Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/12/2024, 10:06
Behavioral task
behavioral1
Sample
3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Resource
win10v2004-20241007-en
General
-
Target
3aa1bbd17d68b0b67b7423f1fe09b05b.exe
-
Size
2.2MB
-
MD5
3aa1bbd17d68b0b67b7423f1fe09b05b
-
SHA1
61c43b8f31a51d772fd39d5caa87699d74971a43
-
SHA256
7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474
-
SHA512
7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014
-
SSDEEP
49152:mx4QdTmxnMJUh+pDY92IXc3Mx+HqXQJc2cv1TDlH:QdPpDYbNiIP2cvxZH
Malware Config
Signatures
-
DcRat 31 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 2512 schtasks.exe 1936 schtasks.exe 2068 schtasks.exe 1572 schtasks.exe 1508 schtasks.exe 1872 schtasks.exe 2988 schtasks.exe 2700 schtasks.exe 628 schtasks.exe 2460 schtasks.exe 2916 schtasks.exe 792 schtasks.exe 1712 schtasks.exe 1992 schtasks.exe 1972 schtasks.exe 596 schtasks.exe 2548 schtasks.exe 2808 schtasks.exe 2992 schtasks.exe 584 schtasks.exe 1868 schtasks.exe 1080 schtasks.exe 1336 schtasks.exe 2032 schtasks.exe 2796 schtasks.exe 1932 schtasks.exe 2076 schtasks.exe 292 schtasks.exe 2844 schtasks.exe 1740 schtasks.exe -
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\", \"C:\\Windows\\Registration\\CRMLog\\lsass.exe\", \"C:\\Users\\Admin\\SendTo\\taskhost.exe\", \"C:\\Users\\Admin\\3aa1bbd17d68b0b67b7423f1fe09b05b.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\", \"C:\\Windows\\Registration\\CRMLog\\lsass.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\", \"C:\\Windows\\Registration\\CRMLog\\lsass.exe\", \"C:\\Users\\Admin\\SendTo\\taskhost.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\", \"C:\\Windows\\Registration\\CRMLog\\lsass.exe\", \"C:\\Users\\Admin\\SendTo\\taskhost.exe\", \"C:\\Users\\Admin\\3aa1bbd17d68b0b67b7423f1fe09b05b.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\dwm.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe -
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2700 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2548 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2512 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 628 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2988 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 596 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 792 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 584 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 292 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2796 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2808 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2844 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1712 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1336 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2460 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1740 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1572 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1508 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1080 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2032 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1872 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1992 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1972 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2992 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2068 2856 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2916 2856 schtasks.exe 28 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe -
resource yara_rule behavioral1/memory/1860-1-0x0000000000360000-0x000000000059E000-memory.dmp dcrat behavioral1/files/0x0006000000016d11-42.dat dcrat behavioral1/memory/772-60-0x00000000011C0000-0x00000000013FE000-memory.dmp dcrat behavioral1/memory/444-105-0x0000000000310000-0x000000000054E000-memory.dmp dcrat behavioral1/memory/2904-118-0x0000000000F30000-0x000000000116E000-memory.dmp dcrat behavioral1/memory/2068-143-0x0000000000370000-0x00000000005AE000-memory.dmp dcrat behavioral1/memory/2520-155-0x00000000013C0000-0x00000000015FE000-memory.dmp dcrat behavioral1/memory/1012-167-0x0000000000050000-0x000000000028E000-memory.dmp dcrat behavioral1/memory/2428-180-0x00000000001E0000-0x000000000041E000-memory.dmp dcrat -
Executes dropped EXE 11 IoCs
pid Process 772 taskhost.exe 2256 taskhost.exe 2560 taskhost.exe 2880 taskhost.exe 444 taskhost.exe 2904 taskhost.exe 2532 taskhost.exe 2068 taskhost.exe 2520 taskhost.exe 1012 taskhost.exe 2428 taskhost.exe -
Adds Run key to start application 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Registration\\CRMLog\\lsass.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Registration\\CRMLog\\lsass.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\3aa1bbd17d68b0b67b7423f1fe09b05b = "\"C:\\Users\\Admin\\3aa1bbd17d68b0b67b7423f1fe09b05b.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\dwm.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Admin\\SendTo\\taskhost.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Admin\\SendTo\\taskhost.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3aa1bbd17d68b0b67b7423f1fe09b05b = "\"C:\\Users\\Admin\\3aa1bbd17d68b0b67b7423f1fe09b05b.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\dwm.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\"" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\c5b4cb5e9653cc 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\6203df4a6bafc7 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\6cb0b6c459d5d3 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Program Files\Windows Journal\es-ES\Idle.exe 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Program Files\Windows Journal\es-ES\6ccacd8608530f 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\5940a34987c991 3aa1bbd17d68b0b67b7423f1fe09b05b.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Registration\CRMLog\lsass.exe 3aa1bbd17d68b0b67b7423f1fe09b05b.exe File created C:\Windows\Registration\CRMLog\6203df4a6bafc7 3aa1bbd17d68b0b67b7423f1fe09b05b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 596 schtasks.exe 1936 schtasks.exe 2988 schtasks.exe 792 schtasks.exe 2808 schtasks.exe 2032 schtasks.exe 2068 schtasks.exe 2700 schtasks.exe 2548 schtasks.exe 1712 schtasks.exe 1508 schtasks.exe 1872 schtasks.exe 2512 schtasks.exe 584 schtasks.exe 1992 schtasks.exe 2992 schtasks.exe 628 schtasks.exe 1932 schtasks.exe 1740 schtasks.exe 1572 schtasks.exe 2844 schtasks.exe 1336 schtasks.exe 2076 schtasks.exe 2460 schtasks.exe 1080 schtasks.exe 1972 schtasks.exe 292 schtasks.exe 1868 schtasks.exe 2796 schtasks.exe 2916 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 772 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe 2256 taskhost.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Token: SeDebugPrivilege 772 taskhost.exe Token: SeDebugPrivilege 2256 taskhost.exe Token: SeDebugPrivilege 2560 taskhost.exe Token: SeDebugPrivilege 2880 taskhost.exe Token: SeDebugPrivilege 444 taskhost.exe Token: SeDebugPrivilege 2904 taskhost.exe Token: SeDebugPrivilege 2532 taskhost.exe Token: SeDebugPrivilege 2068 taskhost.exe Token: SeDebugPrivilege 2520 taskhost.exe Token: SeDebugPrivilege 1012 taskhost.exe Token: SeDebugPrivilege 2428 taskhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 772 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 59 PID 1860 wrote to memory of 772 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 59 PID 1860 wrote to memory of 772 1860 3aa1bbd17d68b0b67b7423f1fe09b05b.exe 59 PID 772 wrote to memory of 2268 772 taskhost.exe 60 PID 772 wrote to memory of 2268 772 