Analysis
-
max time kernel
95s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 22:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/TheDarkMythos/windows-malware
Resource
win10v2004-20240802-en
Errors
General
-
Target
https://github.com/TheDarkMythos/windows-malware
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
wscript.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\MicrosoftWindowsServicesEtc\\xRunReg.vbs\"" wscript.exe -
Processes:
wscript.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
wscript.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1" wscript.exe -
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid Process 3172 takeown.exe 4328 icacls.exe 4496 takeown.exe 920 icacls.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MrsMajor2.0.exewscript.exeGetReady.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation MrsMajor2.0.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation GetReady.exe -
Executes dropped EXE 4 IoCs
Processes:
MrsMajor2.0.exeeula32.exeGetReady.exenotmuch.exepid Process 436 MrsMajor2.0.exe 4704 eula32.exe 3612 GetReady.exe 3700 notmuch.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid Process 3172 takeown.exe 4328 icacls.exe 4496 takeown.exe 920 icacls.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wscript.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MajorX = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xRun.vbs\"" wscript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
Processes:
cmd.exedescription ioc Process File opened for modification C:\Windows\System32\taskmgr.exe cmd.exe File opened for modification C:\Windows\System32\sethc.exe cmd.exe -
Drops file in Program Files directory 37 IoCs
Processes:
wscript.exedescription ioc Process File opened for modification C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\GetReady.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\majorsod.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\rsod.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\Major.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\example.txt wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\fexec.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\healgen.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\bsod.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\clingclang.wav wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\GetReady.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\bsod.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\RuntimeChecker.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\fileico.ico wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\DgzRun.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\xRunReg.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\breakrule.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\eula32.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\breakrule.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\runner32s.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\xRun.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\checker.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\excursor.ani wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\majordared.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\majorsod.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\NotMuch.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\cmd.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\majorlist.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\CallFunc.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\runner32s.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\thetruth.jpg wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\Major.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\majorlist.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\WinScrew.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\WinScrew.exe wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
