Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/01/2025, 04:00
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe
-
Size
644KB
-
MD5
01ebc7d1d7a3e9ba43d98863449432f2
-
SHA1
59059f24d5a416a06f7976508688416ae38a6f50
-
SHA256
e36f4ee428c9abded8a7fa59bdd11f7341cc1211c73fce5069d3d7eaa66f7676
-
SHA512
8776f3f3c9c1469db8bd37871e7d0fb8688255c57f58c72b550dd2742968db11c52b8550ae3209a788fd6ed5c354f21b68098e3a219df293b7781a5bf2c54c9e
-
SSDEEP
12288:cFumuLM+DqWaSMB9KIAG2ruBeIvjgZVJKfDYQ3QxNKYFm:cFaY+DqWaSMB9KrrgPQVUEQ3QPKYF
Malware Config
Extracted
cybergate
2.6
victim
arschloch.no-ip.org:1337
***MUTEX***
-
enable_keylogger
false
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
system32
-
install_file
rundl32.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
You need Net Framework 4.0 to open this file!
-
message_box_title
Error 404
-
password
victim
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\rundl32.exe" rundl32.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run rundl32.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundl32.exe" JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run rundl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\rundl32.exe" rundl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\rundl32.exe" rundl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundl32.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundl32.exe" JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run rundl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundl32.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run rundl32.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\rundl32.exe" rundl32.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06G54T08-1565-0086-I137-28C6T3324CCE}\StubPath = "C:\\Windows\\system32\\rundl32.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{06G54T08-1565-0086-I137-28C6T3324CCE} rundl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06G54T08-1565-0086-I137-28C6T3324CCE}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\rundl32.exe Restart" rundl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{06G54T08-1565-0086-I137-28C6T3324CCE} explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{06G54T08-1565-0086-I137-28C6T3324CCE} JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{06G54T08-1565-0086-I137-28C6T3324CCE} rundl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06G54T08-1565-0086-I137-28C6T3324CCE}\StubPath = "C:\\Windows\\SysWOW64\\rundl32.exe Restart" rundl32.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06G54T08-1565-0086-I137-28C6T3324CCE}\StubPath = "C:\\Windows\\system32\\rundl32.exe Restart" JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation rundl32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation rundl32.exe -
Executes dropped EXE 13 IoCs
pid Process 1628 rundl32.exe 4024 rundl32.exe 4540 rundl32.exe 4384 rundl32.exe 2780 rundl32.exe 1280 rundl32.exe 3824 rundl32.exe 2020 rundl32.exe 116 rundl32.exe 2752 rundl32.exe 4180 rundl32.exe 3128 rundl32.exe 4744 rundl32.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\rundl32.exe" JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\rundl32.exe" JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\rundl32.exe" rundl32.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\rundl32.exe" rundl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\rundl32.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\rundl32.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\rundl32.exe" rundl32.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\rundl32.exe" rundl32.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rundl32.exe rundl32.exe File opened for modification C:\Windows\SysWOW64\rundl32.exe rundl32.exe File created C:\Windows\SysWOW64\rundl32.exe rundl32.exe File created C:\Windows\SysWOW64\rundl32.exe JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe File created C:\Windows\SysWOW64\rundl32.exe rundl32.exe File opened for modification C:\Windows\SysWOW64\rundl32.exe rundl32.exe File opened for modification C:\Windows\SysWOW64\rundl32.exe rundl32.exe File opened for modification C:\Windows\SysWOW64\rundl32.exe rundl32.exe File opened for modification C:\Windows\SysWOW64\ rundl32.exe File opened for modification C:\Windows\SysWOW64\rundl32.exe JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 4736 set thread context of 2012 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 83 PID 1628 set thread context of 4024 1628 rundl32.exe 88 PID 4540 set thread context of 4384 4540 rundl32.exe 93 PID 2780 set thread context of 1280 2780 rundl32.exe 95 PID 3824 set thread context of 2020 3824 rundl32.exe 98 PID 3128 set thread context of 4744 3128 rundl32.exe 119 -
