Resubmissions
04/11/2024, 20:55
241104-zqy11sxbqe 804/11/2024, 20:52
241104-znv7caxbmc 1004/11/2024, 20:32
241104-zbrcmaxclp 804/11/2024, 20:28
241104-y9ek2swgrf 8Analysis
-
max time kernel
597s -
max time network
602s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/11/2024, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
sample.js
Resource
win11-20241007-en
General
-
Target
sample.js
-
Size
66KB
-
MD5
cd1b57f91a68cc5b241ca6b07499aa0f
-
SHA1
868e51ad2a98642c5a91d2f0b4d65cd6bf8f97f3
-
SHA256
7909ad298eba1b0e68c4e7a905563960e39bf5fdc324663e91dc9bf1af7e4565
-
SHA512
c61b85472831fc0e115f75106d8fba08d83be592e7e9ec567eacd45c146fe9e1d35c5d970642687dcff9f6452098ab13eb952057e42c79865c8e72138fc3d8f4
-
SSDEEP
1536:a69UFLCCwNieu/behNFZuSuWtWWxnqio1HSEpqc2SkASNWjII6ZsnJVrYa5vfu6c:l9UFLhwskqio1HSEpqc2SkASNWjII6Zx
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components MSAGENT.EXE Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components tv_enua.exe -
Executes dropped EXE 6 IoCs
pid Process 2092 MSAGENT.EXE 3860 tv_enua.exe 3792 AgentSvr.exe 4880 BonziBDY_4.EXE 3600 AgentSvr.exe 892 BonziBDY_35.EXE -
Loads dropped DLL 46 IoCs
pid Process 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2860 BonziBuddy432.exe 2092 MSAGENT.EXE 1008 regsvr32.exe 4804 regsvr32.exe 1780 regsvr32.exe 1396 regsvr32.exe 8 regsvr32.exe 3016 regsvr32.exe 2180 regsvr32.exe 3860 tv_enua.exe 2576 regsvr32.exe 2576 regsvr32.exe 2448 regsvr32.exe 4880 BonziBDY_4.EXE 4880 BonziBDY_4.EXE 4880 BonziBDY_4.EXE 4880 BonziBDY_4.EXE 4880 BonziBDY_4.EXE 4880 BonziBDY_4.EXE 3600 AgentSvr.exe 3600 AgentSvr.exe 3600 AgentSvr.exe 892 BonziBDY_35.EXE 892 BonziBDY_35.EXE 892 BonziBDY_35.EXE 892 BonziBDY_35.EXE 892 BonziBDY_35.EXE 892 BonziBDY_35.EXE 892 BonziBDY_35.EXE 892 BonziBDY_35.EXE 892 BonziBDY_35.EXE 3600 AgentSvr.exe 3600 AgentSvr.exe 4880 BonziBDY_4.EXE 4880 BonziBDY_4.EXE 4880 BonziBDY_4.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet" tv_enua.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvcp50.dll tv_enua.exe File opened for modification C:\Windows\SysWOW64\SETAE41.tmp tv_enua.exe File created C:\Windows\SysWOW64\SETAE41.tmp tv_enua.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\BonziBuddy432\Regicon.ocx BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Snd2.wav BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page1.jpg BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\BonziBDY.vbw BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt msiexec.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\RACREG32.DLL BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\License.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page0.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Reg.nbd BonziBDY_4.EXE File opened for modification C:\Program Files\7-Zip\Lang\uz.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page0.jpg BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\readme.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt msiexec.exe File created C:\Program Files\7-Zip\Lang\ta.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\empop3.dll BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Snd1.wav BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\t3.nbd BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt msiexec.exe File created C:\Program Files\7-Zip\7-zip.chm msiexec.exe File created C:\Program Files\7-Zip\Lang\va.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Bonzi's Beach Checkers.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\emsmtp.dll BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\History.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt msiexec.exe File created C:\Program Files\7-Zip\Lang\is.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\msvcrt.dll BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\sp001.gif BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt msiexec.exe File created C:\Program Files\7-Zip\Lang\sq.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page9.jpg BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt msiexec.exe File created C:\Program Files\7-Zip\Lang\it.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\BonziBUDDY_Killer.exe BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page6.jpg BonziBuddy432.exe File created C:\Program Files\7-Zip\Lang\pl.txt msiexec.exe File created C:\Program Files\7-Zip\Lang\th.txt msiexec.exe File created C:\Program Files\7-Zip\Lang\nl.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt msiexec.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\SSubTmr6.dll BonziBuddy432.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\msagent\AgentAnm.dll MSAGENT.EXE File opened for modification C:\Windows\lhsp\tv\SETAE1D.tmp tv_enua.exe File opened for modification C:\Windows\lhsp\tv\tvenuax.dll tv_enua.exe File opened for modification C:\Windows\INF\tv_enua.inf tv_enua.exe File opened for modification C:\Windows\msagent\AgentCtl.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentMPx.dll MSAGENT.EXE File created C:\Windows\msagent\SETA72F.tmp MSAGENT.EXE File created C:\Windows\Installer\e5b25a5.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx msiexec.exe File created C:\Windows\SystemTemp\~DF0212EF42CA7675A2.TMP msiexec.exe File created C:\Windows\msagent\SETA71A.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SETA71B.tmp MSAGENT.EXE File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\CacheSize.txt msiexec.exe File created C:\Windows\SystemTemp\~DF419E4FF7BB08BDB9.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD08DED8F3A942258.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI17EE.tmp msiexec.exe File opened for modification C:\Windows\lhsp\help\SETAE3E.tmp tv_enua.exe File created C:\Windows\lhsp\help\SETAE3E.tmp tv_enua.exe File opened for modification C:\Windows\msagent\SETA731.tmp MSAGENT.EXE File created C:\Windows\SystemTemp\~DF965F0DF032634BE0.TMP msiexec.exe File opened for modification C:\Windows\msagent\AgentSR.dll MSAGENT.EXE File opened for modification C:\Windows\INF\SETA730.tmp MSAGENT.EXE File created C:\Windows\INF\SETA730.tmp MSAGENT.EXE File created C:\Windows\lhsp\tv\SETAE2E.tmp tv_enua.exe File created C:\Windows\fonts\SETAE3F.tmp tv_enua.exe File created C:\Windows\SystemTemp\~DFD46B1C9042B5C850.TMP msiexec.exe File opened for modification C:\Windows\msagent\SETA719.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentDp2.dll MSAGENT.EXE File opened for modification C:\Windows\INF\SETAE40.tmp tv_enua.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll msiexec.exe File created C:\Windows\SystemTemp\~DFA0656BD780617A4A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC22169B354AAC085.TMP msiexec.exe File opened for modification C:\Windows\msagent\AgentSvr.exe MSAGENT.EXE File created C:\Windows\msagent\intl\SETA743.tmp MSAGENT.EXE File created C:\Windows\msagent\SETA72D.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SETA72F.tmp MSAGENT.EXE File opened for modification C:\Windows\help\SETA732.tmp MSAGENT.EXE File created C:\Windows\help\SETA732.tmp MSAGENT.EXE File opened for modification C:\Windows\fonts\andmoipa.ttf tv_enua.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\SystemTemp chrome.exe File opened for modification C:\Windows\msagent\SETA72D.tmp MSAGENT.EXE File opened for modification C:\Windows\Installer\MSIE1A3.tmp msiexec.exe File opened for modification C:\Windows\msagent\mslwvtts.dll MSAGENT.EXE File created C:\Windows\Installer\SourceHash{23170F69-40C1-2702-2201-000001000000} msiexec.exe File created C:\Windows\SystemTemp\~DF9D07FFB7113C972F.TMP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx msiexec.exe File opened for modification C:\Windows\msagent\SETA718.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentDPv.dll MSAGENT.EXE File opened for modification C:\Windows\lhsp\help\tv_enua.hlp tv_enua.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000 msiexec.exe File created C:\Windows\msagent\SETA718.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\intl\SETA743.tmp MSAGENT.EXE File created C:\Windows\lhsp\tv\SETAE1D.tmp tv_enua.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx msiexec.exe File opened for modification C:\Windows\msagent\SETA71A.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentPsh.dll MSAGENT.EXE File created C:\Windows\msagent\SETA71C.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SETA72E.tmp MSAGENT.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSAGENT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AgentSvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language grpconv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language grpconv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AgentSvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BonziBDY_35.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BonziBDY_4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BonziBuddy432.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tv_enua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000089ac4f3df1c89d300000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000089ac4f3d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090089ac4f3d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d89ac4f3d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000089ac4f3d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437518892" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F474633-9AEF-11EF-9714-FEA1978CE90E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31141728" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.22000.1\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "954397432" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe -
Modifies data under HKEY_USERS 11 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133752273897503051" chrome.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27 msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D0ECB23-9968-11D0-AC6E-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AgentSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinSource.1\CLSID\ = "{53FA8D44-2CDD-11D3-9DD0-D3CD4078982A}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE11629C-36DF-11D3-9DD0-89D6DBBBA800}\ProgID BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53FA8D4E-2CDD-11D3-9DD0-D3CD4078982A}\TypeLib BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5AA1F9B2-F64C-11CD-95A8-0000C04D4C0A}\TypeLib\ = "{E8671A8B-E5DD-11CD-836C-0000C0C14E92}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5AA1F9B0-F64C-11CD-95A8-0000C04D4C0A}\ = "ISSStyleSet" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37DEB787-2D9B-11D3-9DD0-C423E6542E10} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl\ = "Microsoft ListView Control, version 6.0" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62FCAC31-2581-11D2-BAF1-00104B9E0792} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4ABF875-8100-11D0-AC63-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7AE600-0142-11D3-9DCF-89BE4EFB591E} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{643F1352-1D07-11CE-9E52-0000C0554C0A}\TypeLib\Version = "1.0" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DECC98E1-EC4E-11D2-93E5-00104B9E078A}\TypeLib\ = "{0A45DB48-BD0D-11D2-8D14-00104B9E072A}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DACB7A39-CC0D-4B85-908B-10D2451761A5}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" BonziBDY_35.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{916694A8-8AD6-11D2-B6FD-0060976C699F} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BD9-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{916694A9-8AD6-11D2-B6FD-0060976C699F}\ = "RegiCon" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F55ED2E0-6E13-11CE-918C-0000C0554C0A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4900F95-055F-11D4-8F9B-00104BA312D6} BonziBDY_35.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSPanel\CurVer\ = "Threed.SSPanel.3" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EF6BEC0-E669-11CD-836C-0000C0C14E92}\ = "_DSSMonth" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4900F5D-055F-11D4-8F9B-00104BA312D6}\1.4\FLAGS\ = "0" BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}\MiscStatus BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB52CF7D-3917-11CE-80FB-0000C0C14E92}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D47-2CDD-11D3-9DD0-D3CD4078982A} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53FA8D4B-2CDD-11D3-9DD0-D3CD4078982A} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar.2\ = "Microsoft Toolbar Control, version 6.0" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.0\FLAGS\ = "2" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE1-7DE6-11D0-91FE-00C04FD701A5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7AE601-0142-11D3-9DCF-89BE4EFB591E}\Programmable BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\ = "Image Property Page Object" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EF6BEC0-E669-11CD-836C-0000C0C14E92}\TypeLib BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Programmable BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BD1-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D12BA0-5B77-11D1-9EC1-00C04FD7081F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AgentSvr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4900F6A-055F-11D4-8F9B-00104BA312D6}\TypeLib BonziBDY_35.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA478DA1-3920-11D3-9DD0-8067E4A06603}\Programmable BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53FA8D4B-2CDD-11D3-9DD0-D3CD4078982A} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5AA1F9B2-F64C-11CD-95A8-0000C04D4C0A}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4ABF875-8100-11D0-AC63-00C04FD97575}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED86423-10D4-4CE1-8C84-9C9EC1B43364}\ProgID BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F581B2D6-E4C3-40BF-8A1E-F68CDFD8FEEC}\ = "_clsRegistration" BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BD33B25E-E99D-40C3-B5C5-7F5C3F130777}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8671A88-E5DD-11CD-836C-0000C0C14E92}\InprocServer32\ThreadingModel = "Apartment" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B2676D5B-8D53-4569-AF2C-A55A0D90C132}\TypeLib BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{159C2806-4A71-45B4-8D4E-74C181CD6842}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BonziBDY_4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0913412-3B44-11D1-ACBA-00C04FD97575}\TypeLib AgentSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{22DF5084-12BC-4C98-8044-4FAD06F4119A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4900F66-055F-11D4-8F9B-00104BA312D6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BonziBDY_4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37DEB787-2D9B-11D3-9DD0-C423E6542E10}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA478DA0-3920-11D3-9DD0-8067E4A06603}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1533A365-F76F-4518-8A56-4CD34547F8AB}\TypeLib BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSPanel BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE6-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinEvent BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EF6BEC1-E669-11CD-836C-0000C0C14E92}\ = "_DSSMonthEvents" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DB2224E-D2FA-4B2E-8402-085EA7CC826B} BonziBDY_35.EXE -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\7z2201-x64.msi:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\Bon.zip:Zone.Identifier chrome.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3168 chrome.exe 3168 chrome.exe 1648 msedge.exe 1648 msedge.exe 3828 msedge.exe 3828 msedge.exe 3020 identity_helper.exe 3020 identity_helper.exe 3468 chrome.exe 3468 chrome.exe 3468 chrome.exe 3468 chrome.exe 5008 msiexec.exe 5008 msiexec.exe 5008 msiexec.exe 5008 msiexec.exe 5008 msiexec.exe 5008 msiexec.exe 5008 msiexec.exe 5008 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3168 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
pid Process 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe Token: SeShutdownPrivilege 3168 chrome.exe Token: SeCreatePagefilePrivilege 3168 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3828 msedge.exe 3600 AgentSvr.exe 3600 AgentSvr.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe 3168 chrome.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2860 BonziBuddy432.exe 2092 MSAGENT.EXE 3860 tv_enua.exe 3792 AgentSvr.exe 3020 identity_helper.exe 4880 BonziBDY_4.EXE 4880 BonziBDY_4.EXE 892 BonziBDY_35.EXE 892 BonziBDY_35.EXE 4032 iexplore.exe 4032 iexplore.exe 3416 IEXPLORE.EXE 3416 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3168 wrote to memory of 4468 3168 chrome.exe 85 PID 3168 wrote to memory of 4468 3168 chrome.exe 85 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 3576 3168 chrome.exe 86 PID 3168 wrote to memory of 2616 3168 chrome.exe 87 PID 3168 wrote to memory of 2616 3168 chrome.exe 87 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 PID 3168 wrote to memory of 1036 3168 chrome.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\sample.js1⤵PID:3900