MrsMajor2.0.exeeula32.exeGetReady.exenotmuch.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MrsMajor2.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eula32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GetReady.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notmuch.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exechrome.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies Control Panel 4 IoCs
Processes:
wscript.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Cursors wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani" wscript.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "198" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe -
Modifies registry class 11 IoCs
Processes:
wscript.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon wscript.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 228541.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exechrome.exepid Process 2480 msedge.exe 2480 msedge.exe 5052 msedge.exe 5052 msedge.exe 976 identity_helper.exe 976 identity_helper.exe 4108 msedge.exe 4108 msedge.exe 1052 chrome.exe 1052 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exechrome.exepid Process 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
chrome.exetakeown.exetakeown.exeshutdown.exedescription pid Process Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeShutdownPrivilege 1052 chrome.exe Token: SeCreatePagefilePrivilege 1052 chrome.exe Token: SeTakeOwnershipPrivilege 3172 takeown.exe Token: SeTakeOwnershipPrivilege 4496 takeown.exe Token: SeShutdownPrivilege 2844 shutdown.exe Token: SeRemoteShutdownPrivilege 2844 shutdown.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exechrome.exepid Process 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
msedge.exechrome.exepid Process 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe 1052 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid Process 1252 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid Process procid_target PID 5052 wrote to memory of 2432 5052 msedge.exe 83 PID 5052 wrote to memory of 2432 5052 msedge.exe 83 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 4588 5052 msedge.exe 84 PID 5052 wrote to memory of 2480 5052 msedge.exe 85 PID 5052 wrote to memory of 2480 5052 msedge.exe 85 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 PID 5052 wrote to memory of 4328 5052 msedge.exe 86 -
System policy modification 1 TTPs 2 IoCs
Processes:
wscript.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/TheDarkMythos/windows-malware1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f4c46f8,0x7ff85f4c4708,0x7ff85f4c47182⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5156 /prefetch:82⤵PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1752 /prefetch:12⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5960 /prefetch:82⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3504
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:788