taskhost.exe 60 PID 772 wrote to memory of 2268 772 taskhost.exe 60 PID 772 wrote to memory of 1228 772 taskhost.exe 61 PID 772 wrote to memory of 1228 772 taskhost.exe 61 PID 772 wrote to memory of 1228 772 taskhost.exe 61 PID 2268 wrote to memory of 2256 2268 WScript.exe 62 PID 2268 wrote to memory of 2256 2268 WScript.exe 62 PID 2268 wrote to memory of 2256 2268 WScript.exe 62 PID 2256 wrote to memory of 1668 2256 taskhost.exe 63 PID 2256 wrote to memory of 1668 2256 taskhost.exe 63 PID 2256 wrote to memory of 1668 2256 taskhost.exe 63 PID 2256 wrote to memory of 2760 2256 taskhost.exe 64 PID 2256 wrote to memory of 2760 2256 taskhost.exe 64 PID 2256 wrote to memory of 2760 2256 taskhost.exe 64 PID 1668 wrote to memory of 2560 1668 WScript.exe 67 PID 1668 wrote to memory of 2560 1668 WScript.exe 67 PID 1668 wrote to memory of 2560 1668 WScript.exe 67 PID 2560 wrote to memory of 1540 2560 taskhost.exe 68 PID 2560 wrote to memory of 1540 2560 taskhost.exe 68 PID 2560 wrote to memory of 1540 2560 taskhost.exe 68 PID 2560 wrote to memory of 2648 2560 taskhost.exe 69 PID 2560 wrote to memory of 2648 2560 taskhost.exe 69 PID 2560 wrote to memory of 2648 2560 taskhost.exe 69 PID 1540 wrote to memory of 2880 1540 WScript.exe 70 PID 1540 wrote to memory of 2880 1540 WScript.exe 70 PID 1540 wrote to memory of 2880 1540 WScript.exe 70 PID 2880 wrote to memory of 1128 2880 taskhost.exe 71 PID 2880 wrote to memory of 1128 2880 taskhost.exe 71 PID 2880 wrote to memory of 1128 2880 taskhost.exe 71 PID 2880 wrote to memory of 1572 2880 taskhost.exe 72 PID 2880 wrote to memory of 1572 2880 taskhost.exe 72 PID 2880 wrote to memory of 1572 2880 taskhost.exe 72 PID 1128 wrote to memory of 444 1128 WScript.exe 73 PID 1128 wrote to memory of 444 1128 WScript.exe 73 PID 1128 wrote to memory of 444 1128 WScript.exe 73 PID 444 wrote to memory of 2140 444 taskhost.exe 74 PID 444 wrote to memory of 2140 444 taskhost.exe 74 PID 444 wrote to memory of 2140 444 taskhost.exe 74 PID 444 wrote to memory of 568 444 taskhost.exe 75 PID 444 wrote to memory of 568 444 taskhost.exe 75 PID 444 wrote to memory of 568 444 taskhost.exe 75 PID 2140 wrote to memory of 2904 2140 WScript.exe 76 PID 2140 wrote to memory of 2904 2140 WScript.exe 76 PID 2140 wrote to memory of 2904 2140 WScript.exe 76 PID 2904 wrote to memory of 2660 2904 taskhost.exe 77 PID 2904 wrote to memory of 2660 2904 taskhost.exe 77 PID 2904 wrote to memory of 2660 2904 taskhost.exe 77 PID 2904 wrote to memory of 852 2904 taskhost.exe 78 PID 2904 wrote to memory of 852 2904 taskhost.exe 78 PID 2904 wrote to memory of 852 2904 taskhost.exe 78 PID 2660 wrote to memory of 2532 2660 WScript.exe 79 PID 2660 wrote to memory of 2532 2660 WScript.exe 79 PID 2660 wrote to memory of 2532 2660 WScript.exe 79 PID 2532 wrote to memory of 1484 2532 taskhost.exe 80 PID 2532 wrote to memory of 1484 2532 taskhost.exe 80 PID 2532 wrote to memory of 1484 2532 taskhost.exe 80 PID 2532 wrote to memory of 548 2532 taskhost.exe 81 PID 2532 wrote to memory of 548 2532 taskhost.exe 81 PID 2532 wrote to memory of 548 2532 taskhost.exe 81 PID 1484 wrote to memory of 2068 1484 WScript.exe 82 -
System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 3aa1bbd17d68b0b67b7423f1fe09b05b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe"C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1860 -