resource yara_rule behavioral2/memory/2012-2-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2012-4-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2012-6-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2012-5-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2012-11-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/2012-71-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/2012-83-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4024-90-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4024-104-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4384-112-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1280-120-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2020-128-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4384-203-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1280-285-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2020-351-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4744-364-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 2816 2752 WerFault.exe 106 2376 4180 WerFault.exe 110 3372 4744 WerFault.exe 119 -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "002D 002D 0021 0021 0026 0026 002C 002C 002E 002E 003F 003F 005F 005F 002B 002B 002A 002A 02C9 02C9 02CA 02CA 02C7 02C7 02CB 02CB 02D9 02D9 3000 3000 3105 3105 3106 3106 3107 3107 3108 3108 3109 3109 310A 310A 310B 310B 310C 310C 310D 310D 310E 310E 310F 310F 3110 3110 3111 3111 3112 3112 3113 3113 3114 3114 3115 3115 3116 3116 3117 3117 3118 3118 3119 3119 3127 3127 3128 3128 3129 3129 311A 311A 311B 311B 311C 311C 311D 311D 311E 311E 311F 311F 3120 3120 3121 3121 3122 3122 3123 3123 3124 3124 3125 3125 3126 3126" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE/SOFTWARE\\Microsoft\\Speech_OneCore\\AudioOutput\\TokenEnums\\MMAudioOut\\" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - de-DE Embedded DNN v11.1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Discrete;Continuous" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Katja" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\M1040Elsa" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Locale Handler" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\tn1041.bin" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{06405088-BC01-4E08-B392-5303E75090C8}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Near" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "C0A" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Lts Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Laura" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\MSTTSLocfrFR.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1031-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Locale Handler" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-3082-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\AI043082" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5218064" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR fr-FR Lts Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\c1040.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\it-IT\\VoiceActivation_it-IT.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ayumi" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ichiro - Japanese (Japan)" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "411" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-493223053-2004649691-1575712786-1000\{666F918B-941B-4F2C-A911-C0EF2E331FBA} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Female" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\MSTTSLocitIT.dat" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{37A9D401-0BF5-4366-9530-C75C6DC23EC9}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lts Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Lookup Lexicon" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\c1036.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "0" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Helena - Spanish (Spain)" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 4024 rundl32.exe 4024 rundl32.exe 4384 rundl32.exe 4384 rundl32.exe 1280 rundl32.exe 1280 rundl32.exe 2020 rundl32.exe 2020 rundl32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeDebugPrivilege 116 rundl32.exe Token: SeDebugPrivilege 116 rundl32.