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1052 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff85135cc40,0x7ff85135cc4c,0x7ff85135cc582⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1832 /prefetch:22⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2232 /prefetch:32⤵PID:4104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2296 /prefetch:82⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:1212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3336,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3444 /prefetch:12⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4588,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4604 /prefetch:12⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4560,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4572 /prefetch:82⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4852 /prefetch:82⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4420,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4452 /prefetch:12⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3400
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4528
-
C:\Users\Admin\Downloads\MrsMajor2.0.exe"C:\Users\Admin\Downloads\MrsMajor2.0.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:436 -
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\65F8.tmp\65F9.vbs2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- System policy modification
PID:3936 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd\&cd "C:\Users\Admin\AppData\Local\Temp" & eula32.exe3⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\eula32.exeeula32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4704
-
-
-
C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\B6F7.bat "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe""4⤵
- Drops file in System32 directory
PID:1852 -
C:\Windows\System32\takeown.exetakeown /f taskmgr.exe5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
-
C:\Windows\System32\icacls.exeicacls taskmgr.exe /granted "Admin":F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4328
-
-
C:\Windows\System32\takeown.exetakeown /f sethc.exe5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\System32\icacls.exeicacls sethc.exe /granted "Admin":F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:920
-
-
-
-
C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3700
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 53⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3959855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1252
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:3216
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD557f3795953dafa8b5e2b24ba5bfad87f
SHA147719bd600e7527c355dbdb053e3936379d1b405
SHA2565319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725
SHA512172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98
-
Filesize
216B
MD5710970d43efe3c2656ec119f99410e73
SHA10b1abd60eed01488736edbf5584dd993f97700ab
SHA25668a6568e2df5453bd585771dd34e2f0bb7004ab0f53e5acf1fcdacc2865429d3
SHA5122adfbaf51fdd6954777d95f609bfd04061e1ca6930bc3ed9c6cb3f971d173218971063caa7e891cb315e136d1bb716862a6f63dc6881a40010bdab2cb1b2f4c3
-
Filesize
2KB
MD54ef65348bbae046f2d3a329cdf913fe2
SHA1f6e5c5d6a027af382005e9cbf09979ffad941e32
SHA2562e5db98783aba64cf39a4e21cabbaea1d49e4db0be88cb602c77c42db81fc0f0
SHA512e76591ef30fc1ae3d956857612b0856772b67ab7da1b8aa5bc4805726f4741e6bc36e36b13a30fb9b043e6cf7a04ec4c492b4551f3ecf8ed39d8e3948ed37610
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD5d113063f3f624beb7ac81d46b0fa76a5
SHA1aead573dac883df4a8f8ca611a309630ce12988c
SHA256d5615b557d94650b1d5f2dcf5572cad03d7e48df1169a080ec0d464bcc99f898
SHA5124bc5f392524a128dfc0ebc700cd7662934c9a42351ddee4aa0937770409aa9356e6815cd0f3322c2558aaff4b28cfff7386f4d3b9494ac61ae63bdacdf8f1ed2
-
Filesize
8KB
MD5de883e3a4fb91973e579cf86d29d9e6d
SHA1966b25ba3c94202b1f9a9bb7e0aaa4bd8b2d491e
SHA256d5fab198a278b0f296abf385296f66582bf4103e5c6eeb74238dd6dba57ed149
