Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2024 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240708-en
windows7-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral3
Sample
2.exe
Resource
win7-20241010-en
windows7-x64
33 signatures
150 seconds
Behavioral task
behavioral4
Sample
2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral5
Sample
3.exe
Resource
win7-20240708-en
windows7-x64
33 signatures
150 seconds
Behavioral task
behavioral6
Sample
3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral7
Sample
4.exe
Resource
win7-20241010-en
windows7-x64
33 signatures
150 seconds
Behavioral task
behavioral8
Sample
4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
31 signatures
150 seconds
General
-
Target
3.exe
-
Size
2.5MB
-
MD5
937e0ce2cea3458236b6048250f341da
-
SHA1
9f28ec0fbc4254eab70799d62ae297df1bf5e0c7
-
SHA256
50080976f722a7c65fedbf8ce187521117714e1728ddbaf1153fbca950bee0fb
-
SHA512
afbcf1201bc438f8f572879d67241421d1234f1dd622b9c783d93f800749290a82e7ad53c5127eacef71bf8bdb02056e62b9d0352a9ef636120aa00d60cf0759
-
SSDEEP
49152:QgwRqifu1DBgutBPNeSGIB10SvOGbRrPas8L5pBWBm7dziiv:QgwRqvguPPCbSzris8LfBWBPK
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt
Ransom Note
Greetings,
There was a serious security breach in your systems and this was detected during our scans.
We encrypt your data that you see important in your system by processing twice. As encryption is done as SHA256 and AES256, we would like to remind you that you can not restore your data with known data recovery methods. If you want to use data recovery companies or programs on your side, please do not worry about your actual files,
process and / or make copies of them. Corruption of the original files may cause irretrievable damage to your data.
If you wish, you can contact us via the following communication to resolve this issue.
YOUR REFERENCE CODE
dSrpj5gFWMP-ll0U7Vt6Joc3PAlyDzpjngpVXxmV0UA*[email protected]
[email protected]
[email protected]
Emails
Signatures
-
Detects Mimic ransomware 2 IoCs
resource yara_rule behavioral6/files/0x000a000000023b86-39.dat family_mimic behavioral6/files/0x000a000000023b85-49.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Mimic family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BLUE.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2416 bcdedit.exe 1832 bcdedit.exe -
Renames multiple (3703) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3312 wbadmin.exe -
pid Process 4352 wbadmin.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 3.exe -
Executes dropped EXE 13 IoCs
pid Process 1588 7za.exe 4532 7za.exe 3172 TEQ.exe 1584 BLUE.exe 1344 DC.exe 4548 BLUE.exe 2580 BLUE.exe 1556 BLUE.exe 1844 Everything.exe 4000 Everything.exe 3572 xdel.exe 4704 xdel.exe 5064 xdel.exe -
Loads dropped DLL 5 IoCs
pid Process 3172 TEQ.exe 1584 BLUE.exe 4548 BLUE.exe 2580 BLUE.exe 1556 BLUE.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open TEQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open\command BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command TEQ.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open\command TEQ.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell TEQ.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BLUE = "\"C:\\Users\\Admin\\AppData\\Local\\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\\BLUE.exe\" " TEQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BLUE.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\IMPORTANT_NOTICE.txt\"" BLUE.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BLUE.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\O: BLUE.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\A: BLUE.exe File opened (read-only) \??\G: BLUE.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\L: BLUE.exe File opened (read-only) \??\M: BLUE.exe File opened (read-only) \??\Q: BLUE.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\U: BLUE.exe File opened (read-only) \??\W: BLUE.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\Z: BLUE.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\B: BLUE.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\I: BLUE.exe File opened (read-only) \??\S: BLUE.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\H: BLUE.exe File opened (read-only) \??\N: BLUE.exe File opened (read-only) \??\V: BLUE.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\R: BLUE.exe File opened (read-only) \??\Y: BLUE.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\J: BLUE.exe File opened (read-only) \??\K: BLUE.exe File opened (read-only) \??\X: BLUE.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\P: BLUE.exe File opened (read-only) \??\T: BLUE.exe File opened (read-only) \??\N: Everything.exe -
Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4480 powercfg.exe 1108 powercfg.exe 3432 powercfg.exe 3440 powercfg.exe 3544 powercfg.exe 3036 powercfg.exe 2608 powercfg.exe 4324 powercfg.exe 3676 powercfg.exe 3728 powercfg.exe 1956 powercfg.exe 2676 powercfg.exe 1432 powercfg.exe 4416 powercfg.exe 4412 powercfg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\7-Zip\Lang\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]@gmail.com.blue BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Ion [email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] BLUE.exe File opened for modification C:\Program Files\7-Zip\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\7-Zip\Lang\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pl_135x40.svg.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\[email protected] BLUE.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\[email protected] BLUE.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
pid Process 1996 powershell.exe 4740 powershell.exe 1728 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile BLUE.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open\command TEQ.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\IMPORTANT_NOTICE.txt\"" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open BLUE.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile TEQ.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell TEQ.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\.blue BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.blue\ = "mimicfile" BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command TEQ.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open TEQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BLUE.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open\command BLUE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3676 notepad.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2580 BLUE.exe 2580 BLUE.exe 1556 BLUE.exe 1556 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 4740 powershell.exe 4740 powershell.exe 1996 powershell.exe 1996 powershell.exe 1728 powershell.exe 1728 powershell.exe 1728 powershell.exe 1996 powershell.exe 4740 powershell.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe 1584 BLUE.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1588 7za.exe Token: 35 1588 7za.exe Token: SeRestorePrivilege 4532 7za.exe Token: 35 4532 7za.exe Token: SeSecurityPrivilege 4532 7za.exe Token: SeSecurityPrivilege 4532 7za.exe Token: SeIncreaseQuotaPrivilege 3172 TEQ.exe Token: SeSecurityPrivilege 3172 TEQ.exe Token: SeTakeOwnershipPrivilege 3172 TEQ.exe Token: SeLoadDriverPrivilege 3172 TEQ.exe Token: SeSystemProfilePrivilege 3172 TEQ.exe Token: SeSystemtimePrivilege 3172 TEQ.exe Token: SeProfSingleProcessPrivilege 3172 TEQ.exe Token: SeIncBasePriorityPrivilege 3172 TEQ.exe Token: SeCreatePagefilePrivilege 3172 TEQ.exe Token: SeBackupPrivilege 3172 TEQ.exe Token: SeRestorePrivilege 3172 TEQ.exe Token: SeShutdownPrivilege 3172 TEQ.exe Token: SeDebugPrivilege 3172 TEQ.exe Token: SeSystemEnvironmentPrivilege 3172 TEQ.exe Token: SeChangeNotifyPrivilege 3172 TEQ.exe Token: SeRemoteShutdownPrivilege 3172 TEQ.exe Token: SeUndockPrivilege 3172 TEQ.exe Token: SeManageVolumePrivilege 3172 TEQ.exe Token: SeImpersonatePrivilege 3172 TEQ.exe Token: SeCreateGlobalPrivilege 3172 TEQ.exe Token: 33 3172 TEQ.exe Token: 34 3172 TEQ.exe Token: 35 3172 TEQ.exe Token: 36 3172 TEQ.exe Token: SeIncreaseQuotaPrivilege 1584 BLUE.exe Token: SeSecurityPrivilege 1584 BLUE.exe Token: SeTakeOwnershipPrivilege 1584 BLUE.exe Token: SeLoadDriverPrivilege 1584 BLUE.exe Token: SeSystemProfilePrivilege 1584 BLUE.exe Token: SeSystemtimePrivilege 1584 BLUE.exe Token: SeProfSingleProcessPrivilege 1584 BLUE.exe Token: SeIncBasePriorityPrivilege 1584 BLUE.exe Token: SeCreatePagefilePrivilege 1584 BLUE.exe Token: SeBackupPrivilege 1584 BLUE.exe Token: SeRestorePrivilege 1584 BLUE.exe Token: SeShutdownPrivilege 1584 BLUE.exe Token: SeDebugPrivilege 1584 BLUE.exe Token: SeSystemEnvironmentPrivilege 1584 BLUE.exe Token: SeChangeNotifyPrivilege 1584 BLUE.exe Token: SeRemoteShutdownPrivilege 1584 BLUE.exe Token: SeUndockPrivilege 1584 BLUE.exe Token: SeManageVolumePrivilege 1584 BLUE.exe Token: SeImpersonatePrivilege 1584 BLUE.exe Token: SeCreateGlobalPrivilege 1584 BLUE.exe Token: 33 1584 BLUE.exe Token: 34 1584 BLUE.exe Token: 35 1584 BLUE.exe Token: 36 1584 BLUE.exe Token: SeIncreaseQuotaPrivilege 4548 BLUE.exe Token: SeSecurityPrivilege 4548 BLUE.exe Token: SeTakeOwnershipPrivilege 4548 BLUE.exe Token: SeLoadDriverPrivilege 4548 BLUE.exe Token: SeSystemProfilePrivilege 4548 BLUE.exe Token: SeSystemtimePrivilege 4548 BLUE.exe Token: SeProfSingleProcessPrivilege 4548 BLUE.exe Token: SeIncBasePriorityPrivilege 4548 BLUE.exe Token: SeCreatePagefilePrivilege 4548 BLUE.exe Token: SeBackupPrivilege 4548 BLUE.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1844 Everything.exe 4000 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3496 wrote to memory of 1588 3496 3.exe 85 PID 3496 wrote to memory of 1588 3496 3.exe 85 PID 3496 wrote to memory of 1588 3496 3.exe 85 PID 3496 wrote to memory of 4532 3496 3.exe 88 PID 3496 wrote to memory of 4532 3496 3.exe 88 PID 3496 wrote to memory of 4532 3496 3.exe 88 PID 3496 wrote to memory of 3172 3496 3.exe 91 PID 3496 wrote to memory of 3172 3496 3.exe 91 PID 3496 wrote to memory of 3172 3496 3.exe 91 PID 3172 wrote to memory of 1584 3172 TEQ.exe 94 PID 3172 wrote to memory of 1584 3172 TEQ.exe 94 PID 3172 wrote to memory of 1584 3172 TEQ.exe 94 PID 1584 wrote to memory of 2548 1584 BLUE.exe 97 PID 1584 wrote to memory of 2548 1584 BLUE.exe 97 PID 1584 wrote to memory of 2548 1584 BLUE.exe 97 PID 2548 wrote to memory of 1344 2548 cmd.exe 99 PID 2548 wrote to memory of 1344 2548 cmd.exe 99 PID 2548 wrote to memory of 1344 2548 cmd.exe 99 PID 1584 wrote to memory of 4548 1584 BLUE.exe 100 PID 1584 wrote to memory of 4548 1584 BLUE.exe 100 PID 1584 wrote to memory of 4548 1584 BLUE.exe 100 PID 1584 wrote to memory of 2580 1584 BLUE.exe 101 PID 1584 wrote to memory of 2580 1584 BLUE.exe 101 PID 1584 wrote to memory of 2580 1584 BLUE.exe 101 PID 1584 wrote to memory of 1556 1584 BLUE.exe 102 PID 1584 wrote to memory of 1556 1584 BLUE.exe 102 PID 1584 wrote to memory of 1556 1584 BLUE.exe 102 PID 1584 wrote to memory of 1844 1584 BLUE.exe 109 PID 1584 wrote to memory of 1844 1584 BLUE.exe 109 PID 1584 wrote to memory of 1844 1584 BLUE.exe 109 PID 3496 wrote to memory of 1868 3496 3.exe 110 PID 3496 wrote to memory of 1868 3496 3.exe 110 PID 3496 wrote to memory of 1868 3496 3.exe 110 PID 1584 wrote to memory of 3544 1584 BLUE.exe 129 PID 1584 wrote to memory of 3544 1584 BLUE.exe 129 PID 1584 wrote to memory of 3440 1584 BLUE.exe 130 PID 1584 wrote to memory of 3440 1584 BLUE.exe 130 PID 1584 wrote to memory of 3676 1584 BLUE.exe 132 PID 1584 wrote to memory of 3676 1584 BLUE.exe 132 PID 1584 wrote to memory of 3432 1584 BLUE.exe 134 PID 1584 wrote to memory of 3432 1584 BLUE.exe 134 PID 1584 wrote to memory of 4324 1584 BLUE.exe 135 PID 1584 wrote to memory of 4324 1584 BLUE.exe 135 PID 1584 wrote to memory of 2608 1584 BLUE.exe 136 PID 1584 wrote to memory of 2608 1584 BLUE.exe 136 PID 1584 wrote to memory of 4412 1584 BLUE.exe 137 PID 1584 wrote to memory of 4412 1584 BLUE.exe 137 PID 1584 wrote to memory of 4416 1584 BLUE.exe 138 PID 1584 wrote to memory of 4416 1584 BLUE.exe 138 PID 1584 wrote to memory of 1108 1584 BLUE.exe 140 PID 1584 wrote to memory of 1108 1584 BLUE.exe 140 PID 1584 wrote to memory of 3036 1584 BLUE.exe 141 PID 1584 wrote to memory of 3036 1584 BLUE.exe 141 PID 1584 wrote to memory of 1432 1584 BLUE.exe 142 PID 1584 wrote to memory of 1432 1584 BLUE.exe 142 PID 1584 wrote to memory of 3728 1584 BLUE.exe 143 PID 1584 wrote to memory of 3728 1584 BLUE.exe 143 PID 1584 wrote to memory of 2676 1584 BLUE.exe 144 PID 1584 wrote to memory of 2676 1584 BLUE.exe 144 PID 1584 wrote to memory of 1956 1584 BLUE.exe 146 PID 1584 wrote to memory of 1956 1584 BLUE.exe 146 PID 1584 wrote to memory of 4480 1584 BLUE.exe 148 PID 1584 wrote to memory of 4480 1584 BLUE.exe 148 PID 1584 wrote to memory of 1728 1584 BLUE.exe 152 -