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 2064 explorer.exe Token: SeCreatePagefilePrivilege 2064 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe Token: SeShutdownPrivilege 1712 explorer.exe Token: SeCreatePagefilePrivilege 1712 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 4024 rundl32.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 2064 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 1712 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 3540 explorer.exe 6040 explorer.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 1628 rundl32.exe 4540 rundl32.exe 2780 rundl32.exe 3824 rundl32.exe 1096 StartMenuExperienceHost.exe 3128 rundl32.exe 1772 StartMenuExperienceHost.exe 4204 SearchApp.exe 1320 StartMenuExperienceHost.exe 824 SearchApp.exe 5552 StartMenuExperienceHost.exe 5920 SearchApp.exe 444 StartMenuExperienceHost.exe 4696 SearchApp.exe 5204 StartMenuExperienceHost.exe 5560 SearchApp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4736 wrote to memory of 2012 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 83 PID 4736 wrote to memory of 2012 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 83 PID 4736 wrote to memory of 2012 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 83 PID 4736 wrote to memory of 2012 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 83 PID 4736 wrote to memory of 2012 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 83 PID 4736 wrote to memory of 2012 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 83 PID 4736 wrote to memory of 2012 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 83 PID 4736 wrote to memory of 2012 4736 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 83 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 PID 2012 wrote to memory of 3444 2012 JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe 56 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2.exe3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Windows\SysWOW64\rundl32.exe"C:\Windows\system32\rundl32.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3824 -
C:\Windows\SysWOW64\rundl32.exeC:\Windows\SysWOW64\rundl32.exe6⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2020 -
C:\Windows\SysWOW64\rundl32.exe"C:\Windows\SysWOW64\rundl32.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4180 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 9688⤵
- Program crash
PID:2376
-
-
-
-
-
-
C:\Windows\SysWOW64\rundl32.exe"C:\Windows\system32\rundl32.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Windows\SysWOW64\rundl32.exeC:\Windows\SysWOW64\rundl32.exe5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4024 -
C:\Users\Admin\AppData\Roaming\system32\rundl32.exe"C:\Users\Admin\AppData\Roaming\system32\rundl32.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4540 -
C:\Users\Admin\AppData\Roaming\system32\rundl32.exeC:\Users\Admin\AppData\Roaming\system32\rundl32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4384 -
C:\Users\Admin\AppData\Roaming\system32\rundl32.exe"C:\Users\Admin\AppData\Roaming\system32\rundl32.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:116 -
C:\Windows\SysWOW64\rundl32.exe"C:\Windows\SysWOW64\rundl32.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3128 -
C:\Windows\SysWOW64\rundl32.exeC:\Windows\SysWOW64\rundl32.exe10⤵
- Executes dropped EXE
PID:4744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 53211⤵
- Program crash
PID:3372
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2064 -
C:\Users\Admin\AppData\Roaming\system32\rundl32.exe"C:\Users\Admin\AppData\Roaming\system32\rundl32.exe" Restart2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2780 -
C:\Users\Admin\AppData\Roaming\system32\rundl32.exeC:\Users\Admin\AppData\Roaming\system32\rundl32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1280 -
C:\Users\Admin\AppData\Roaming\system32\rundl32.exe"C:\Users\Admin\AppData\Roaming\system32\rundl32.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 9525⤵
- Program crash
PID:2816
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2752 -ip 27521⤵PID:3816
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4180 -ip 41801⤵PID:4456
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4744 -ip 47441⤵PID:4392
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4204
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:3540
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1320
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:824
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:6040
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5552
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5920
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5320
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:444