SHA51216b628b61c0297be8ee8dc68527bfc70a66e92bb943cc0e088e2da5bd0690d884618eca50af301eabeb7aad4a46d7babd31c91d7ef890c59b47bb62d7c81bed7
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
99KB
MD519c08f4a1b456a0d1ea86b04b5595e8e
SHA1aa0f190cb8bdb193a2c7ca2c759ec52fde070de4
SHA256fc2ed0bb111b96fd6712816743f764e29949a73ec2ca6ba1168ec223be975bd8
SHA5127290a8e388c839bffe3ea6453ec1697e50fe10489f2185fef912ca9a47d34301da8b6345cd05b3ad76455e9779bec21c9c2ec2ce9b0a767d2a202d3d20bdc519
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD566dc299a01f0f3989f4bac9be58bde09
SHA11efef7a293638932033da0fcfd6454087505d6b2
SHA25601eee756c1b1e8198e9c855d52ed94424bf7aabf057f9a639becc85d4ebfc26c
SHA5120474c4daf7ad3d8d64cef74a9b6690b65fdc8c88da4f0f4334ba5e323898764327d4891a11558263425272ce690e69b24f6d283a19127a96a107a14b2ace5e6f
-
Filesize
579B
MD5106247267798fa1d7190823a5dd5c2a8
SHA162ff3bed0b462d3a59eb3d4aa1f0849e43612c61
SHA256d59a10df53802434b539b56f779878466f70463da9508ef850f69c20fd590e9e
SHA5127ce5fc8a4d2e13f265430e9ddc523bd5a4fd5c9bfd4dcb8e699429770888898b12b3d3c0313fd6c51c6638869e08286e6e16fa8894b6f606c88b42db973a83df
-
Filesize
5KB
MD56cced760f835a2cc58b166e5481c6e45
SHA1ccba3f94f608f26ca90744103d60e5c562e23363
SHA256d972e091aca6038efa68f38c2805e832c3b78214c6da4e25cf0e53570d09bdbc
SHA512f6caf4877278a0b8a0365a0703d8f00a927a92d917365a8f799b34c3b7b8b951104f68eab2e1efeaec85dc34de29d39d50395c9be108943acb7e46ee2393d437
-
Filesize
6KB
MD5ec9cc2bd7a32a801f0d3eaf3a8e2ba84
SHA19f2bf328f6d7f9b765e0348291c63481eacdd70d
SHA256b081e99a927936419a3038ab668fbfbc98661e6034e88829e0732f7c1d01dfdd
SHA5125780ad562177d6570b95b0a72fe1dc7853733b70121c32eb133107b038662b669fd3db30b2f42ade39ad2b83fc7a486d367f160e194ed05be630e8b237db04af
-
Filesize
6KB
MD53632740429c23718fb1b281617da8643
SHA1f63c213b7e7733489319f10797f2d9635db087fd
SHA256dfdee7620a3d04784280f12755199c8681e5fb2781d51fe035e708c12cbb4ab4
SHA5124dd8394105d81669b3b39e56afbbf897ba5534e45426ba5cf21bc875ca897646746ab9757f08e946be614c7cf59d60bfb99411bfdf3c624a8f3b47a322c76afb
-
Filesize
6KB
MD541b60c9f18a495d9fe9d626dd2cfcb0f
SHA1da7e3554e2e9e003320c121f9e0669a4f9f58d92
SHA25666c8c39c40b2532ae3677aae43f3eeca144160b60a41600ad467656b66e89c8a
SHA512034bd4111d5ba964d3ebdf55976c947dc2599ca357aea95911439abf2583cfa94083a3ebea91f1b05263465ed8d39cc7eb2084a1e736f0aa8832b2fa4b7f5f97
-
Filesize
874B
MD53d6e142b475701e122b4070f6e12c26d
SHA1ca06c79b914641b7d88e8684653cb9a3b74d3221
SHA256f4a65183438b5870e3f078cc26426738f6ae1273205a98bc7b0091cc3d25c6fc
SHA5122d2d4f1e4813f167d0961828cf3008fc6ec1f4cd762db407045d8463330e3893b8cf0a6e2d0907e2a7d05cae1cd599e172edccedc87e57db13b85511d7a55f19
-
Filesize
1KB
MD53e448bd9a10b807ef3f24918fc48034c
SHA187a93d8c2980e3045dd6ab349d664729206e548f
SHA256917c77066b32665d6fabbe457e806df401cc3b9cd75fd570c754169b476c8cbf
SHA512e2849bd8fb157e3e9bbd1ed2f9e270cd615b4290fe1c9c53a175304239fc6cdcefe49bf421de41dc80c29288a240be58fd3ec117f66f886283de7e3336e2f6e8
-
Filesize
1KB
MD5c591f8742a0a061c84d4efbdf56b423f
SHA1397738286a5102820fc681f08361d8aeb742be24
SHA256edd35708f676231795f0665d8fa0fc1d0fdfd146cb34c60d32d281e51366a474
SHA51251e6e660500d5dcb8f4f425fac403c7767c23806ec93a681f207fc2910dd9fb088f954dd8fb72d9c55e9554a7adb0389fc3c6009fcaa81c55bc7e4a85a3b4777
-
Filesize
874B
MD5ae3360cbdacdee5149b6d8bb95ef8f3b
SHA1d8b3f2fb8e754593457e9bfd6d780c5f34651018
SHA256f998799c4bedbee76196c3db6a34f7ec036a8b92e89c4403ce2a2b7b40723d5c
SHA5124eb6fa21b1a1aa551086eea5a33b1694e2a7f6ce29124fb4b9112a78e8b702d90c8efa71ed7aeca1b092a709e5e2dea0d9cf1cdffdc635560e4541b1b104456e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD51a2b89b5177cee34062dc614031d1d46
SHA1b79b5eb6e94128f4826b2c906f0082d34f5cd6bd
