0dda77742afd76c913c379
SHA25693dcd165c74a0bc6d88893d059438918aba00a1689975a46ce566418771155d7
SHA512158b93cbf9058fc7eaf544dbf4f2a370823d87b14ca3ed3cb526d73b74dd1daeed60ca45239dca6025dc3f6944fd52135115cef8439e3753e9dd5cbadf45568e
-
Filesize
161B
MD5356bb4b7893a70e1ed805dc4d3073687
SHA181b45299b89c885f4f60652e04cbaae80af84373
SHA256789e4bee2a6de184ed1927fd82f7299c6a1984f0713379305c238f09f0829d74
SHA5124894fe8f5895f7e4562039de4b3b83f6ccf245067570f3b333254e842cc99398e06932a81ca9aabd0a85a986193b0128094231750dea5ff4bd819d93992c0c25
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1KB
MD539e0ffad643551417ac5c8fdd9775dfb
SHA17aba2a6241b939d61a3668b2df8e4e5910321b8b
SHA25668013684399d387c36c4c4eb88c12b69dec57d2d5c91223713a43f328d145992
SHA512b4a496f570f5bbfe7aa75d66f691632a752d9d2e832e6353e9d20e0b6b29c62e0685631f5324c2da23c921f1d89ef3a317292fc4a52e5d99024898a98d2f847a
-
Filesize
1KB
MD533162e760bccf2b99fca7c70ca2bcf69
SHA19fe46ba6cea79f5612794c74d7e87f75b14484d9
SHA256b6ce600cd1f0d968e188475d81bb8014b71ac6e5e348fb578bc4a4392b47cdb0
SHA512273bb468c9bd911bf0381613986c9cae18da2c98e130de8cafba697215f778dca2f95d24ad9627562a6e3a11160bf826ce176d0878da34f7ddd03b0cd11f0ee9
-
Filesize
1KB
MD59c1ad788183c38dc77c0173201714532
SHA1e4faa9ea3763dca2a6ea325e2389ba79ed9c2e79
SHA25621fba93cffffa78e4b42f2f464506c6f665a93eafea0178c0abaadfd1e1be60e
SHA512dabed66e0d6b8313cb84f7a61f9f6ead14e36d701b9afde4e28e200b70b39a3e521b7dd71cc2e2d2dd4b5e6b12ad9b23e9534ad251ce31fd26dd981500aa152d
-
Filesize
1KB
MD5e1350a4f733b66aec7d9efb4daf681af
SHA11126b48281388c3be273a8e2dc9fdf633b1dd901
SHA25653a6445de9b3b28e8d070f8723883085e9288041f292b619dd14e853ed7437cc
SHA512670166e2d43ae763891c8f7ae2590fd7e9fc746a144cc8414469fd763af7396db1379ba62604a60576e6dc1304d8a29e7e64bbcf6b374a45d68867967f1648fb
-
Filesize
1KB
MD5576ccedc2a52ce9fd68fcb81aa18df4b
SHA19290ca9d7d16bb8e6308f64cec835ec8a0d4811d
SHA25640193224659f141f4dff7732c54c9467c538440e9ec9c6f66b1147483ac36add
SHA512b787d427e3745a90f2473f021ea14f92f9fa169a089fb514aad19b72d0f8a15cb496cd32dbcd2a58f175356ef8c717d2bf7f009886934d7f9620b9330b824323
-
Filesize
1KB
MD55d59cff9a99bb219f4fe7e1502f7b4c7
SHA1b4a657a2158ca88449c30b37e38f4fd260c6e01d
SHA256d166bc87a59ac38ef87d648efe813ff3befb889fb67a17e1b4cc3db757c7db64
SHA5128cace5bfce0066a37e47f1a3d4a9f1382581c251d4b117b9bb48b7990fd6d9533a6f2d168fb214e7ef3ee287209058f43e3df1bdcdf0a4a3f044e2fdf15bbbcc
-
Filesize
1KB
MD5fa2991e2ed793246cce1a94b5f155421
SHA15d6c77338633f654dc65f78f393b0010c38a3aa0
SHA256c7e234d099e6ace5de2165b9165084c64ae7963732e9fca73ccc114e24ac1f7f
SHA512b7c7f17ff458a08c51e493b9fdff1bb10fee23b5b2e9e87e099686528961ee6d1b983876b0df39399751244a86d14ae5038c093a5fd1478718d118986569aac3
-
Filesize
1KB
MD56acaaff3489c490f13e686b1905d048f
SHA111aaa70670a81326dfb432ba36cedecbdf681532
SHA25673acb1d8debfb09ad8d9cf5996b646548de8296a0ed11880990d05b3cbbd43a2
SHA512226502b0d9b8e9f60a568e32636a1ccdf64969c897b1a5ef23f7e3f4501b2d2ee182099b10bb8a556a50692fa14e7562be47e9d8614a07258c312ca544a6e358
-
Filesize
1KB
MD5905dd129c4e0a781964c068a2abb5576
SHA1d0dc3955734f4613fd9f551ba788ac24ddddb8da
SHA2560c099805dadfb149f57a1e78893b3713661760df60475f4839be1e7f62615c31
SHA5127db318d899da87655efcd4a269588f7f1d281b7bc894065c09bd5e10ed3650dd9224f64a23abcb855fb3df7e4670551029903141dd37af79dc18b85376d80ae8
-
Filesize
1KB
MD5e13caf84998874f7874d64ec1dc3982b
SHA12a11d4433d65592e651e09b9635113458f1ce8fd
SHA256fdacbea8f4b6826581b085c03df5b5128a6fda4de97b79b0cd677eee0229257b
SHA512a05b2d17a9bd2344666bd13d1d22bc61f6508f8e3dfb46ff1016f310c2f731bec6db1eb6bb91ec1e74b9d9e60458274d261b59fbb444a179635b67fc224b63dc
-
Filesize
1KB
MD58c9c579cc701aa5927a7206b1c6fa983
SHA13bd54db85578fc2187a033415c4864d18676a73a
SHA2560fc8af49db2f2276a8cf221d7ebedf702c1780dc24fcd35218671e2957a8066a
SHA5122fa46171a58c573af4ad886a09a2c9f7da4e39f783a4f6c086d45ee0ab63ef937697d0252aaf1271ae89372a58e3313fabc8dfc89cdc0ed3f72d67382f79aa34
-
Filesize
1KB
MD59700b65b344b860b1532a5b1398cef6b
SHA141c4e559d7098f00cf9ae95be8a3972074277055
SHA2569bb499604ed487237dc504cab68a515222b405776090bfee47f580f989c411c1
SHA512a320ae9b316f8a0c10727df25b6f2595a25de02b7816f16786f70b56203ba273b8cea0933a1c75934d8a0d08a6088f83d1084ed6875742d409354e509d7d456e