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4696
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5960
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5204
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5560
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3316
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3792
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5188
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6024
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5988
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5600
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4436
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6016
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3616
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6040
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4924
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3112
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4216
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5828
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5460
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3888
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5620
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4260
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1792
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5756
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2820
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4256
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5256
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3328
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4420
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5068
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:884
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5136
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5792
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5820
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5168
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5644
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1468
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5808
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5948
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5688
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2464
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4048
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4820
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5768
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2608
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5528
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3976
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2596
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5708
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5752
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5508
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2908
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6112
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5172
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5660
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2212
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1704
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6068
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5932
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5780
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3028
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5996
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:596
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4204
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3620
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2656
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4932
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1876
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5704
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:972
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Filesize471B
MD520e64b00088a9559c728a14e4531ffa3
SHA1c9d7ab909a2ffb7dc79ae5090895b861c0de3196
SHA2568432920aae7dd6cdc1a0faf4aae7cffc8042da0df9b634e06ab8c0651921630d
SHA512c50b86cb7aa4198424e9420e18e511a8cec1de1b4380efa0dd6e147cb60b2fe59b5698ea27374a213d1ecbe579982b0ef7d53d121f370df874d073f4e71704b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Filesize412B
MD546f98129cacd6b7bc9b12ea122b7284d
SHA1185ee8a357c317387cc5f27266bfc680b8a13377