SHA2566ac6724ac56cf5abc8a5996b98f8d5fa623262ed7d75731be99f4facad0720c0
SHA51286532b248433278541e68b29e9b2a65d2c6ea5eff3c3c65944b846c9e7323803f3479ec16e010473a1fd80c0b0acbea6bbfad5a0de233716fa1d414fe4ed2a1c
-
Filesize
10KB
MD5e870bc252083773eddf5d0cec05c45cb
SHA1962ab8669656f8cd346e7c162b8e497200b57192
SHA25639617f696d80d04c0bc8611d363f9dbc292fadb556fcff213e1a6ea09724cd42
SHA512b5cb5bb85d9cc5ea0399c4ad02edcd6bdca5d6a2c1562427528ca634ead28efbbd623be9253de5f8f88af15859809acc826124aaa336c233319e21c297007732
-
Filesize
356B
MD5fe81c1282a808b7a1d0a27d7cccaa624
SHA1f6afc7b26ead8cdb51b11d59c6e68e5aab265bfa
SHA2563e18de7065154144b54a2f7c179c27b3f27c3cda5871f472f452a8cfc3dc6791
SHA512873e226360edc463dd753aedfec7ec60e0d8efac08652245709862b8bd9e6ae85eb6ea6f05d8d2c0ec1c8e7fc1bddeebc5037efcac1ceb5b1f099b49c0a93045
-
Filesize
2KB
MD5fd76266c8088a4dca45414c36c7e9523
SHA16b19bf2904a0e3b479032e101476b49ed3ae144a
SHA256f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f
SHA5123cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072
-
Filesize
671B
MD5d4e987817d2e5d6ed2c12633d6f11101
SHA13f38430a028f9e3cb66c152e302b3586512dd9c4
SHA2565549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
SHA512b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
-
Filesize
388B
MD55f9737f03289963a6d7a71efab0813c4
SHA1ba22dfae8d365cbf8014a630f23f1d8574b5cf85
SHA256a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275
SHA5125f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a
-
Filesize
341B
MD5a91417f7c55510155771f1f644dd6c7e
SHA141bdb69c5baca73f49231d5b5f77975b79e55bdf
SHA256729f7540887cf32a5d4e1968a284c46cf904752821c734bd970ecd30a848477a
SHA512f786699c1ab9d7c74dd9eb9d76a76728980b29e84999a166a47b7ee102d8e545901ed0fcb30331712490a36de2d726115b661ad3900cdc2bfcfc601d00b76b07
-
Filesize
60KB
MD5d604c29940864c64b4752d31e2deb465
SHA1c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3
SHA256da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d
SHA51289a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54
-
Filesize
122KB
MD587a43b15969dc083a0d7e2ef73ee4dd1
SHA1657c7ff7e3f325bcbc88db9499b12c636d564a5f
SHA256cf830a2d66d3ffe51341de9e62c939b2bb68583afbc926ddc7818c3a71e80ebb
SHA5128a02d24f5dab33cdaf768bca0d7a1e3ea75ad515747ccca8ee9f7ffc6f93e8f392ab377f7c2efa5d79cc0b599750fd591358a557f074f3ce9170283ab5b786a1
-
Filesize
58KB
MD5cd58990b1b7f6c68f56244c41ab91665
SHA17ccca9958d6aebbe3883b55f115b041b827bd2e7
SHA25651f59e877a1c2a1c2760c677def7395ef2868c2ee3e56ffdc3ace570afa50428
SHA512011bdd417ec3bf72daa2b32d3816b696be8b87423740dc2a0182e23515651deeb870a94f3415a73480145f9f5e36c1a3a492410b77ca95d7fab8b9826e9198cc
-
Filesize
52KB
MD51aaafedd9f259acca75708f4af10b5be
SHA1f6b4ea28d304e1f9205c1c0b970d60ee989402f2
SHA256429e01b0e06b02a55bafb1527629f8d4c5f64d9b21ac9f81484a3928fdce6dc9
SHA512a995ebf4d142452aabb419f0cacfa5412d03532840cb08c37dd7c00001dee521bf9d0da66ac4346b07dffd91fe01fa3115fa05811acbd43d380320dca1be4aa8
-
Filesize
58KB
MD5bcb0ac4822de8aeb86ea8a83cd74d7ca
SHA18e2b702450f91dde3c085d902c09dd265368112e
SHA2565eafebd52fbf6d0e8abd0cc9bf42d36e5b6e4d85b8ebe59f61c9f2d6dccc65e4
SHA512b73647a59eeb92f95c4d7519432ce40ce9014b292b9eb1ed6a809cca30864527c2c827fe49c285bb69984f33469704424edca526f9dff05a6244b33424df01d1
-
Filesize
1.2MB
MD58f6a3b2b1af3a4aacd8df1734d250cfe
SHA1505b3bd8e936cb5d8999c1b319951ffebab335c9
SHA2566581eeab9fd116662b4ca73f6ef00fb96e0505d01cfb446ee4b32bbdeefe1361
SHA512c1b5f845c005a1a586080e9da9744e30c7f3eda1e3aaba9c351768f7dea802e9f39d0227772413756ab63914ae4a2514e6ce52c494a91e92c3a1f08badb40264
-
Filesize
151B
MD5f59801d5c49713770bdb2f14eff34e2f
SHA191090652460c3a197cfad74d2d3c16947d023d63
SHA2563382484b5a6a04d05500e7622da37c1ffaef3a1343395942bc7802bf2a19b53f