C:\Users\Admin\SendTo\taskhost.exe"C:\Users\Admin\SendTo\taskhost.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:772 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ab35106-d5ad-4530-a266-844e3b61f400.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe4⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2256 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\288c35ac-6528-45ae-b3a3-9763afdbbf7e.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2560 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e67915fe-449f-4872-8923-aa3b3f9cf47e.vbs"7⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe8⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2880 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\399e6311-c3dc-4f52-8ca2-48a7577ca435.vbs"9⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe10⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:444 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60f65f81-f80e-4171-9877-0553e5244e97.vbs"11⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe12⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2904 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\093d96e2-81e4-4481-8787-fac5205801c5.vbs"13⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe14⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2532 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9573d2f6-b1d9-4ca2-ad4f-d6444cd4f169.vbs"15⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe16⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2068 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0cab5dd-4707-43ca-97ca-fbd88e1bf727.vbs"17⤵PID:1324
-
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe18⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2520 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e08352f-9ab0-49df-b095-8a40ae794573.vbs"19⤵PID:2272
-
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe20⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1012 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4595f9d1-b66f-4e01-abd1-d66335f79030.vbs"21⤵PID:1076
-
C:\Users\Admin\SendTo\taskhost.exeC:\Users\Admin\SendTo\taskhost.exe22⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2428 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a40a1bb-dd23-4aae-8896-7517cd25ee8c.vbs"23⤵PID:1980
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa7a4ff3-2da1-42a5-8ab8-18d8b53e083e.vbs"23⤵PID:2908
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7e51393-9a85-465d-b9f9-1e9ebd8afea2.vbs"21⤵PID:1876
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f050ff08-8aa0-4d4b-bdea-eb5aef56d205.vbs"19⤵PID:2280
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6017b138-fb0e-4e0e-8a9a-b046801c57a7.vbs"17⤵PID:2484
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a90ab2c1-b83c-4473-bb00-9b053beacf5f.vbs"15⤵PID:548
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98861ff0-3354-4063-9999-1bcf1cf53a30.vbs"13⤵PID:852
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5b41d2b-920b-4916-b4a8-5e5a7219b8d7.vbs"11⤵PID:568
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20f91dd3-0f3c-47e5-b7a1-6350280b8d1a.vbs"9⤵PID:1572
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0907e37f-5aa1-4a7d-93d9-90470d2bbe1d.vbs"7⤵PID:2648
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4876a9fd-0ae8-4def-86cb-b3948aff9bd7.vbs"5⤵PID:2760
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2bea1de-d169-4d4d-9c80-b5ba15dd4501.vbs"3⤵PID:1228
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\SendTo\taskhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\taskhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\SendTo\taskhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3aa1bbd17d68b0b67b7423f1fe09b05b3" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\3aa1bbd17d68b0b67b7423f1fe09b05b.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3aa1bbd17d68b0b67b7423f1fe09b05b" /sc ONLOGON /tr "'C:\Users\Admin\3aa1bbd17d68b0b67b7423f1fe09b05b.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3aa1bbd17d68b0b67b7423f1fe09b05b3" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\3aa1bbd17d68b0b67b7423f1fe09b05b.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD53aa1bbd17d68b0b67b7423f1fe09b05b