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdaf99cc40,0x7ffdaf99cc4c,0x7ffdaf99cc582⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:22⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2076,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:32⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2212 /prefetch:82⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4408 /prefetch:12⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4600,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4584 /prefetch:82⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4596,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4720 /prefetch:82⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4648,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4424 /prefetch:82⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3544,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4588 /prefetch:82⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4784,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3504,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4320,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4944,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5296,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5332,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5312 /prefetch:82⤵
- NTFS ADS
PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3240,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5048 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5124,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1244 /prefetch:12⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5748,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5944,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5936 /prefetch:82⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5920,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5928 /prefetch:82⤵PID:956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5172,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5956 /prefetch:12⤵PID:2040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5516,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3432,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=3488,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5960 /prefetch:12⤵PID:3124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6260,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6244 /prefetch:12⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=3104,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6388 /prefetch:12⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=3216,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6396 /prefetch:12⤵PID:1044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6604,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6356 /prefetch:82⤵
- NTFS ADS
PID:4072
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:4716
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=1456,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:5552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=5144,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5688 /prefetch:12⤵PID:5616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4968,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6508 /prefetch:82⤵PID:5692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6012,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6660 /prefetch:82⤵PID:5700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6440,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6512 /prefetch:12⤵PID:5796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5728,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2724 /prefetch:12⤵PID:5996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5488,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6728 /prefetch:82⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6172,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6484 /prefetch:82⤵PID:896
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"2⤵
- Enumerates connected drives
PID:5572
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"2⤵
- Enumerates connected drives
PID:5924
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4804
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4684
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:1008 -
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXEMSAGENT.EXE3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1008
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4804
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1780
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1396
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:8
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3016
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2180
-
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3792
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
PID:1636
-
-
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exetv_enua.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3860 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2576
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2448
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
PID:4676
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bonzibuddy.tk/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdb0083cb8,0x7ffdb0083cc8,0x7ffdb0083cd83⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:23⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:83⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:13⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:13⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:13⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1184
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2844
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4880
-
C:\Windows\msagent\AgentSvr.exeC:\Windows\msagent\AgentSvr.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
PID:3600
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004801⤵PID:1516
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL speech.cpl,,02⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL speech.cpl,,03⤵PID:4912
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:2192
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4032 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3416
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5008 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3124
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2320
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵PID:2780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:5580
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD50009905b8e9924f4327bd25a58654f4f
SHA13de3d0a647b14c6bb7630d26a95b7639a234dedf
SHA2565bb0531b069493e3c6807fecfdb1c7337f1c4edd59ae4d7a7d1471d28feb21d3
SHA512414a30476ff1cd2b9382c7e487ade7f317d6de9f593e5c06619d154f89041bba650932c4681e925a15e03be4a55c37970dac105fc389d3327820dd416aec8d6c
-
Filesize
31KB
MD524f85c50a4a98f41e66c6353a6ef68da
SHA10cce5895b360b42fbd8b41af6ea25e59c8ba71d4
SHA2566627c01b548626121ee233dc7ffac4de70a7fcf3625903035d66466cf305d0dd
SHA512a02beb4d724c3e5c3e279fee112ce4e573c774a15631c6374ec4bb7907db5aaab3955000bd6d6fa8ff54a303059d28d41436ec1816331d24fa382a1b60b24cdc
-
Filesize
1.7MB
MD5bbf51226a8670475f283a2d57460d46c
SHA16388883ced0ce14ede20c7798338673ff8d6204a
SHA25673578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e
SHA512f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9
-
Filesize
532KB
MD5fe522d8659618e3a50aafd8ac1518638
SHA17d1b392121da91393f69d124928f9fe50d62f785
SHA256254cf6411d38903b2440819f7e0a847f0cfee7f8096cfad9e90fea62f42b0c23
SHA512fbbcb853b77ac038e4b7f7668e9fefdc7ba3592c6899cddfd72125d68d0b2d6b858baa3987907d58a5333ea9a4d5eb0ab8b7535a6263738f96212a6146c49b81
-
Filesize
211KB
MD51ffec2a95db8f1fa25d3b275261728b4
SHA1123fbcc9e2e35b5782ae19bb18e8f8ebdb2fc29b
SHA256dd9dbe58cd2f798b432d9ba9bbffe13d08bf9dc18c9b6a6ecf4ba71b238677e3
SHA5124bd65e5edf3aa9bd6271b0abc17080bfdfca62e0ac1a927ccb01e358dc21c0f7ad3790c02fc2d2a07fb836ce8af471b035adafa12d4c703c2a1745f35fd1114a
-
Filesize
191KB
MD5e0eb40842ca3a05b93e8fcf19f0bcc16
SHA101f14ac781463066de363e63039b6b5c80e7a2d2
SHA25632decd776fc0020d399adcea54ff1b338110514e598a2788b4d9d7ea82582445
SHA5123981e7c761ec81cb1b18e46b82355cb8b160028fca0f5b7159cd9fcab3824172cf496da57518ce9344351d49d576eea0e1d09b54e1d5fbf2da882ffa8061a7d9
-
Filesize
935KB
MD5d36deceeb4c9645aab2ded86608d090b
SHA1912f4658c4b046fbadd084912f9126cb1ae3737b
SHA256018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45
SHA5129752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2
-
Filesize
668KB
MD55ab26ffd7b3c23a796138640b1737b48
SHA16dab8c3822a0cab5b621fd2b7f16aebb159bcb56
SHA256eb775b0e8cc349032187c2329fefcf64f5feed4d148034c060e227adf6d38500
SHA5122b40489f46e305f7e3455cac25e375711a6a1733861ee7bf1b800b86eaad2f40871c219924ddceb69b9748ae3cf9de59f0edffd7ed7b5e7f35d1239fe0333a78
-
Filesize
92KB
MD5c3af132ea025d289ab4841fc00bb74af
SHA10a9973d5234cc55b8b97bbb82c722b910c71cbaf