SHA512c1c3a78f86e7938afbe391f0e03065b04375207704e419fe77bf0810d1e740c3ef8926c878884ad81b429ec41e126813a68844f600e124f5fa8d28ef17b4b7bc
-
Filesize
13.1MB
MD51c723b3b9420e04cb8845af8b62a37fa
SHA13331a0f04c851194405eb9a9ff49c76bfa3d4db0
SHA2566831f471ee3363e981e6a1eb0d722f092b33c9b73c91f9f2a9aafa5cb4c56b29
SHA51241f4005ec2a7e0ee8e0e5f52b9d97f25a64a25bb0f00c85c07c643e4e63ea361b4d86733a0cf719b30ea6af225c4fcaca494f22e8e2f73cda9db906c5a0f12ae
-
Filesize
1.2MB
MD5cbc127fb8db087485068044b966c76e8
SHA1d02451bd20b77664ce27d39313e218ab9a9fdbf9
SHA256c5704419b3eec34fb133cf2509d12492febdcb8831efa1ab014edeac83f538d9
SHA512200ee39287f056b504cc23beb1b301a88b183a3806b023d936a2d44a31bbfd08854f6776082d4f7e2232c3d2f606cd5d8229591ecdc86a2bbcfd970a1ee33d41
-
Filesize
17KB
MD5289624a46bb7ec6d91d5b099343b7f24
SHA12b0aab828ddb252baf4ed99994f716d136cd7948
SHA256b93b0cb2bb965f5758cb0c699fbc827a64712d6f248aaf810cde5fa5ef3227eb
SHA5128c77696fe1c897f56ea3afdecf67ad1128274815942cd4c73d30bf0a44dd1a690d8c2f4b0be08e604853084e5515020c2e913d6e044f9801b6223c1912eec8f8
-
Filesize
38KB
MD5a62eeca905717738a4355dc5009d0fc6
SHA1dd4cc0d3f203d395dfdc26834fc890e181d33382
SHA256d13f7fd44f38136dae1cdf147ba9b673e698f77c0a644ccd3c12e3a71818a0cd
SHA51247ffac6dc37dac4276579cd668fd2524ab1591b594032adbeb609d442f3a28235a2d185c66d8b78b6827ac51d62d97bdc3dffc3ffbaa70cf13d4d5f1dc5f16c2
-
Filesize
58KB
MD587815289b110cf33af8af1decf9ff2e9
SHA109024f9ec9464f56b7e6c61bdd31d7044bdf4795
SHA256a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4
SHA5128d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc
-
Filesize
483KB
MD57907845316bdbd32200b82944d752d9c
SHA11e5c37db25964c5dd05f4dce392533a838a722a9
SHA2564e3baea3d98c479951f9ea02e588a3b98b1975055c1dfdf67af4de6e7b41e476
SHA51272a64fab025928d60174d067990c35caa3bb6dadacf9c66e5629ee466016bc8495e71bed218e502f6bde61623e0819485459f25f3f82836e632a52727335c0a0
-
Filesize
302B
MD58837818893ce61b6730dd8a83d625890
SHA1a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
SHA256cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
SHA5126f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
-
Filesize
8.8MB
MD5570d35aabee1887f7f6ab3f0a1e76984
SHA1ae989563c3be21ee9043690dcaac3a426859d083
SHA256fa24bc7bc366f2ad579d57a691fb0d10d868e501221df0c32a98e705d2d61e43
SHA5129b68a8acacba451bbf028656c181fae29c5bcaed6a7ff4c1fc26ab708b62ca4be7bba9c777c598926d23331570617d20a0ce439f014461eccd8c3f595d21a54f
-
Filesize
51KB
MD5230970ec5286b34a6b2cda9afdd28368
SHA1e3198d3d3b51d245a62a0dc955f2b1449608a295
SHA2563cdafc944b48d45a0d5dc068652486a970124ebe1379a7a04e5cf1dcf05c37c8
SHA51252912b6b2ba55c540316fcfc6f45d68771d1c22ddf4eb09c2cc15fb8ddd214812c18fd75cd61b561c29f660e2bf20290a101b85da1e0bbf8dfbf90b791892b57
-
Filesize
58KB
MD5b561c360c46744f55be79a25e1844e3c
SHA1ed0f7eb00b4f1ae6cf92ad75e5701014f3d03d56
SHA256d1094e91960ded15444c6f50756adc451a7c0b495b2ea28319b7184ba96236f7
SHA5120a3a75d08f1d7afcd7a476fc71157983e04b0c26b00ace4d505aa644e5da3e242dd0f6afdb3c93f29ba0b08d2702d0e96b49acba4ed260330068b13f93973e9f
-
Filesize
74KB
MD591a0740cfb043e1f4d8461f8cbe2ff19
SHA192e1ad31c34c4102e5cb2cc69f3793b2a1d5304e
SHA256dcaabfd6955d3fec26a86217d1b1ab7e979c301d498473e4d885145ce031fc3b
SHA512c60067655e5f191708af9b25382869e3ce65cd3ea2d6cac70f8cae4132942cfd6a8aa9dde1e2b7f3f12997d6d7411e21dc73ab4cd83ec555d74b82b86778a613
-
Filesize
345B
MD53dbccaadafb7f0227c1839be5ca07015
SHA1bd636f73235d52d172ad8932a8e4a6a8b17389a0
SHA25633a0c62f3f66bce3fc1beb37aca8ad731bfa5590177d933d9d4eae016019242a
SHA512d981670f9d492d97931ab260a7d7d27d4f97621a1ef3e20246d4be2a9b4cfc01e01174a1d46432b4a3d937ad135c97eec9ef7bbc7da46034388843887df4637e
-
Filesize
2KB