System policy modification 1 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" BLUE.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Greetings,\nThere was a serious security breach in your systems and this was detected during our scans.\nWe encrypt your data that you see important in your system by processing twice. As encryption is done as SHA256 and AES256, we would like to remind you that you can not restore your data with known data recovery methods. If you want to use data recovery companies or programs on your side, please do not worry about your actual files,\nprocess and / or make copies of them. Corruption of the original files may cause irretrievable damage to your data.\n\nIf you wish, you can contact us via the following communication to resolve this issue.\n\nYOUR REFERENCE CODE\n\ndSrpj5gFWMP-ll0U7Vt6Joc3PAlyDzpjngpVXxmV0UA*[email protected]\n\n\[email protected]\[email protected]" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " " BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BLUE.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p1794523514629813379 Everything64.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe"C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe"3⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1584 -
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\DC.exeDC.exe /D5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1344
-
-
-
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe"C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe" -e watch -pid 1584 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe"C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2580
-
-
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe"C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
-
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.exe"C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1844
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off4⤵
- Power Settings
PID:3544
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:3440
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:3676
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:3432
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:4324
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:2608
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:4412
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:4416
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1108
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:3036
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1432
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:3728
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:2676
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵
- Power Settings
PID:1956
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵
- Power Settings
PID:4480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1728
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1996
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2416
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1832
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3312
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:4352
-
-
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.exe"C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4000
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt"4⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:3676
-
-
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe"C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe" -accepteula -p 1 -c C:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3572
-
-
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe"C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe" -accepteula -p 1 -c F:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5064
-
-