SHA25656b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52
SHA512707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2
-
Filesize
61KB
MD58d46b86e8a60ae61796c6a95b4acbe5f
SHA1f94fd98d504b4654b5dd8cbc244f755f07a4ec99
SHA2566c5de0800ef7a46174ce4f6eb4703a4b69369e8652d43f9337fba72eafdf86b4
SHA51225e4bacd553f2b1844f4a7fb63f17ebf739c4ab1a861f418c1066ec2244f0848695b31fa3a4d8da5aa7eee436045cc94da508b9494a2ffc086e9843b1e648613
-
Filesize
3B
MD521438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
Filesize
3KB
MD54a1f7b5393ed5806de73df26a55de62f
SHA1f4f49807e02eefce09ef7006aab40f18a8b9aa08
SHA256f8f512f6d4b1bfce7b18f0b8ed76e8825120637b70d3fcdce02ccaa59d2da4ee
SHA51237d103f34b9ebac7e31fca18b9f563a4eb86637eb8fb6d76b4271d04e218ca25d39c9ce80abb88383cd30e692f75e5d36d599cbaaed5853f2834e22c5ebbf2ca
-
Filesize
3KB
MD5876fa5ba6305635b5a30cb235ecaab0d
SHA16c6f7bf272d9ffa99e6ffcc3b55b95cb364e4e9f
SHA25607d966ca31f672dbe451b4745a1013c51f63a5ecf94f902aacd61fd8b3c96afa
SHA512bc22591f9fd48c703a616c4363e4086b0069c1a34fa01d539943841622c2c5a4893379b045d5d6796471dd350637fc7f9e47d21f1d01ce78d5457982f27c53c8
-
Filesize
336KB
MD53d225d8435666c14addf17c14806c355
SHA1262a951a98dd9429558ed35f423babe1a6cce094
SHA2562c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877
SHA512391df24c6427b4011e7d61b644953810e392525743914413c2e8cf5fce4a593a831cfab489fbb9517b6c0e7ef0483efb8aeaad0a18543f0da49fa3125ec971e1
-
Filesize
7.8MB
MD5c3b0a56e48bad8763e93653902fc7ccb
SHA1d7048dcf310a293eae23932d4e865c44f6817a45
SHA256821a16b65f68e745492419ea694f363926669ac16f6b470ed59fe5a3f1856fcb
SHA512ae35f88623418e4c9645b545ec9e8837e54d879641658996ca21546f384e3e1f90dae992768309ac0bd2aae90e1043663931d2ef64ac541977af889ee72e721a
-
Filesize
796KB
MD58a30bd00d45a659e6e393915e5aef701
SHA1b00c31de44328dd71a70f0c8e123b56934edc755
SHA2561e2994763a7674a0f1ec117dae562b05b614937ff61c83b316b135afab02d45a
SHA512daf92e61e75382e1da0e2aba9466a9e4d9703a129a147f0b3c71755f491c68f89ad67cfb4dd013580063d664b69c8673fb52c02d34b86d947e9f16072b7090fb
-
Filesize
2.5MB
MD573feeab1c303db39cbe35672ae049911
SHA1c14ce70e1b3530811a8c363d246eb43fc77b656c
SHA25688c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8
SHA51273f37dee83664ce31522f732bf819ed157865a2a551a656a7a65d487c359a16c82bd74acff2b7a728bb5f52d53f4cfbea5bef36118128b0d416fa835053f7153
-
Filesize
3.2MB
MD593f3ed21ad49fd54f249d0d536981a88
SHA1ffca7f3846e538be9c6da1e871724dd935755542
SHA2565678fd744faddb30a87568ae309066ef88102a274fff62f10e4963350da373bc
SHA5127923556c6d6feb4ff4253e853bae3675184eab9b8ce4d4e07f356c8624317801ee807ad5340690196a975824ea3ed500ce6a80c7670f19785139be594fa5e70f
-
Filesize
152KB
MD566551c972574f86087032467aa6febb4
SHA15ad1fe1587a0c31bb74af20d09a1c7d3193ec3c9
SHA2569028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b
SHA51235c1f500e69cdd12ec6a3c5daef737a3b57b48a44df6c120a0504d340e0f721d34121595ed396dc466a8f9952a51395912d9e141ad013000f5acb138b2d41089
-
Filesize
50KB
MD5e8f52918072e96bb5f4c573dbb76d74f
SHA1ba0a89ed469de5e36bd4576591ee94db2c7f8909
SHA256473a890da22defb3fbd643246b3fa0d6d34939ac469cd4f48054ee2a0bc33d82
SHA512d57dd0a9686696487d268ef2be2ec2d3b97baedf797a63676da5a8a4165cda89540ec2d3b9e595397cbf53e69dcce76f7249f5eeff041947146ca7bf4099819f
-
Filesize
45KB
MD5108fd5475c19f16c28068f67fc80f305
SHA14e1980ba338133a6fadd5fda4ffe6d4e8a039033
SHA25603f269cd40809d7ec94f5fa4fff1033a624e849179962693cdc2c37d7904233b
SHA51298c8743b5af89ec0072b70de8a0babfb5aff19bafa780d6ce99c83721b65a80ec310a4fe9db29a4bb50c2454c34de62c029a83b70d0a9df9b180159ea6cad83a
-
Filesize
1.0MB
MD512c2755d14b2e51a4bb5cbdfc22ecb11
SHA133f0f5962dbe0e518fe101fa985158d760f01df1
SHA2563b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf
SHA5124c9b16fb4d787145f6d65a34e1c4d5c6eb07bff4c313a35f5efa9dce5a840c1da77338c92346b1ad68eeb59ef37ef18a9d6078673c3543656961e656466699cf
-
Filesize
112KB
MD57bec181a21753498b6bd001c42a42722
SHA13249f233657dc66632c0539c47895bfcee5770cc
SHA25673da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
140B
MD5a8ed45f8bfdc5303b7b52ae2cce03a14
SHA1fb9bee69ef99797ac15ba4d8a57988754f2c0c6b
SHA256375ecd89ee18d7f318cf73b34a4e15b9eb16bc9d825c165e103db392f4b2a68b
SHA51237917594f22d2a27b3541a666933c115813e9b34088eaeb3d74f77da79864f7d140094dfac5863778acf12f87ccda7f7255b7975066230911966b52986da2d5c
-
Filesize
99B
MD54de674e08ea9abd1273dde18b1197621
SHA17592a51cf654f0438f8947b5a2362c7053689fd8
SHA25656010f4c8f146425eb326c79cbad23367301e6a3bc1e91fdcd671ce9f5fc4b63
SHA512976d5772c2b42616cf948f215a78fa47d8154798abf1148f7f750545ed3de9ec1ecdf2e7e16b99c1459e5519a81301b9c1e6864e992a807b78257f0abaecc4c8
-
Filesize
76KB
MD532ff40a65ab92beb59102b5eaa083907
SHA1af2824feb55fb10ec14ebd604809a0d424d49442
SHA25607e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42
SHA5122cfc5c6cb4677ff61ec3b6e4ef8b8b7f1775cbe53b245d321c25cfec363b5b4975a53e26ef438e07a4a5b08ad1dde1387970d57d1837e653d03aef19a17d2b43
-
Filesize
279B
MD54877f2ce2833f1356ae3b534fce1b5e3
SHA17365c9ef5997324b73b1ff0ea67375a328a9646a
SHA2568ae1ed38bc650db8b14291e1b7298ee7580b31e15f8a6a84f78f048a542742ff
SHA512dd43ede5c3f95543bcc8086ec8209a27aadf1b61543c8ee1bb3eab9bc35b92c464e4132b228b12b244fb9625a45f5d4689a45761c4c5263aa919564664860c5e
-
Filesize
391KB
MD566996a076065ebdcdac85ff9637ceae0
SHA14a25632b66a9d30239a1a77c7e7ba81bb3aee9ce
SHA25616ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
SHA512e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c
-
Filesize
997KB
MD53f8f18c9c732151dcdd8e1d8fe655896
SHA1222cc49201aa06313d4d35a62c5d494af49d1a56
SHA256709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
SHA512398a83f030824011f102dbcf9b25d3ff7527c489df149e9acdb492602941409cf551d16f6f03c01bc6f63a2e94645ed1f36610bdaffc7891299a8d9f89c511f7
-
Filesize
472KB
MD5ce9216b52ded7e6fc63a50584b55a9b3
SHA127bb8882b228725e2a3793b4b4da3e154d6bb2ea
SHA2568e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13
SHA512444946e5fc3ea33dd4a09b4cbf2d41f52d584eb5b620f5e144de9a79186e2c9d322d6076ed28b6f0f6d0df9ef4f7303e3901ff552ed086b70b6815abdfc23af7
-
Filesize
320KB
MD597ffaf46f04982c4bdb8464397ba2a23
SHA1f32e89d9651fd6e3af4844fd7616a7f263dc5510
SHA2565db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1
SHA5128c43872396f5dceb4ba153622665e21a9b52a087987eab523b1041031e294687012d7bf88a3da7998172010eae5f4cc577099980ecd6b75751e35cfc549de002
-
Filesize
65KB
MD5578bebe744818e3a66c506610b99d6c3
SHA1af2bc75a6037a4581979d89431bd3f7c0f0f1b1f
SHA256465839938f2baec7d66dbc3f2352f6032825618a18c9c0f9333d13af6af39f71
SHA512d24fcd2f3e618380cf25b2fd905f4e04c8152ee41aeee58d21abfc4af2c6a5d122f12b99ef325e1e82b2871e4e8f50715cc1fc2efcf6c4f32a3436c32727cd36
-
Filesize
320KB
MD548c35ed0a09855b29d43f11485f8423b
SHA146716282cc5e0f66cb96057e165fa4d8d60fbae2
SHA2567a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008
SHA512779938ec9b0f33f4cbd5f1617bea7925c1b6d794e311737605e12cd7efa5a14bbc48bee85208651cf442b84133be26c4cc8a425d0a3b5b6ad2dc27227f524a99
-
Filesize
288KB
MD57303efb737685169328287a7e9449ab7
SHA147bfe724a9f71d40b5e56811ec2c688c944f3ce7
SHA256596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be
SHA512e0d9cb9833725e0cdc7720e9d00859d93fc51a26470f01a0c08c10fa940ed23df360e093861cf85055b8a588bb2cac872d1be69844a6c754ac8ed5bfaf63eb03
-
Filesize
64KB
MD5b5ad5caaaee00cb8cf445427975ae66c
SHA1dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA51292f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
1008B
MD5d222b77a61527f2c177b0869e7babc24
SHA13f23acb984307a4aeba41ebbb70439c97ad1f268
SHA25680dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff
-
Filesize
649B
MD5879505cf34987d535d400695ba08d595
SHA19dab8eb5d7a3b50ce1e71108217df4324c8a83d3
SHA2562feb30446ac01fb6b40c422927098895a6608ae728102946a444d2c5e80f8b51
SHA512d05b4077c67ace2b8674e731a38b8ecc539f7920fa194fe9faf9f1ca485c0a3e2782f0b971894ab771549ee82013ad94b11c27f127f099ec6be83cfa2c6534a1
-
Filesize
62KB
MD5e5fc91cbce096df1d36191f9eedd3c64
SHA11a8076bf524b6d2b8a44c18fa8afb199a60dc1c9
SHA2560e111dba5797ec182bf4af537a2c928ebd3957b99ed291610fbf322d6c2c9e19
SHA512c9b064fbcb2df48dcf5bfa4387c164acb2bae075af013e6c39166dddc7e91ce993caaa0fdfac3ba1c3a12ca6c21577d99776fb1445f3009c7359b926a173f668
-
Filesize
38KB
MD5d4586933fabd5754ef925c6e940472f4
SHA1a77f36a596ef86e1ad10444b2679e1531995b553
SHA2566e1c3edffec71a01e11e30aa359952213ac2f297c5014f36027f308a18df75d2
SHA5126ce33a8da7730035fb6b67ed59f32029c3a94b0a5d7dc5aa58c9583820bb01ef59dd55c1c142f392e02da86c8699b2294aff2d7c0e4c3a59fce5f792c749c5ce
-
Filesize
24KB
MD587c2b09a983584b04a63f3ff44064d64
SHA18796d5ef1ad1196309ef582cecef3ab95db27043
SHA256d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0
SHA512df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067
-
Filesize
72KB
MD57c244372e149948244157e6586cc7f95
SHA1a1b4448883c7242a9775cdf831f87343ec739be6
SHA25606e6095a73968f93926a0a5f1e7af9d30ecca09c94c8933821ca0e45732161ed