SHA2562b462e806b3b963bd37ca4b1962e490d1e9f7b5938e5e3cb485c61a610be2bfb
SHA5127b6dc4c8227194b5cd1b6a49291a66be76602c9a0716e8523f12a17a49b97a71c8144f43fa1581bcf3061f63e56b4ffedad2f9d0ba43bd98c61a59714f314109
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
Filesize2KB
MD5bfc6518d16dc09b98eef57e863a84286
SHA1cfeee75936f8802f248001d424b7604e2dbf3e57
SHA25610625407954861ab2610ffa4ada2c09609f24d81a8925a585b0ecca8b7877992
SHA5129607a61d59d52f9964a1004a1cacd04b4404b5e08bd69ce758413786f4c1ca9ed33ca6875a54d4370c7659eb48de81b7a0f7f1747b2772f8b8a1b2947aa473f0
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
Filesize36KB
MD50e2a09c8b94747fa78ec836b5711c0c0
SHA192495421ad887f27f53784c470884802797025ad
SHA2560c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36
SHA51261530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
Filesize36KB
MD5ab0262f72142aab53d5402e6d0cb5d24
SHA1eaf95bb31ae1d4c0010f50e789bdc8b8e3116116
SHA25620a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb
SHA512bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2CFNWDLC\microsoft.windows[1].xml
Filesize97B
MD5539db492f33fccee9be530dd0bf34a46
SHA1650b2a3583d6c9499b4ed73e9a5dca37f342a50e
SHA256f6d425aad05b46e77b53e5737c85f4ceab6531e773ea87eb985754be5ec19999
SHA5129328f2fa286b4a9ca6ae57ddd9fca0b1140e5f68a5e143fd8ae6ea212a1af5d7b6b2289c324fa9480ca8d2e6d3b0cf7115611a56a3a161c5ad2f988f6ae62a0a
-
Filesize
8B
MD51f33c2a63865ad91f74dc9cf3b45c617
SHA1ae2e751055e95486bde8b32ea81072484e512cff
SHA256b8a9646ed5bec50963e817db3154eb6eaa10e411817c7514c3a026bea3b257a6
SHA5124483658df49c98aa8cea14700f4af80b7c1973f48abbc9a14c96d8453061b9f1a76385e0a75f4d9d0d03e650c753d37ff33f84c874b7a4710949f8a01ecb8ec1
-
Filesize
229KB
MD51bb8acfda2f2692de5717d94d0062bc8
SHA16e34e46f8b21b3b65737b4b8dea9786e672e8728
SHA256036bfdbf68ea9b6d3b3d7c3e0d5d1702e918db7c19ac733b5afbffb724a4d01c
SHA512827a68f98b4b14bc04e3c0585be237ed17cfbe3b1a4483bfb8aae3acb62dbce23dc4858ba7294ba51c349f6e34a5831e88c6bf2a1bc217a47b077db48c3c6cf9
-
Filesize
229KB
MD555bcc241d243d69c5d568579fbfa94e8
SHA15ba3933235388ed2c221abe54f1613183611b2c4
SHA2564e4266d5823ded6aa8a4cde35efd6cb3138bc3dc7f9d78fa75ebc31e15e09a21
SHA512d4105a0b426074967890341f5176ecda7dee73b7a05a8b2801928a6a4cbadbd06b966a96264836f68aaddb103334686ab42cf3cf174a3a1efdbbfa8113d10551
-
Filesize
229KB
MD5f3273602406d16d6b2f40bf5d6de1cc5
SHA1b1abe4f846e4451b5b6c81de1bcafe313f72cc82
SHA256e8fe46aa7c08ff77d60f910ffd07dfc3849a13802a5d15cad32a83643445db27
SHA512468207d4eed98d9be53fc6e1e3c560eeb994fa62e3d0093dcbd9d889fc48f11902009b2a7593c2c30c848b9c9bda1842107c8dac6379fcb2bb8cfe68466f840a
-
Filesize
8B
MD5603804a63d941dd9b7d6cef0a4510ccf
SHA1a6ce087a3443bd974a4e1ce2573d64c9f6180d13
SHA2560a9421bf2655dfbf454adde5888d4125258e7893ea18889ed0f742a3b95e1d5f
SHA512272c25b04b46f17c04026fdae85d82b19f11008b3649df12bfe56d42e2000be06d74d380b71e7d9102a897b75b0ae5d55fa50673f99ca57494c15794366d7a10
-
Filesize
8B
MD554bf01b732d22b42c327d96a7cb38b02
SHA1523974b8c80dd5869b1a37ee8b495b957eb476be
SHA256cbca2bfdb2d2f6207714991f35714c2adc8a259cb76750360a0bf8a942715b47
SHA512aab93eeee3b492cd7f47880b0a3ec1c2e2cdd93725b0d86ee362ab485e94b536548568f3ad555377e7582c49c6feae5a476247b483ac1328e2ca97e0df35a6cc
-
Filesize
8B
MD5007cde42db59c543679c3a2010b236f9
SHA1149268cb00d792abba7ec1878acd924d77707a19
SHA2567b252ed656e708505d79f952fb11fa21fe4a32399d82f0291532f70b692cf91a
SHA512223cd9294c04370edfb40a9b0c4fd7f360be777db4bea75592d9a60dc4e27659fb408e50a0705afb735605983b846e3c439a30ebbb0b5b79232793426366a9b8
-
Filesize
8B
MD505f12272b9f259e34059baac9fc2afc1
SHA15e900388012b4912f8c76ff0ba6de57a3639022a
SHA2568d291e82ce6e4d548a166e42d58cb739bc243dcba6fb815aa0cd9ad2e33b4273
SHA512e610974bc57fd43a880a807a23c1f770ab3294ed453137438c3586f3253c4fbd5d04aef085b5c875a75185c33d45d733bc3475e61ed667e35c09b7f138f725fd
-
Filesize
8B
MD54b9e76e826babbec8c283afe211a373c
SHA16226e917c3d9795d42152048d3353c1c32feee50
SHA25615f691753b1a31b05c36f1925a6586516e8b1dfdeb2cf858765ded8bd66a871e
SHA512ad59effaaf69e6103aa0dafb8410d26239a077ea1a707c58c58737a89a36e18ee1c7b55b5098dc7443ad51985e42daa9117d417c70bda3c521722b909a1402dd
-
Filesize
8B
MD507e22c94c7b0b2100654cc353e651753
SHA1c3282f0ea2cbc7e3b825c1140993cfdae2da5aff
SHA2567883e58350e85c2260550300b6615a52372df14ff46662f53d90c6571a7b6986
SHA5125aaf077a002e6b8409ce05d6bcfc5e744459c909a74f6e616ab70a6e081d0eaaa414ea6e5012e86aa200b1f1a901194142c2e343ee89bb4e34a969764be4b946
-
Filesize
8B
MD5ba55078afed6594d16427898e4cb9a3a
SHA1b5e911735cfdec265602df06d674e5e9d7e630f6
SHA2560aa383b01268ee95301e430d72b97fb5053d4fecf44e45a6ee755aa1a1821e96