SHA161c43b8f31a51d772fd39d5caa87699d74971a43
SHA2567362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474
SHA5127ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014
-
Filesize
710B
MD543fdf458ca2299bb2814c9cdd13638f0
SHA1bd50ec589d9e3878962f4a111794bdb7a086c368
SHA256a2936914865e43dbebdc3a0bc542e879a1d7210aa8ab025cad222d76c6af333a
SHA5123d23fe1b0ccd5f157e215b0c9415ab8477c5c7e617428bba71a12e254fc3d08e70279bbe089c6d7aacda1c9f1c6fcfdfa7dd241f0ac34503cf2f53037973e771
-
Filesize
710B
MD5c37d4cb478604890deafd59115e8a3a1
SHA19f05cf9ef45d0a4d17932c1183480ace90753443
SHA2565623f5b6aa2faebc19514a1b7891d5ed89fb8331cda4f1635829a7ce1cbdd0df
SHA512d08774eac87ee44d47566aced47be33e66e0cb4a9b70c4794a54cea10803b2fae538801821efd521d66fc7ca1e6db65e4b4570dce9137bf6a6cf9cf7c8ce5ac7
-
Filesize
710B
MD5b92f6ca6e485df15c39e835f3266abfd
SHA163e70e54cb2bb7df395fa9c0412a7e52ccc76811
SHA25648fb22ca258e77480b1a98a7ff2e29ba69a95e9b19f61245629da5590f8f4aab
SHA512f718768886071fa5eafbd99df7350e48505de23e46b85c14c17ed11d645e59f4e61a76568af7b69000b2bda5991b36b97dbd951ac460c71220a9ef33161e4dcf
-
Filesize
710B
MD50428b772990c38b2b6689443dd6592b8
SHA19af3a340492b12866ff184a2ab6540d2a38fb9b5
SHA256b7d824abce0dcfeb3b710d5fb4972e5eb06940edd282b9b41344d07b6836d226
SHA512f39125484f9cfa27aab1e2cf2fb7d2371f4ec795c0ac080b5d29152045e364fb3cee4550a38ec17c138e7a046e15cf03ebf90b0777c88647c4f46e0da8d13e31
-
Filesize
709B
MD56d0a920f6ba1c14baa7d191a0d3a388c
SHA1af26b6027e2c0c501129d44d94c6d200b42de998
SHA2569088f7e0ac4bfe7db889923ad011fdc0a905b300372fb0973632877deaea5de8
SHA512fdaba7a177d4714ebd5619e04e0bc7cc8d5d45821aa82c3348cd6654ee9246508e2b8b630f8590fd3d207ddd4921db9d7f17495c5bdbf60563a67bfbeee0fa94
-
Filesize
710B
MD58747493d21ab2f0ece118b33d66e9398
SHA140ccb5c6f14ac08754528e471e0812d4925979e7
SHA256dfa09444abfd46dc4c9d2c02ab006d7c762150701227413d3e1b0ab8e413d13f
SHA51280c042eb505c38db33ce75850a6080560bc7c7bcae216b9ee83397f87a0b3e6e7cc5a711c4d8ce65d83d3b1a62dbb6580a3da4feb7436e75792d558194de75a6
-
Filesize
709B
MD59a0a490d71f6983f53ecfe69f21430d5
SHA17ee71240aec4a76ba584a153245f170100b08a5a
SHA2567b0ef9b5d6f9740489fcb889c4b2fe94f2bb9ada70d5066afd744bd11f3e7152
SHA512e3d8ed4fd650f1be0542e63b3cf3ff34b7af6fd4dcbefd63c40f2a95f0e52406b4def01ffa38d1f5ea1da0bb8f6f1fc4f4de9351e3a45a08a1e2dae679818fde
-
Filesize
710B
MD5c628042ebad85c9f5aa40bf924401558
SHA177073541745cdf589bcc5d9b676de10c6bf74dba
SHA256a713cdf98570c85922792c7c1ead2c64576754453b9cbc42a9704118e3855f07
SHA512970c30d4f03af332cf96937537207a1c1eb4af3d50b5d26ff7e47e06cf25c636a4217abb0405b97fa51faf9bf48c656b2844d11050f943c623885b202b322fec
-
Filesize
710B
MD544d0b2f115052772a832d891dbf29ffd
SHA1c72d426840c5f8d98dc43144a6733b1db8f0e8ef
SHA256b7c3a74abe9da54a0c52eb86264696925ed404d8455b9adedac626243abe4bc3
SHA5122ffe9bfe2a3b3ffc9aef4d172ba2d29853e82e591ddf7473daa333ce00e684ab104a7cd002442fbe5d7881c8e9ff8c3ca81592ca8e35169bb2e70a7c3ff6f8df
-
Filesize
710B
MD543c41ff93a456d11df95fad22a6e01a1
SHA197bf955cf4d2ff011027c9ca79a2dfc6f077601f
SHA256146e669e3ead8a81a6657160d603c8cb4576b5a802f8c08b009f0bbb57f1c408
SHA5123817bccb9fb348ee05c5ee3769605ec657f9785bf76711a22cd36c3d0f200db98a3856ca5875414231d5e0f3add46678ce4a5a9c1c214ea0878776cee67879df
-
Filesize
486B
MD5689c6c22afb8a95c726a859f4d580918
SHA107aebbefa5306cce0b862489317437b8952e5a48
SHA2562927140e870240dc927bb498a8e27aff6cce73f68feefedbf37666e5a908e42d
SHA512c36c9ccd120e543d776b6fcd834ca4a18ed3f597bbe4633ab4d2a707702c6f2334efa81ecff0ed803ad1b8f752b5f66e6973e234b9b28157b58f7caaa58a8101
-
Filesize
710B
MD5c91b6b330d87176aa9e92a92658cd6fe
SHA1db3dbeb0dd27b37cf3809343e3fe124c0046fffc
SHA25647a5eb31446556bff6f2e187e337bf51022c85944af4191874b874c49ff5ef1e
SHA51209259d591f7c811e2d8de52421965a8d4ca1152388334df94a4f091c378859f017f87fc1f6a8a8198b6e97595d8b79c3c8f143a6021aac1ed5019cffa1ac7223