SHA5124ce4d73b785acde55a99f69ea808a56dec69df3bb44ac0d049c243fc85544db4c020412634da52a069b172e2484a6f2c36799e38adbfb988bcb5703fd45b3601
-
Filesize
409KB
MD5832ad40beba0d187ccda3633189c65e8
SHA1e7dae2828eccde88d76a18af16c069a9e60779b1
SHA25616324156d318738cd39d0c99fa3729559caf3b530111d9251cf4ddcf2f110194
SHA512ca1f39b5c272be8be8420e37e4332b6ef59574f95983d5e1a1c102256a3478e2796dcfada5720da6ac0d0106d7faeadca6f3fbc2a98036bd10ac09031d997705
-
Filesize
725KB
MD58083ce83edae35e3337f7f26b52c08dc
SHA1187958eb3fbd9b44ffd1d2223ab9f63dbf4be728
SHA256d014283ecbb1e069f80a07b4c356824bf0408ac2599a850e69557c82fed649f4
SHA51226c7319e00084e9bafb0370bbb2b6fb5b716352dd35ef97a842893e816361a88d4adb3a618a71d9921e39c30d077a3723240d390223d4db840015b512b099c84
-
Filesize
936B
MD59e5419f1ae85b206263571717dda2986
SHA17ec29db2f377fca4c1ab3ab45ef30c02ec696422
SHA25676827f3902be00c796d5011fe0b595953118d6aea4b5ecab2dea0ce21c8ea81d
SHA512ab30b847c8b763546737887f39785df048e83e55a81814ccd860a3d5b3278d6fadbdb731bc5253eb979cd0a1ea80ae1bb08c94abfce044f26976eb5a044e6f21
-
Filesize
1KB
MD5be470a9a9099efa70ddf006d38292565
SHA1864cada15f61c89deee4571aa062ca821692cc82
SHA256623064fea63b895ed68bdf55cfebc0b515801010279445abd0e5e4f26be7d780
SHA512180ae77de4723fcf91bc49fcf8febdf17c520f6a98f975539e278789a14ea8d0fa55c9c2e1c4012b8e6355febdd54bf0039b261dc9bee85e9f0e2645161b30a2
-
Filesize
3KB
MD5f330efa22aa3f4b4e970e02406641681
SHA13018d69477e22d2d3b7c3b92933d56845a8ec456
SHA2562e59f77bd173f1bd09e6d239d6003b8be690bba0fbc395e563b8d8e2ee4ff8b4
SHA51238d10ac9329255d2eddf3f316ec6100aca17ac5d2f6ea244310473f9b474e3696f3daee3fe30cc7791274894f4fe37b945a8f45f1ca3849e817d1ecfd4efd894
-
Filesize
4KB
MD5991eba7732142c901b3ea4b5a1360d52
SHA17fb219796134ee4f89b92f7a52f658dad78574a2
SHA25625d0f6761b706e49bd2e7865c37dc6a3978fd867a24027a64b2de780377c08a4
SHA512de1eaefa91a7fb4cf7f30e3ea7a2223356046b05ac0ee45b48cebd4886e6ef205094bb8b7edbfeaebacf985b3b1e5ba9288d36f5fd13b0188710d0b333031337
-
Filesize
4KB
MD592b10a3a24d96ea62a480a67b84ad961
SHA14cb594e4bb887d16e5cd548c641b288e54c1a0ab
SHA256f8114d1892e0c90b3f990cbcea25178e7a239da57ec252d229ef27b37267b40a
SHA5125370288dab143f3c65a2740a4fdb858b89e420bfd27e89d8bc42312a1bbb5c599d8c8d0992af77b36d85542f008b8b204304c64cd4b3cd94bb5914a6769f274c
-
Filesize
15KB
MD54884a1e84ecacbb3dee277fbcefc8b85
SHA16d80164e3820da5f1c37d70b60580c5343672869
SHA2561c372bb74c60669e9db28171c94d4f4bf2bd3dcd82787e6d2cc0e4d066c0f5c4
SHA5128eceb2e4d8536f1334876b04d62842a49f1ca1e572569bb72f5a2f5285d1326930c8e06988fcb4fc2dba842125258486d0080d280ff6ef38dd977eb2312d36db
-
Filesize
17KB
MD5125afc611e632d38785863ce3cb20887
SHA147c9362d7779b9a9ed67b4b9a1b8a8c6ebab291b
SHA2569f574b6f35382fb09079591e008ff91c1e2e7a5569e8f57cb6c32714702eab02
SHA512c4f874d87155358d29306b036f13c48e94e0e5c9cf08d75dec15d755f143c552910285a3053bdc584eb9f8912e86f47743e4e7c61077652ad90dbb292ecdd680
-
Filesize
18KB
MD5c097603e1b1b6fb944665284c27f231d
SHA1f4051c8414e3830155df7c831fd8f15064cf17fa
SHA25698746677a5fd2601f6aded600a029df185d5820768dccfd02a466c2e9939caac
SHA512821fae124837a357f70ffe8b3da4a4b58b321e1f8a32ff5d4142f60d3005b6fd318ea5036dff23915310b46f6d8beda7a7c3bd2f2c31c17b859d4dd4d58016e3
-
Filesize
8KB
MD5444d0bf4cee15868922d19c19f32c278
SHA1e43807e820f24c4f35bb31387cf3598ceb5934f8
SHA2561af594d0cee28001daf9e90f9a7789a5a0e21194fcbc92b5e428d4390c545dbf
SHA512098f0b92434184807e9394b4b5507e1d5b4f4e3993cc59155bb4174899f66c0adc7789cb1ebb6e9f03a694c2926c219638e4f48fa535ae79a10a65ceea42b1d0
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
3KB
MD519e1c05baace74dbcc37e65cc5d1712d
SHA152efdf8de5824fba526714fdd9d4eb83628654a7
SHA25678ec558e1b1060f4ad151b006ca5baec4c48b9e32af8aea04335306a9ef9be68
SHA512d771966e476890cda3473a84d910ec677b18b691609287a6625122dafcb87cee55b44216ec2e493c3f5e5be0368455e402cbc75a8ac21c88f7a6f5f05fce82e4
-
Filesize
3KB
MD5153866273fd7379caa8c415fcdb161c5
SHA1483f2f5e874ca4fd59bce62cf11ff731d2368f82
SHA2566c2dff4d07ed6f38507df5ab5d26e78850ba4c6eb67ea938ea66d11e5a9f0f11
SHA512e9b5cd134de85cf1f1e233a9044cd34d1404a3a9590a5d56627520d30bc4e989f8931b921bec59d9773c1813298fe0468eb8b94945288b34fa5ef4e02b066b1f
-
Filesize
524B
MD5e1541d8855f994ad071fb8f49ab59a9b
SHA10b7026ac24e2fe62a5927cba6d596f81efe674e3
SHA2562530e397befd8aa5d5d6da25afe3cb0403a43515ad449a735920b5e9c7b741fd
SHA512e805d3238b70964dd0575ff2536ae29c34d6ab5b17f32d8ff31b51e7e8f3443b1469b279a519432fe2455e7bf4b053c31d6a5d555394b26bd9a2285a04fa93be
-
Filesize
524B
MD5ba5ecfef6727bce2d76ba91ca1f4c780
SHA157a640cb0f27154f8c53d733f92416f30a79c509
SHA256ff9637c2b686011b5fa012d5518fa4c24b1504d4c2c5573c61fcbdd470342493
SHA5129fbfae5c32ef25b38a81bea3416ba1824fa9448bc12e269822b63692b1f68f4186f828df284d07ac5e0cfbe3bc6d864191f42e0c8b21b4c135118a2472937fb3
-
Filesize
1KB
MD5741155a9aa04ae4966d026b429f7ac29
SHA1224bee658ff4e5a741dbc51d548ff66a8b161f33
SHA256bc54a920b1edbe391e61ebddccb7ddcc0c3c98cce27d0662bd483701da4f2a01
SHA5129b8400852b1401f3ab79be82b19c2df1ea41141efb6672cd9ec0cec16b42c48dd07e0b70c1c5bddfc8b3237f220087f18979470132a9a7663659a827889936cc
-
Filesize
1KB
MD56adf89ecbfab417e3a498c16a50e9c92
SHA1ebf9529a7baca463462bc867b2a7f94a42e80f3a
SHA2565303c7e3db49df7af5757ed8f8cef7823fa7a862473fe8dbcc726449155f5b18
SHA512d175f051d8a8e578c7d931e3682a4da0db45e69b8653b7283cb49431f0d9c1b4a325bc88da63e73ee3600a4b02518b995a6d416d32eb432522ac28d3c4fa7238
-
Filesize
3KB
MD560b9c145a089b41980062bf6d456cc05
SHA1be597d4d942c881bd6173d974fa55b7fbb851ac2
SHA256fbe0f8061f70424dce98d7395eae236fdd09065d8f0ef52ae596e2d18e465de3
SHA51202a95b8b74dcda7869538fec25d5a3508bfb7c60b8d2e30ccad3a10c2ae52366cce7f6f6afafb6786a958b32a7815d9d357d434a8a83d6239199bb57643c4f33
-
Filesize
4KB
MD5b3165b9111db78daaa0511035abc382a
SHA13a348a6ea5c6b117f0bed725d52a17f478169859
SHA256d7550d52c5cebcae0996da15ec4de43317765e43a433b1325a8eb419794a3dd3
SHA512ba58f8778ad2f953154af4b93e748e019913fa2fd29735cf3320228bda86a150a8aa7bae9f97ec47da736c06918545663b7e5f03fe2dbf50a6fb01ccedda23e8
-
Filesize
4KB
MD52cf7bdd417d22104121e01d9110fcdd0
SHA1f70339e954ced0f380181d327f3d4e5daff3423d
SHA2560628ca82609e8cae6dd8adbbcd29109688cad949fbafc752c21d9565c83f63ba
SHA51227fe061d18561e3a95dcf2300968bc3fcc6582127fab52a973f2ef674da3068ba01e08fa990a90d7d8df3b9969a5e305e436bc09236a6dfa5e941f2e1af5373e
-
Filesize
2KB
MD53146c516126d53718cd19cebf42edd93
SHA1c3ad396ad6a9862aab5985fe84af4c7b5e367b6a
SHA2569f6351722b405e3f91e37b0ecb7ccd2e65aff2ac675a8508d8df384cd8a45e11
SHA512ad7211900c695f4d9d15d2bafa8118fcb7e5d0074eac685afd1baf2e5ae67cacc3950ec53914fcb215d232a6d72cef8d12446d243ddda827e84647a35f3af1ef
-
Filesize
4KB
MD5c41a058049762d62ffcf18f821060810
SHA1254cfc70bc6132d3d0e703122148dafdffd15a60
SHA256d74f5d50505f52299b1bfed0133e8f57493969b3ab69a62a480c082b38b86745
SHA512578a705e6e77c6e6b4b569fc5f5ecc151839b504ee7656d3f6291ff34d1b90c86e55cb8274d332e85c3a38f400bd3f016b0eb93113049de8cd0862b99db4156b
-
Filesize
4KB
MD5ade04bdcae1eb7022ba9847a35829f14
SHA106156c6cbe806eb1ef55ceec8c0479d5f0f3f15d
SHA256693bad0a17ce6185b507052b174c998c225df041cf3a82e9cb9fa8aad95a5509
SHA512b1b40cd83de396b48aac4ae1a8b6e3abceea49b7e5d605c26f203c3cf4a73331d50f2e38f9c0c2c9088c3d876301787855937fa0ea913184fa5b0429525d5cc4
-
Filesize
4KB
MD53bfb16996dfaf51eb1ccf1e108acd25b
SHA19ebfa33795b50034f5db3517e777105921ea82d7
SHA256f273952e8e39316b6a11a3b77fc2c71daf0e227ce4a7122301096a57d49f99eb
SHA512fa3f1b8f7b4f3efbdc73ac87af54ea9098330dcb613ee48283893b0851941f2669a658e165ab6060243dcb0e0593facdf0a8cd4caa8160ef28138efe5a651711
-
Filesize
3KB
MD514f91400e13ea298efea2974a698450a
SHA126a6e8740fb93bf10cb653711f22283df6afa79e
SHA2569b21114d1085685fe9b8d1a99a7681beca86f14bee7cd5368f570c578949462b
SHA51244ccffa4d4c5be21afa63596ac83dd57cdb9cb7d2cffe33b1a0c7375757fb9d4ff50e059ec810f84570c2008709f0c8a10769fee8f7ae695bce41c96f4c98bcb
-
Filesize
4KB
MD52b8ee32caf2b6fc4c7aeee5d2f73917f
SHA1b2419be5a3835f3df980604a61e76dc0b12dde49
SHA25607810bb0dcad279d0efc284fc2fe50b014035915d1a96d35cc5c6fd1f4422075
SHA512d438be3e044d8d7b466c0b449ab48570edf98fba01a98a6a67942a781f9be757c4a09847ba9c72ad8452100195560c8b76e15c06e3748cb4be5937df0dc97c52
-
Filesize
4KB
MD52420b7ba9e1e87ca056b2579985c65c1
SHA168594793a5a8e4f6a9b1fd47b8246be8a2057c1d
SHA25640ea34595eae5b365447ad2c3acdfb87471abafbbe6ec81f5cbf27fbeb3801b6
SHA512b17aa3265a90ddf15ae5227f3f301aafaa7208929a4f552bf3838c5e2a96b60ef20b239bcc4f81f2916c1c771735d39900d22f6af50a6de4ff976d000d2ea436
-
Filesize
4KB
MD515fe23f58fbace6fb9c26d497b619245
SHA1a6db4757f568836fa495675f3ed3027c859bd0bd
SHA256c53a3d26d2e6f4df13c98a7ebde671249c18542085f9160ae420a88e5d4c4915
SHA512444af031a84c48e74cb3aafc24c39ab584362e827c9df1a68878f1be38aea80c468ce5f621cf55908b779423097650aa126e8fdcff3fa4798036a61f50bf1576
-
Filesize
4KB
MD52b6b4ad4cab69dc79f5aa4bb537392f0
SHA18b2acf85db1e7199deaf41cee981648254239437
SHA2563aa0335873ac0209aada062aeeb9ea088ecb67e7878ebe763861f0e1bc37e674