C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe"C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe" -accepteula -p 1 -c Z:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4704
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1324
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4684
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:552
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4572
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:652
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:516
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1612
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2212
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2100
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4748
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:1548
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:804
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4356
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4688
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4760
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
798B
MD5ecce8b36183da17049294aa2167f88b4
SHA1bc3afdabd1b0ee3258c14afb08c7d4d576411019
SHA25672c4c54b7684e6d9382e93260c2088a5cc2adc9159f007b1bf685f86cca4b768
SHA5128610d6ce1becc3c4e02e05b8b515bfdcefa6a533d7aa3377e797214330c34b62681bdd1f3165b9b8e0308e2dc6c4c6e8189ae089c3b1f533c3dfbdfc67a65825
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
1KB
MD5fb5eb8486decd5ee26d4a7216c2bab97
SHA17cb5457255f1b5135b3a16a93e81f97d40803615
SHA25688cb58071acf3f407762095429b8ebc25868b9826c29785981585c24ce2cd6e5
SHA51275e7b968ee81f10844ddd24cc446fe276979cbb6588dacee72f57dd9196abcd822745b6e4d95a7cf45650fb73b73e2ee03576b3d6cf4744a1eb6882b956dc714
-
Filesize
174B
MD57adcd899e1068e8745789ab1c8b1cdc9
SHA1594943ead427b5b720edae3f44a46af6fccd4ba6
SHA2561c31f5875c9d1b25b8d4966a800b3776c219062595fcdf3a1599737ef11ddc40
SHA512689c62fe8bb3a820c72cb27f6afbf0d83bca9272d2babf3ae025e698591fe990ce788e3a55f6a2973fcc62130ad2b68169e6a3c5bbe0d7f31578f93442d540d0
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
1.5MB
MD501327fcd52053ba0b9e753de88195637
SHA13c197ff9a594753293a13f82a58d5f4c2b12ed50
SHA25653143309b4f29789d8316c8a424b35b14340b01679d8d53ef65200945f772391
SHA5129d067184978fd2399842b3ed2e3082a46be763d305fd2154eaf0151ce2b7252eafb949f67b0a27ab09f493476b4125db676681361fe5812d83eb39c14da2e5a0
-
Filesize
2.0MB
MD5cfdb19345dec70e33fb559514d0c951b
SHA15b511c7a216105e0d52efddef53f336e36e7c8c4
SHA256d7fe920929797c83862c796b9b1c5bb00445af2bef761fef2fed71a72dc91665
SHA512157beaffd3e916badf389c6e0bff709f347352ffe10a9645f2a1837888901dd64ac248f5fc74e9c4c0689506dcc9050214dc73594a683965b31bb92694969426
-
Filesize
2.1MB
MD57ca770cc5f649256a18623245348f39f
SHA181398374ba4751a61a0d9949cc1fe75f18960741
SHA25607631e96b95b1f01bdc591699ae6bc2e6787387cbe865bc11004bd34c0f9c3a4
SHA512bd70b65f1ef54f1eed3e48013c0332d82370caacd67304e20497c5c8f6d6fd5ef2d838ecc9c4e80dca4e4a107676942495cce4c2526281b32fcad2ee12b33cdc
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
13.2MB
MD5ba57ee9b27c3ec9176f1cfa362f96b71
SHA1c6d790c5258139d7a3f19de545b606046d31a9a3
SHA256f389f8099c1bbfcb7450f93364b1c3199fe125a3db83c4856c3b695dc1ab0aa0
SHA5128dd85892b15da0d6d30e8dcb614001e921d14914bc40563bf1e0bd92239e57dc7f3ee9ad90790d8d72e37e068184832843520a93ff1b8f31ba3d400f8fafdc4a
-
Filesize
20KB
MD542d04c11d16494939b458a71f9efb6ab
SHA18e8b827e5a66d67b30c969fc9572aa7017955f39
SHA2563c123bb4de622d8760010603b8453c1273c459ee7c7adac032ca76897305abfa
SHA5123a7d0e7cd741fdd08f12d363cbba320e1b222b62d1d1e33e56dc33ba8ad6124d68892751ce3a25f0b3596bc72ee1621f0d7cff666ad167da4880eba44076c2f1
-
Filesize
32B
MD5f27a49dfabb6c20af7cf25b8ccdfc1fb
SHA1f6e93e9ef1aeb5be68adf2896d51e58559d48043
SHA2569d9cf3b8c3d3b14fa20f12418a9513fe6894e6f18cf4592d3a0573c0a176eee2
SHA5126ea76569666e07d081cb73c6b8574be1f572cbffe6797b5ddcc50734e955379caf65c01c3e2af57f39c435ca626ce41e7d15ec5207f549130656603a5c3a81ec
-
Filesize
6KB
MD5b39d68a4fd6a1da99a92c1e53d5e2c0e
SHA1a3c5454141d0dde11227d26964e53b23850040a5
SHA25608b1a8c090d7f35703eefcefd0f43d2e5eced4cfb930b080794167faec66830b
SHA512175b61419f43c3dc84c6a5e685ec1cb819034e7afb9e713dd3b377470433c85cbcf6776a801d6fb79f35fcd89626e60ae1df9516b5718ccc11fb3f6dd6985a47