MD59192fd494155eab424110765c751559e
SHA1b54fcc1e29617b3eee1c7bb215c048498881b641
SHA256cbd3b0f294e8f11592a3ad80d1070d81746f806a48183b93c345251422ccbf0d
SHA512b8c48916535f3721e7f47be6af671765c3befefcd407c6ea5fabcf9ada119747408d662f61fb436f98a7c33050b6674da54dddf25e683429204a96555ec6e801
-
Filesize
440B
MD5fe44b78a465853c0ac0744c6ab05ea40
SHA1f32dacd91b9547fce9a8a2846a4e17c33295aab3
SHA256989d947c51c878bcefecb53d867a3c182c2d67129a87a5f6773eb6ef2bbf9b2e
SHA5126b945e16786833c2e2e9867315b8859c413687fc72d4c8576b9c0a1aed2dc65249468317dd49f2ecf777e27c9969b7a7abc72b4d9b7c182dc7999051377515db
-
Filesize
336B
MD504067ca733ee8b2ab2f068edc8b75a0f
SHA1973cb577f6ab2463040918c3661333553a3132c8
SHA2563aef33c03777abe62feef0a840ac6a087caafc05adfe801464fd1c52eac656a0
SHA5125423a1e668211f269a3d787548e11d18de7365d6c2525c2de61014854f1ab5a51b5de9eda70fb21d6ebe356cb52e93b3f406c71ed7fbcaedd2b023b6fa9c13f8
-
Filesize
108B
MD52609fde7a9604c73be5083e4bcfa0e20
SHA1068c89f703fb11663143b9927f2a0c9f9f59c0e3
SHA25617d014cb4abbaced3acce9b6d7a1b595cd6e2dd814e41f06ceddcdc08e93eebe
SHA512439fee7cc198cb3fef4ef14693141e52c305579a4ff2da0842323f57dcffade03f3b01ac288080fed423511937a4c1e2080f5a79f967a963fe34253f541824cb
-
Filesize
133B
MD5c94bb8d71863b05b95891389bed6365e
SHA107bb402d67f8b1fc601687f1df2622369413db3b
SHA2563900e3b60b4691311e050c4cf8fac82ff178a06e3d04d5d6b2d7ea12cf5d53d1
SHA51200e7ab3a91862faaf5ac5ca3de6dbf2cbb8aac4aba277e1e14b2ecf4650eea2e68134e0df549dca35ab715ed46e36fa9cfee1ba7bb3520511723bf567566682d
-
Filesize
11B
MD5b181d5a4055b4a620dd7c44c5065bbe7
SHA136320f257026b923b923ad2c0e7fa93a257806e0
SHA2564d2639e890d6d5988eb9cb6f8cb50647048bbfeeb83fc604c52567e7381c876c
SHA5120bec0cf2e5b93065701c5458c1d7e047312971d7bbed3ce5444db710654fa0d84eabb7d7c243130e3cb2dae38eb05874929b5b08547174a6065f8accd4e0433d
-
Filesize
105B
MD54cc606c63f423fda5324c962db709562
SHA1091250ffc64db9bea451885350abed2b7748014c
SHA256839301ef07178c100e7f4d47874faf995ae5d11dfd527dda096a284c8114671b
SHA512f29ef2bc694f497499545d1fa4e14ca93c06049fff582af3a6caf3885153491a1cd9e96ab5a6746051aa972421f876c008e5d5b671bd34c3922b61c84151097f
-
Filesize
126B
MD5fecb9e50c1f01d9d6101f273cb860260
SHA118c413f577c289004db6156bd133e5db70258044
SHA2568863b595563e92d73b29090ff83191b2fa1297507be588aa7e1cf910e77c7feb
SHA5122c30641b099d5b6c3af40cb41e70160c1f4294bb30dc3162b018e9552b48fc899d1a63d3e366bfb71fcf6803bcc518cf8d504ce60684ce221028a9bf2bc07f9d
-
Filesize
383B
MD55f427dc44f33906509423d24fa0590c0
SHA1b896f7667381a594d3751e05f258925b81c231c0
SHA2569aae0707b1d5d3b7ed3bf5cc8fbb530aebd195e3e2f18312f3f7f1aa43e031b4
SHA512bd28c386772062ef945f24c8ad7a25f158856af36e31d2c9b14674cedfd34b4f48ed531cd40a7eb291384d83665ffe154f0786c1a7ee1616256cf30125120961
-
Filesize
93B
MD526ec8d73e3f6c1e196cc6e3713b9a89f
SHA1cb2266f3ecfef4d59bd12d7f117c2327eb9c55fa
SHA256ed588fa361979f7f9c6dbb4e6a1ae6e075f2db8d79ea6ca2007ba8e3423671b0
SHA5122b3ad279f1cdc2a5b05073116c71d79e190bfa407da09d8268d56ac2a0c4cc0c31161a251686ac67468d0ba329c302a301c542c22744d9e3a3f5e7ffd2b51195
-
Filesize
134B
MD58267192f547f8914ff36eff80ca3f402
SHA123bdeb19fb37059e1293dd80d8be69480c957c73
SHA256cdd4f356ca256c707960bc42b97649111a830e6f951ca6a3cf80853e3c342947
SHA512cd684cb73496ca925fd8604fbbf286b842e2b02ce18b19d63618e8355dcec02bce700fb09b25da932545845b01a7f8d9986fa486db504b92a42d7c0ace21e9e2
-
Filesize
25.6MB
MD5247a35851fdee53a1696715d67bd0905
SHA1d2e86020e1d48e527e81e550f06c651328bd58a4
SHA2565dd4ea169cabf9226f54bb53e63ea6a1b5880a0d1222242aee378efb6255b57d
SHA512a173801aaef4fab608d99b52223b5b2400d69b91edcbf33c21fcb47bd832eef9d771dfd36da350a502a371ed1739c869a7c2b4dca456c93f2feed9ac9c647c7c
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e