SHA512aa11ee924e544c2fb35232298d96b9e30563ba60aa741060bb6a29f24245f9842201b806aec79f39491ab62ab8cea93803c1968a4779a9de6d40829609ae6584
-
Filesize
4KB
MD50c193299913117db5529ceb38a261d48
SHA1f38b9fa38dfa4eb996afb30a66ef10cc87d2c32a
SHA25628f7d984031c1b3fcdfa97f1b27aa7a776ca9fb8164ef8e019ad2adc65721b38
SHA512ae046ebf64e1e44b4d04b172ee6021a33075b3278f943760201d458d3c85a80e09c219150967d1e3683d103619d966cfdb63c2929e73110b545316272fbdf343
-
Filesize
4KB
MD5fefefd1dc605ff04d63ab035d7a73bcb
SHA19a72c6ff5906436f62758b99c9cd1e4c7fa8a9b9
SHA256d3dfe8edc6e1facbb80658ec6200bd444b74816538605759def5d9f1771ab846
SHA51250a67a879d2f5493a40fe9b83625ca7f1a21dea05ef45a1ecf13ea222b81067d8de7c74f43ecbc138386e3ad6b7f61b682b77ff015b84d98d56bc652724b7b2b
-
Filesize
4KB
MD5e571754de57292054aa82f01757d7faa
SHA16dcb1037d2c0cfe08bf1c9e0220e8f90e521b7c4
SHA256e22db72fec27a29cb67be82aa53d404719c11c7d1dfef727c15b835721c9ad70
SHA51238e39996b7bfac0f3d13e1ac0b2cc7d981c0acecd4db0ce1a2c728aa4e865e56c6ceb2ce3886bb276147aea4fd0b7ac22f9430f10082785aa52463bc149ab3e7
-
Filesize
4KB
MD5b15ce8c7acf1993f75f8f0a36acc61db
SHA116779f2a2fbef80e92bc00280b092c41612aae70
SHA256ec15847a77609567cf11c0c363b98fa8422289e84c3fa2d41c0840aa3dc7c6db
SHA51280edd9c011ef337c6b7ba6f1416f135dd3a8fa58c15e1cfe84e4da71e912d2153b60e061b372e7f26a53d8e9ebdcd0f5481a555f3b9d08e1e56ea3489c188123
-
Filesize
4KB
MD5ae978dd75c07fa723c182f4916c920e4
SHA1415f722b4644d897cd34b80815f7a5d5137c33e9
SHA2569995b4595fbdedb64b2f6d8fa16c8bcd77537a148967ec648d9adfda78396fbe
SHA512cbbd823f7e01d3979ca5145afe13dbd3acf2cdcbb148872304f46ea0e41492496c0fcafeaf50ace0b674df669bb9b4e2d09c0d5aa4c20f6401b4c4f64dde1d0e
-
Filesize
356B
MD54a10f2587e7091ae651aaf16aa58b01a
SHA19e3a0b54215e84653b95d157b2ed5f817cc466e6
SHA256b0b6d561ca5a1bc229ad6bbf970832ec2dc4ff9afffe964d5ec35c0ddaa16def
SHA5124762f5d09e2a7092d87df4798fc184de340bf8e00d91d2740568549a677d09f62f1fb59a8ff3b2c5501af07e2889eb19b0c571f17c35b107715bdb0e6b368fe1
-
Filesize
10KB
MD508047049bfd27b6dfc1abc837b9d076f
SHA1ce1efab8ca72f4430fd5d76305f4cb06f7b091fc
SHA256044d3fcb3c4998bde1f192d137ed210291598e5cfba21bafb8b1d29cda7d73fa
SHA512772941e605db0cca70cc2748e47e5eb79130a9f819ce1539eb631493bebcdb435ff9bac9af43b9f94951ebf1d3936db6e3a4f6f348a243521af3b901fa6a54e9
-
Filesize
10KB
MD50522383f825b317aeecd64c56544a9e8
SHA1b66a76ca76f32fceaeeba8026e9ba65392a66824
SHA2562a9b33c2cd562eb4bd080f492b358549a10823512b8afb402c2fa71e2b48c78a
SHA51259ea632cec90d63f2327a3a4437c5939ec0f0facdf95b624aad0d803addbd2da3c8d481e3c1221e6d53b109088e9d29e087cafd010def797a4b79d24521fa356
-
Filesize
10KB
MD53dc0da337483db3a9cbc8709902c0fd8
SHA11d9df4ee61eaa26824887f3b417eeced63e3323f
SHA256b90746d4aea39d7168c7221da95da77955420a874df58d0159dc97b447e3388f
SHA512f419709d59105f935a6147e0fd1fe50dbc6877b84b9677bfc6fce968291a7f2d555d85e5367666df000269ee1a6397a9b5e0672cba041f99d0badcc30ff47546
-
Filesize
10KB
MD50d033ad9b83d31a9d569d31881339764
SHA1046a36170df00878358c8b178012d32abb77537e
SHA256c9a51296a1269f51fbf579ef150cb577648f31a3ec3738f99ba583e39be15a98
SHA51240ef8b13ddfeec65582a0b5c3e0a65199a1a44e82b2d50826fdfb7641faa75081c5cca0b438f820104969b06d45482b53d929d7a4875ea950c12187f71a8bb84
-
Filesize
10KB
MD5a8c8a21fa8ef5de6b76c1311c178bdbf
SHA18c36eaccc97f4930186a64a25ac8dba63e678acf
SHA256625e470a1b9bf1b36d57c24422f0ff3ae550e4fcb743f2adacf273cd93d8802d
SHA512fc2f2324eb7a9c2c82140d685eb7111155183d164d2e365e2fa52837c8cc8362a90ece5d2f1cac1f9fe5e2c23af1102305faadd71c27d2396fc3e5e3d1f7bd30
-
Filesize
10KB
MD5b4092f2dc23cd9906487424a90386295
SHA1661c6caf2c5eca3fbcb4156c56bc4380323ac91c
SHA256cea165560987b51c8d9ec51ec234cb750495e339d0ae1335b7f11497ff383701
SHA5125995e9268ccd569c6ba0bd39ade26d8728a102ff83a6f6bfc1047d66ed8797d17d00a3f8efe63a67647933b4902a20ec239ca613f3a226feddedbdfb9b98e45d
-
Filesize
10KB
MD596232f33005e4c585b7751a813f475c6
SHA17a934efcc9051d881018aa9e1410908e2f2fbd19
SHA256cd9ab4f1d07c00ccf350da797acbd95a9eac0b2f0f9947bd5f72508424feaa31
SHA51208dd8cbe6fdca387614a0c428ab0e726d9b8ccd904f8d46618328cbedac1df6294c8666dd6eaf66753b34a53201a4a4b5e66d287b811efb15bf57c64e46ced32
-
Filesize
11KB
MD58d5ced3e3be7afd2fce8fe98052a7131
SHA1f745645dfef242ffcba02085be9475b717fc61c8
SHA256eaf47bcc4ce5c6da4fc3c2116a6bee62b972cc5126ffdca498d39486c27880af
SHA512f6def1d03a7911e12f461266439665cce0948b4c021250e5052b27bbc510e1f6fc0f09317f3693e57ed1f88c252b466e8b3d612b753dc13ed71dbf859490fc0f
-
Filesize
10KB
MD5fe7bf7eff3a85e5bc94a91b354b0c3a9
SHA104dfd50a33cd49c68d08aee9e2d1a39ecdfa80c8
SHA256c673bd32c20600652c75d5f4a83695453c0c10f0a8305e7dbecf5f570a52f7f6
SHA5122a83911bca182465d4aedd6063df366e04dde9fbb4bceb47db65dcce8d0fec2714fd56047d478dbd3830c103fe2b0b5b9dd45562c2fdc59b5f1de658101dee9f
-
Filesize
10KB
MD5503d980e3f6886e3167d8c3d274e6bd2
SHA1b7533b93ad0d34be30b3c77ae813b4034ba65e09
SHA256b6fe771d769e93ccd9c6d6fc01bdd023ef60c9da7976265965d2f819fc8e36ff
SHA512686d14599ad56d32e43efdd39186d2313e536162a8907027aeaaad21eaa6741026f1bcf854e0db936e585557feb5835ae6f34c72b9f2dad37f2f56724be543ad
-
Filesize
9KB
MD562ad323c976a633d7668241555ae4992
SHA1f8e8e728dd0a10151a5f69252dbdf543726bc6e8
SHA256573d178aeae9ff61071586505fadf41f58f6b0b01b899339050e8149e3f63e7f
SHA512cfd0bd6a597a79ffcdbf0ef6d190bc6ad727b819aa77cc6d77de8e4264025ed9b171b60c241327fa8202c5334819004de673d26d32c8854111bae09f418f3123
-
Filesize
10KB
MD5fc7ec2556a70074d95327172a3e7d6e8
SHA1ed6ed68262c5be2aa023b99f597cff4472123f00
SHA25681714a539aa53a6b528c29d207936e0dbbb688541a89174bdff626a6cfdc12aa
SHA5127694601cddca084827e4a77b91ee774b8167a80185ec92dce64403dda36d72c6b6a04ae9017bf1d701f93f5466397e7d386e0503e4c12f3c8f234bd892f22b2d
-
Filesize
10KB
MD5dfcc2fbbea92557d6e8782707b957c99
SHA1c5640c0fc9d87b73aa98df863e21984c9d7747c3
SHA2564c4669762374f008dd6b731ee99e0894fe7f194c3c32eccbecfa4211c256aa92
SHA512477cc53040fae4301922e430955142b21caf43d4daaf0fb6f8dc6ccf579ee9f5dfa4323d9809f622dcae7cac2344b2e6466eaebbc5e15166666774ec0aa219ca
-
Filesize
9KB
MD5ab79394b6c07e9178d027ecfb6d5bf93
SHA16eb705344708fedda29b3cb129d1a39daaee6b31
SHA25602049ded982591f79648c5f017b440841a73857ee5608bb7bac6eb5a82b1cec4
SHA5121d909756a455061265dd8d8904f356d8386785e3286aa943594962b791398e2a1cd8f8d9ec3e27c596534d64896f09e9768052056a6e4b17ecf3446f3a995d84
-
Filesize
10KB
MD53c331c83a0f80b545cd8cc03f1de0b91
SHA12a81938d1410b147091557695b89b9a986603a85
SHA2560cfbfadd1e8961f98eb20f2087f2d4ec0e33368b0deebb3ce5b4ed313bcf7003
SHA5125e9c773c85c1411420f2ddb973765c489f0f2f3434d7115a048d8438073e81aca612f2d3c61d2bcbde427d8723f0a48a3b9228405ce270558f6efa8bcc7a9b3f
-
Filesize
10KB
MD5b0e04315ff90ee4dcacd1bbf8e018e08
SHA1b3c7b52e5de270d77cb9cf1a3d924d6452b3715b
SHA256d09d3e0c3bb32d78f7c8ef7e2de73b2c6088f58661a196161f8348d1be24ed0d
SHA512054bf42c09a899231e6564e1cf93c8a78cfb4ac2c5f8ac078394c74ab4ee56b7e0b6ec201c007744c462778356f427ddb7c655798904385d532c1abdcb838a0c
-
Filesize
10KB
MD5ee76cda386f64b3253b7fb10982a3202
SHA16f2779100baf4a69235d6c8e1cb6f8d9da20c73b
SHA256d0256d928eab31200a1f401999f4fbcdee1396c26fa4062253e1ee8121a7ff12
SHA512563bbed11c94747c94e36eb3f5f4dc09ffa7a088252ded7f77b467ab1c79c4f8d2649664b005229c53500fae6b767ad2ebc1abb2979e3d8d396e7bbc8fe48d2c
-
Filesize
10KB
MD598b2dd76371866e9e3bb977469db9887
SHA1e968e78eba01c1398caa6cd5cdabf4ba9565f3bc
SHA256e52722e40fc8825213e754feb33c565fb44347f4bb9bcffc5d6e60e17c9dbbb7
SHA5123ac109162c25854debe6d6d10cf81927c7e07265e15074c909197f8d3378900e2594abef5ca18f145c17b36d3ada1937c7829f300f577a1cf5632e72608a42a4
-
Filesize
11KB
MD52ba64f60cca776f84ec4b75727973852
SHA1841fd60af120c0c025ac767d6d7a8b34b46207ce
SHA256070b485af4000ef1221c5b12e03527757a763f1ed3af4f7432441d6cf368a97d
SHA512de29e1a3af1770d629513eff6471e998c62ca36b00b208ca5009ab7843de805daec8bc3ebc4af48417feb3f0860f5f99e488d4309b5bc93c6d78dff7626110bd
-
Filesize
11KB
MD50e05f226e235632be253903e624d8ad3
SHA168625ba772a5515f9bca5b9313e470b3f0333b27
SHA256bd9c1897acf59e60b86b09c3432c7662277549cfddab10cf0ccedb164970b3f9
SHA512f5404fbcf11cc3efdf3ae91c711d4d86f42b008b7f0059a4915520770449a98c9247e18163938f538bb9cb74f985a3a934f21880928bd0f6e8d132f2275682f5
-
Filesize
10KB
MD53eeaba135b81cbd937f17d7dee4c5c65
SHA140ad34786c52ae584a460c7c95377c9f1f2fa792
SHA256eeaab6005e9dcdcb3642d1c0d3a11fb3343cf56f15b19f8a47b2b2f2f38f053c
SHA512521beb800e228bbb9e38d691a5d075f4ff4389df046747babb2337cabf25d874c0bdbde1cc2bc103e90cd4005698fdd7712b5c3916a3393911a02e0604215187
-
Filesize
11KB
MD51e1441ffc533243102d4e1d1fc471728
SHA17c4c968653276e6a919690396157a761c8ec300e
SHA256166b93b3afb06e82cbabf38425c73aba4b65aefef39fc188ad8a52be18f9b74a
SHA512943c57354fa3f9081c4c8bd5f8c503ed21235135867d8ad4317613f162667ac8b03c9c29c97306a926f1d13fa9547427daff55759e1d93345d8c6ac24eec9d75
-
Filesize
11KB
MD5dfa8db0cebad266319aa7d43ca65d77d
SHA124cbe1bb87b339057aa1bf22e9f4ba8785b5eb22
SHA25634c102696c4b78a04ee3bb3c13669390860d8e5dfb78941126651f88e3bf58d4
SHA5125201c99879395dbc730352c5266dcfab430b063ca85ffe335c1917969905ed9e8719798f75514c8861e8fd8d079778c09c98d5589ac533de85a3826bf2953af8
-
Filesize
10KB
MD543c9f0ccd5e3ec9c5c69345a8c31b7d0
SHA14f8ff117509a604d018c38068cd065ef95e39717
SHA2567ac764582117d246a66ddf96224dfc378b715934f0502f254ba84ef3980f890c
SHA51203a92dfba9181d9b808bfdf053c78b06fa96174b1a6699e1e72cdf88c6bd51952aa5313b9d20159a1395da32ec68b5be60df46ab350de6fbbe8896d1fdb9f7b5
-
Filesize
10KB
MD504a8e73425f5ca9d3251866fc271d104
SHA1fd0683f9f32a44a84949a822fb9960d7f52894d8
SHA256c1e221fa1d7ca574129beb3dc770169381733c22dc062cfd5aaeefb5eaebb0ea
SHA5122cdd39b0d91230f750838e73a30ea63d546c821db9b57990bfe58e2daf341c1c71e692ea556e0ed6ec3c052629d80d025b75596321916f1ad3ee5d60af8fe882
-
Filesize
11KB
MD510da028b4e6f3e551d7c59d0a4eae6b4
SHA162738c75d3e75c1b309f05676635762b4a4d8a49
SHA256c874eca7b083adc6b5571da5002fb288539feb009d4f77e428b088d0509b361a
SHA5120004822a5b9ceeb3b2569ea56c4d7db2fdeaf46e34a0267c926201a94b2d2a680c06970b023d9b7fb6eff251279aeb9744383eefd8c514d2bf66e2c97adaf761
-
Filesize
11KB
MD5455e6bfe7279848ef4034a288afc610c
SHA1649d3f3ce35b86f4c1cebaf62bfa5d60eb6ce24b
SHA25686fad103fb4637a7aa07fee332061213a6c51ec7997f9b52682f776e7494ff84
SHA51253c07e35a7034ec24841a43c76b7756a01e9da02f8d7914d3508bf54a9be8599f463a42cb2247b26b6baf374318f6c9e1c62e7f917c482fffc95544638b628a3
-
Filesize
11KB
MD558af4ce98bafc6c29d3e826d8228e4f5
SHA1bedc6370d58c2063bdb8bb67a4e9c4d9ec846326
SHA256704697b6f4776b1517564b73b3c22f2baa25b7ae3e37d71f77b486796e618d7b
SHA51226f3628764a26527fc349a3559b122812ea6a4ee2f1b966b796d2166616801878049e600b11a371990a79909f8b45bd8b1559547102cb6129edc661742349a01
-
Filesize
10KB
MD5443b6ae95c4623adea6d736ebca9d30a
SHA1eb034b273822e92098f80a600ba80d155c2ab2cb
SHA2564c46cca207a32d8d536f7690ca93b17ff56a591b95bebad81c99d1e5c4765344
SHA5128feb8c4477ee7da2455f2faf8d962fad5cbf2a318977e125f26b20f3ffc89377122d8dc80c49d492a165783cc58cb3fa66bc187726e2cca4c710ad4bda712238
-
Filesize
11KB
MD511a7d6cdd9aebbfa87aadd388b80dcf5
SHA162ecf2559b76364f322a3b3a1d782cb9286bb064
SHA256e92d58ed42bfb0bf6577dde869671465d27409d574fff81359d481f468d48924
SHA51278781b6d0abc832c86ba7a9a42d7166e1d28967aa31805ac0f4483d1f7a2cd75b19527dceb6abd97099c06cb817c2ec33fb9504847d00a14958229a1b7b98737
-
Filesize
11KB
MD590e47b33cbd3dfc636834f546b0d54c5
SHA1da258ae912eb81c4f9efd99f84bf5e377606db91
SHA256d85d742c6242673b1683d7212b3875a7a224e427e00408ff4dc63fb197628c2b
SHA512f659faa63b24dea93a7df0cf2229a09ba3dbaf827f3ba5d3b2da4871449d4c7561c957d6050c346deedb9df8085b94a64300974c4386047065b95740c99c2515
-
Filesize
11KB
MD5fcd7aebee61a3e11b5fdf2278b63131e
SHA18a3d5f3594da3a1d17cba72a510754c436bfff6a
SHA25620ff70574f2808b9d909522e06fc4a86d55629b0451ec9196ced97551144f86f
SHA5127a08bda72c932f166296580f1076bccf86a69c98192913ed7ae632f8c31f140f8e8de9fa1471eb5a68376122e3ebce324fd270d293be936e1142bf70e855afb7
-
Filesize
11KB
MD5ebe2adad19cf016db5fe5211e6e36225
SHA1d335b0da78f8d9bc2f973edb0dd7e2fc0a3b8fd8
SHA256169681e01731972b9ea91866d6750b7b12a2dc6c79cb200737e69c1db09cce42
SHA512a382ea711cb5b01cabd7b8e541ad8526510d5c85e4f2677cd3fb4be9676e9b6399f5919ddae3ef5c3465ac4b4fb60b2b5155fde5ab6d7b3553ecd534aa3261c5
-
Filesize
10KB
MD5ce739e1ec2c6dc61ff1e8c05dd358049
SHA163a0a72f1d7f47f00f9671a74fe2ffd621dc07ed
SHA25625b650ad977b9c0798534da75b0cd5315fb453b4261953cbbdbec902ec087967
SHA512ddd23fe980611ec1f1d6b86ba042bc9e1da69e3df4df17fce9c8de6bead9c081d358ca6434ec7097c28384e4b06861c675009aac917863fe3db6b768f35b7e26
-
Filesize
11KB
MD520cd328154fe1afcef45ef8f6e623c9f
SHA1146c30daa3d837a436a755da535616514ac43e9d
SHA256461b937396ff87c6aaf1e2f016e53863d408cb749412be47991c2861f43aff76
SHA512db83ee28deac78a0f0268060d448f0d11fe1edce06ff757634a8391420e699c1cbbc0e4ab3edc31762f544e1cd0333127798d83c159731d89f156ccc09229915
-
Filesize
11KB
MD5e1886d7eac7cbe735ca7c21765d39403
SHA13dada502425595493d200a41e4c461758d10b6df
SHA25676a64f5921f6c947ee3a14632455fdcac939b2f16964c3643d05eaabbe519829
SHA5129ce0517be57098f37c7174a1bcee7bcb0522d56ad0ef599d9d3f98bbe404413d7ed474b0e32b009828d61f624de93f7e938bf8a3abeda2ba82af666abaf22a35
-
Filesize
11KB
MD560bb9d3d25b690414025e787d2d432a7
SHA155687cf03e8d23ef7625b0231b2817275577c2a3
SHA256eba2c569e5906ef931f1a05e6fc1485eb4dfd3f25e54b3e0df4570c62628adc7
SHA512ecc897743ff7892ff5f91ccaeb304687fdcd546538fd2a923c6c4565cd20e395decaa83919c9fc80c225f03269f8d1c511c16d4f2d1d54d63fc0692cd93a29d4
-
Filesize
11KB
MD566b9cbf7e2ee3ef857c223579c0a6202
SHA109c3d1af7945679ac81562dc63fa7e762b68fda9
SHA2567f45483ef845f759fd69560e7865434139dd812f20e34a7028ffbfb01f474f4e
SHA5127bdb4f7b9bbd68bfc76453f3810daa240f82caaa6a37880b5ac735823176e5f40677ebd60737d005181c21b93a38373dee73550a7cf61b52cee5d41074feaaf0
-
Filesize
11KB
MD5ece07c2e93a86b8227a4a07d32cfda34
SHA17b87ed2549a2c3b340b0efd5d10e4703cd49825f
SHA2566204f33c5d79dcf37a98db487e7f59e4f7bb72a52730f63b370daf56cb2315c5
SHA512c08729985aa9251fad68101b16f725fc81fe4110e41a5531d79edf2a929f30660c7170967d714c12b1fd2420dbdfef025906d8388163916a34c39472706688fe
-
Filesize
15KB
MD5bf1b6be439fa1ed76f01a95e2c3abf8d
SHA19bb714ddd722d24f45cff6fbc4c449ee8b8295fb
SHA256b4cbefeaf8e8097ada9bc54307c8b59c9104c6ce8f660c16dbd77cfadc3d8910
SHA512bc7e348d0aef9d338329754e9f6061c50c811cefa1336f88ccaab453d8f3f474bd5c4046e197796125ed48c91e25647fd03a17dbb95cf74c79c284d863ba9374
-
Filesize
229KB
MD543a9f2f1686295fbb21e42923045da44
SHA10a6cbbf28d26bde141db2081b88ec72de96e0458
SHA256d99b6162448f0a9a0275501f900c7348e3cd7d529e3c1af86378d9679d89466a
SHA51219000b6351d77e8cbd8d8b9c9c9ff654c1114a08adf6f6b2a34694a4b26220ed2ccda0b9683dea25f256af7c5f638a19f40fda0d7e29134e1510552e2d425be0
-
Filesize
229KB
MD5f55b3a91807e36a6295ea92850838f8c
SHA151a3497224ee8e89af2c925c90af3c928e5b953b
SHA256683944ba15adbcea865ae7ac86b2520f7c3ad0937b772db7dc3701256963c6ed
SHA5120058d85d1a2424b8ef2cee5bf678af56a83e1daa4de01aeb8a4d04609f60213234954523e5295e51ae9a0a90d010b9702b17be0de5d8f84ee6d241dd34ed16ea
-
Filesize
229KB
MD5bf6ec30d807ae1c58bc6db4ef737cff2
SHA1857a9cfd648aac883b370931e510aea60e8a5b2c
SHA2564f236720fee5452067a6bb435ba49f69a85b098c9fe6c6bc6024846dbbafd981
SHA51247997ea6a921b992249a2dac4921986f1e5db38153d65eaf577fd1152add23a87e079b56f607bbb28696bc4700267f833c5e99a9dd57fe4ee2bc8e8ff30e6a8f
-
Filesize
229KB
MD56db27f113ca304c5274c76229fbc6251
SHA1e4336662ddf2a490d2d2897d42f4257f9370cbb6
SHA256116d23ffffe66f0f3245c42a5932e642d93bfd7dd0d2358f4b62a966439246e9
SHA5126b0905487dbda8cf5dfd739477c276eaa0f962c8d86bac33ca27f0ed3d8667b6d7b312fc178a1f5345d4deee82e21b2aa2ebaca6142b6b7f2aeb69ebe8febd90
-
Filesize
152B
MD5d91478312beae099b8ed57e547611ba2
SHA14b927559aedbde267a6193e3e480fb18e75c43d7
SHA256df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043
SHA5124086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96
-
Filesize
152B
MD5d7145ec3fa29a4f2df900d1418974538
SHA11368d579635ba1a53d7af0ed89bf0b001f149f9d
SHA256efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59
SHA5125bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5635e2eb3dfcc7054493ddaf5ce97b8db
SHA1e0c004057750a472de24307a8bd8e477dda8cc82
SHA25699f710fa6d088c933e92d27dac470014c629323068fd1e517f78909fe9f153dc
SHA5123e416131e6b8bb06c5eb1dca8ce41636c1b894431b9630212eaea6a4543dd5f246035c8509d3a56eeccdde32b522164c912ef59143ae0ee118e64618347a03b2
-
Filesize
939B
MD5e605840c6ccbb11763fd5bb8184a82b7
SHA1a9f3503f28b0d2cfc24bd21e0e251be757c09e45
SHA2569b486b80fba6df2cd402f87f097accda58c44a7f485943fae6bf927bc7a129e9
SHA512dbc734d8eb468865f675b416f21aef0d07b8d715efc07a86cd688d936aead179864e97ff28fe12116123f0f223464c33d8339f126cff5215cd26d7991e81666d
-
Filesize
6KB
MD5eaf47d31ef5a12af45034a526baeb39a
SHA15cb5f8475585e5181d9d4a92074415ddcae5f740
SHA256f9002b3ab346fe47ab1fc879c33fbed47096dc20095a04a63f26d5b184e14c0f
SHA512060bc94f0a68e25df5d590ef132ab91e4ed5e7e096dbc1ae7ac5c434411b061e1320e8c887a746d6e3c7ef9b8c6395a389e9331fe2ad89f13c2e2b2af9d70157
-
Filesize
6KB
MD57813ce677b86bd529cfc721cd123e563
SHA16577b0ad6b10c9cfc4dc962a97f57f69f771ce75
SHA2568dca318a43c7806a01671b61bc3e357c6774f375d2888f30b62422806efc6cf2
SHA51262a81f31a215d49a0d0256636c0812f090eeb87ae3eb3310c7c4743f6356f46cf1e40264059b48d4acf494813d50ea03a557fcc577907a9b3086da0f5463ddf8
-
Filesize
5KB
MD552b86a6a99882f3ad374bccfdf591c2a
SHA1c2c20fe83a1509eb2f6ab03a2a428511dd6982d2
SHA256c416391045ac0c5436258958fdaefb0edb67798ea0bd16d878fd8fba40be2906
SHA512389d36ee142a3826e55c332d7691d7b664d7a376b5d4f40ab1dac9158c3dc5d9d66bac163c168b78cb7de9e5bcab03b18c260bb6acc623112eb23d56eef55c28
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5baf9818d0f260640e84497af007d8833
SHA125e79f039c3e240b58326dbee1575c110fd5a302
SHA2568d990cad28464c537640f674298f142494f2b87e51d1fae36ba91aaeb9a9532b
SHA5122ddbf29f0b764529e1cf4976bf84cfd195bc54ca0c6f0203d24e5cccf104e0fcde3e483879603b96d1dc70cf1dbf446ed099ba2ceb1badcd04f6d359811779d3
-
Filesize
11KB
MD5c4fdeac50e5870be5495b96e3bab4ba1
SHA10e334fa3d72f47c302956155200c88c4e333a484
SHA256e1cab6d100e79c1e74e44708f151c22d2eb57d8576eebeb9c02976f137646963
SHA5125dbd46e2cc83c9b69dca0b9ee999126197aced9df5df809cb1b124b74d633d1aa751811dacf939c0ea4a5d1291f8248f784beecff2bf5e84731c9064c59b682b
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\0d19ce75-bcdf-40e2-b996-f635323e457c.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
8.0MB
MD58e15b605349e149d4385675afff04ebf
SHA1f346a886dd4cb0fbbd2dff1a43d9dfde7fce348b
SHA256803f930cdd94198bdd2e9a51aa962cc864748067373f11b2e9215404bd662cee
SHA5128bf957ef72465fe103dbf83411df9082433eead022f0beccab59c9e406bbd1e4edb701fd0bc91f195312943ad1890fee34b4e734578298bb60bb81ed6fa9a46d
-
Filesize
8.0MB
MD5596cb5d019dec2c57cda897287895614
SHA16b12ea8427fdbee9a510160ff77d5e9d6fa99dfa
SHA256e1c89d9348aea185b0b0e80263c9e0bf14aa462294a5d13009363140a88df3ff
SHA5128f5fc432fd2fc75e2f84d4c7d21c23dd1f78475214c761418cf13b0e043ba1e0fc28df52afd9149332a2134fe5d54abc7e8676916100e10f374ef6cdecff7a20
-
Filesize
8.0MB
MD57c8328586cdff4481b7f3d14659150ae
SHA1b55ffa83c7d4323a08ea5fabf5e1c93666fead5c
SHA2565eec15c6ed08995e4aaffa9beeeaf3d1d3a3d19f7f4890a63ddc5845930016cc
SHA512aa4220217d3af263352f8b7d34bd8f27d3e2c219c673889bc759a019e3e77a313b0713fd7b88700d57913e2564d097e15ffc47e5cf8f4899ba0de75d215f661d
-
Filesize
8.0MB
MD54f398982d0c53a7b4d12ae83d5955cce
SHA109dc6b6b6290a3352bd39f16f2df3b03fb8a85dc
SHA256fee4d861c7302f378e7ce58f4e2ead1f2143168b7ca50205952e032c451d68f2
SHA51273d9f7c22cf2502654e9cd6cd5d749e85ea41ce49fd022378df1e9d07e36ae2dde81f0b9fc25210a9860032ecda64320ec0aaf431bcd6cefba286328efcfb913
-
Filesize
8.0MB
MD594e0d650dcf3be9ab9ea5f8554bdcb9d
SHA121e38207f5dee33152e3a61e64b88d3c5066bf49
SHA256026893ba15b76f01e12f3ef540686db8f52761dcaf0f91dcdc732c10e8f6da0e
SHA512039ccf6979831f692ea3b5e3c5df532f16c5cf395731864345c28938003139a167689a4e1acef1f444db1fe7fd3023680d877f132e17bf9d7b275cfc5f673ac3
-
Filesize
1.8MB
MD5b3b7f6b0fb38fc4aa08f0559e42305a2
SHA1a66542f84ece3b2481c43cd4c08484dc32688eaf
SHA2567fb63fca12ef039ad446482e3ce38abe79bdf8fc6987763fe337e63a1e29b30b
SHA5120f4156f90e34a4c26e1314fc0c43367ad61d64c8d286e25629d56823d7466f413956962e2075756a4334914d47d69e20bb9b5a5b50c46eca4ef8173c27824e6c
-
Filesize
73KB
MD581e5c8596a7e4e98117f5c5143293020
SHA145b7fe0989e2df1b4dfd227f8f3b73b6b7df9081
SHA2567d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
SHA51205b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6
-
Filesize
40KB
MD548c00a7493b28139cbf197ccc8d1f9ed
SHA1a25243b06d4bb83f66b7cd738e79fccf9a02b33b
SHA256905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7
SHA512c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830
-
Filesize
160KB
MD5237e13b95ab37d0141cf0bc585b8db94
SHA1102c6164c21de1f3e0b7d487dd5dc4c5249e0994
SHA256d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a
SHA5129d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb
-
Filesize
60KB
MD5a334bbf5f5a19b3bdb5b7f1703363981
SHA16cb50b15c0e7d9401364c0fafeef65774f5d1a2c
SHA256c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de
SHA5121fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46
-
Filesize
64KB
MD57c5aefb11e797129c9e90f279fbdf71b
SHA1cb9d9cbfbebb5aed6810a4e424a295c27520576e
SHA256394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed
SHA512df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a
-
Filesize
60KB
MD54fbbaac42cf2ecb83543f262973d07c0
SHA1ab1b302d7cce10443dfc14a2eba528a0431e1718
SHA2566550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5
SHA5124146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e
-
Filesize
36KB
MD5b4ac608ebf5a8fdefa2d635e83b7c0e8
SHA1d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9
SHA2568414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f
SHA5122c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4
-
Filesize
60KB
MD59fafb9d0591f2be4c2a846f63d82d301
SHA11df97aa4f3722b6695eac457e207a76a6b7457be
SHA256e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d
SHA512ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a
-
Filesize
268KB
MD55c91bf20fe3594b81052d131db798575
SHA1eab3a7a678528b5b2c60d65b61e475f1b2f45baa
SHA256e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175
SHA512face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6
-
Filesize
28KB
MD50cbf0f4c9e54d12d34cd1a772ba799e1
SHA140e55eb54394d17d2d11ca0089b84e97c19634a7
SHA2566b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1
SHA512bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5
-
Filesize
8KB
MD5466d35e6a22924dd846a043bc7dd94b8
SHA135e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10
SHA256e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801
SHA51223b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247
-
Filesize
2KB
MD5e4a499b9e1fe33991dbcfb4e926c8821
SHA1951d4750b05ea6a63951a7667566467d01cb2d42
SHA25649e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
SHA512a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a
-
Filesize
28KB
MD5f1656b80eaae5e5201dcbfbcd3523691
SHA16f93d71c210eb59416e31f12e4cc6a0da48de85b
SHA2563f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2
SHA512e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003
-
Filesize
7KB
MD5b127d9187c6dbb1b948053c7c9a6811f
SHA1b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9
SHA256bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00
SHA51288e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476
-
Filesize
52KB
MD5316999655fef30c52c3854751c663996
SHA1a7862202c3b075bdeb91c5e04fe5ff71907dae59
SHA256ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0
SHA5125555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44
-
Filesize
76KB
MD5e7cd26405293ee866fefdd715fc8b5e5
SHA16326412d0ea86add8355c76f09dfc5e7942f9c11
SHA256647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
SHA5121114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999
-
Filesize
552KB
MD5497fd4a8f5c4fcdaaac1f761a92a366a
SHA181617006e93f8a171b2c47581c1d67fac463dc93
SHA25691cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
SHA51273d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25
-
Filesize
2KB
MD57210d5407a2d2f52e851604666403024
SHA1242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9
SHA256337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
SHA5121755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68
-
Filesize
4KB
MD54be7661c89897eaa9b28dae290c3922f
SHA14c9d25195093fea7c139167f0c5a40e13f3000f2
SHA256e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
SHA5122035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f
-
Filesize
29KB
MD5c3e8aeabd1b692a9a6c5246f8dcaa7c9
SHA14567ea5044a3cef9cb803210a70866d83535ed31
SHA25638ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
SHA512f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e
-
Filesize
1.2MB
MD5ed98e67fa8cc190aad0757cd620e6b77
SHA10317b10cdb8ac080ba2919e2c04058f1b6f2f94d
SHA256e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
SHA512ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0
-
Filesize
11KB
MD580d09149ca264c93e7d810aac6411d1d
SHA196e8ddc1d257097991f9cc9aaf38c77add3d6118
SHA256382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
SHA5128813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9
-
Filesize
2KB
MD50a250bb34cfa851e3dd1804251c93f25
SHA1c10e47a593c37dbb7226f65ad490ff65d9c73a34
SHA25685189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
SHA5128e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795
-
Filesize
40KB
MD51587bf2e99abeeae856f33bf98d3512e
SHA1aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9
SHA256c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
SHA51243161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
49.8MB
MD565259c11e1ff8d040f9ec58524a47f02
SHA12d5a24f7cadd10140dd6d3dd0dc6d0f02c2d40fd
SHA256755bd7f1fc6e93c3a69a1125dd74735895bdbac9b7cabad0506195a066bdde42
SHA51237096eeb1ab0e11466c084a9ce78057e250f856b919cb9ef3920dad29b2bb2292daabbee15c64dc7bc2a48dd930a52a2fb9294943da2c1c3692863cec2bae03d
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
1.8MB
MD550515f156ae516461e28dd453230d448
SHA13209574e09ec235b2613570e6d7d8d5058a64971
SHA256f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca
SHA51214593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5
-
Filesize
5.0MB
MD51fd2907e2c74c9a908e2af5f948006b5
SHA1a390e9133bfd0d55ffda07d4714af538b6d50d3d
SHA256f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
SHA5128eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171
-
Filesize
4.0MB
MD549654a47fadfd39414ddc654da7e3879
SHA19248c10cef8b54a1d8665dfc6067253b507b73ad
SHA256b8112187525051bfade06cb678390d52c79555c960202cc5bbf5901fbc0853c5
SHA512fa9cab60fadd13118bf8cb2005d186eb8fa43707cb983267a314116129371d1400b95d03fbf14dfdaba8266950a90224192e40555d910cf8a3afa4aaf4a8a32f