SHA512cee8bee926410f1b14e5303da1a5eb91d01aad2e9efd295b5024637090c1081834b19996ab0d6269b2e729b1330af5eac6dad4605d755cb4bb38ee56d7d86867
-
Filesize
8B
MD54b4e88381109f2f6e095015ac9150f4b
SHA1415284b96c6e84c703995b12082448b53c8405fa
SHA25628a9ec709be8001fe97961c0ed0e565fa382d9bc94f4b60ea9798fe15a0cb034
SHA5123d43c43bcf299400eb4b6fa377f70e2e4e0578184783e82066728cb85b75408bcf2bf72747a89a99cc288acf0a9219f607201afc692bed53ea0e71970c7ceecc
-
Filesize
8B
MD5ed13c130ecad3083b55c1527493d2771
SHA167296974ba7f36407b383f5af95da9cd432c75eb
SHA2561fc53f5d73aeccac7396f1ae5244912665699c9ca4c411bd3699c48ef3e14773
SHA51210bce986d758d14cb69571df50091a14de1d1a641d440d2fdcd14850c012d6a43efa723f92fd1da1527cf512dd96362bd5b69b4c45a3788f4a6ddbfa15d4913d
-
Filesize
8B
MD5c8ff584eac3d955c6cffb52d18b2a4eb
SHA1c84e1864c843bf417bd8d3c3c0b7c4815db7eb39
SHA25661a3692da619083f87d90a6fcebda48997234d9fff3aec75139600861799cbdc
SHA512996266b7612b593e07e4a3374c9dc95f1ce5ef77e5e64419bbb0c496dd11f78ee4fba08acea165201164624c073ae2e457d926254b8ce0a989dea6cb78d7523f
-
Filesize
8B
MD5515fa254919f1700315d3dac12352587
SHA1f5f33f2b2b5e620b5e06da43a3e5b2bc5d4a56e1
SHA25689596dcdf39925b86d88657ed2021b7246fa196142334d4de35a78bfdeb35a6e
SHA512fa9d1261255f72e0d2e418e2eab4da8f63194e78fbda87eedec301d2892ff917f1164a31ad5460626804a9c0124b3a7705a6fe0edc040374dd0d6a77465e42c7
-
Filesize
8B
MD5eaf2c50348a7288997f3467de8fa8dfe
SHA1b43af3e36372bf36242845779559960cf0bc493f
SHA2564e061107f2d2557546e3b3073d9bb7c8bca91db7d0950f12474182eb89b128a4
SHA512f753e6ab21ea3cb01e14463ee4449037984491bdee330ff8ded318bdf052c523da68a175eee4b0298707ae94016bc9506a0cc3e77bf1ed99b5fe69765a6d33f4
-
Filesize
8B
MD50cc625571472a327e37dd2339961a3e6
SHA15df9c442c068fa4e614a53c9c955dfb47ccf44e8
SHA2567991e9950c64f2071c8c717f6b39ba68034566f204e50af6b8dc0eaab8b869ca
SHA5125348fbb4d5eefbd1d1b9ce16217deb5c729ce6db8a2d98d3dc275d524cfb619f54f3c395db6e85c47c3b09f4215b06cfe2848714b6bfc361c4e688d907d943f4
-
Filesize
8B
MD5956568540d0afa366150753d3fcbc276
SHA130527d17edf603b2ec4a76f4720aad790fb2c244
SHA256b22c4852635ae7f2e044085fa295b2474503d0b07de71491350ccfcda6216bf5
SHA51252c4a6edface07866b43ff68244682684f5cfaf1438f87e70c72a1a529a963829adb273a96717774c1e3f5f4a5f0787aa78c5db3e86286e8de0684dfe2c55bd5
-
Filesize
8B
MD567acf2bb43ab07d6b0f8f78710dbc662
SHA18c7ca1ac96b17278e0e66808d7ef866866cefca5
SHA25656cae1de98989beaaee41e6925e2d1208776b74e4c196723179e8f26d9216506
SHA512a5db21638c7230fca9f0922c901bad9ec10beb9d8918d68f511bfd7ce7ade3b4d5d48a5c9d135c95cefb00ebcf86c0bfd3ce33db409fe7bafe23169f4d115b45
-
Filesize
8B
MD537ba71a3a7734351a44a9425e9c0f595
SHA17df577cf0a2ecc7025c043b1c968ef2eaa714e98
SHA25684dddc6ae8196848ab363e26384c667c37254c55366f6c975f8a86c10946c1cb
SHA512ed2234fb8929e0eb56a3214c8c4966cc404e7ba1411da2d1efddcfa90d76d332ac0d12414b9eaf401e9e2e964320b1832aca07dd827ea071059b4ff954b3e803
-
Filesize
8B
MD548c3cf03d8c0c4634d8a180fddcf60ba
SHA13ee9c5f4691bf5bfd5324d011eca3b59f0fb04b0
SHA256fe7a995a588130a3345078871ccaf8e249dc4103fcf2ea7bc7b81cf146bc3df5
SHA512bd7782e4ab98b87767161236a8042f0f2500cd201b158ad3592dc244dc54f683350873d1ba630546d4a1c463d5df6e658f3d08d1e88cde0add5cb8a9e7d99e1c
-
Filesize
8B
MD57ec0e49de982f81598f4159aa0646152
SHA1c1bd34ceb1894b7488d8861d33bb437ec0b438ee
SHA25609c0d5d970465e3a9dd7dcc88eca1bac2b943dccb60999e3a88f54ed144aa918
SHA5123cdf219dfdb4eef7eada917eea2f2472edc3365e7a71d45cb6a0401d2132090b7560b962c82a39e5f3f79963aab1514e267c2f115333a9252291ca64f5d843f4
-
Filesize
8B
MD5375e38d97fd890499a87b0b3b18f6d69
SHA1fa96ccae3640b421958dc21174bd068bc689a832
SHA2568aa503fb1f46ce9ce96deaa9d3c26b7cac6593e1b77b260e490e0005f47ca2ea
SHA51229e43f9ecdd25c9c401abc56cf7c72a85aefce10957e2b7dc3187f8df378f4f8ac63991674d979da01ec7afcf12df390121c12591a8f0a3973be7527a7ecb877
-
Filesize
8B
MD56d351bfdcf516d81b497a68c194b04df
SHA1fa5e90273b95742e309f65a0b41a4239e319a5e2
SHA256a21b15b22976b4d25f1b54b2d953de5e53b9604580d98a14d9384ba1949287c4
SHA512c8d1ab26a1b42ccdcaa37773d187ed61c269139b94aa5b6c0811958eb7f08708f25ceed3825cb47e76ddbfa43184773867e2e89a52569ec5751c071a2e130461
-
Filesize
8B
MD5ffe0b01bb44e866d7e6f129754eb87ca
SHA11879aa363f40b934cab996cf1bffdc9a28fec0eb
SHA256396c74a5f52d57940143621b0ddaca393d9e7f203c37c985e82b7789946e2176
SHA5126e148ac1760e9eee31c6c3e40d1ce80cc3cff6b60a3fcc1800c331c39de84341b066f7e8a87c8716d080719a8d02ab24a866e57a229344fd5c9bf2f9a1729d00
-
Filesize
8B
MD5dcf5b111d88c7057ee5356d85beedebc
SHA1240a5f83dc11704c13d67470dc1b7af14d26cc6c
SHA2564efdbc90f013549c0012ef99fd872e13afe825d73ec72a28090089b194237dd2
SHA5127ed88f7dafe1b4e37e08b271d87b5258fd66434cee00208c294875ea84828417d5f8eeff867c8e215252fec0a8e95950bc93d8b529aa780c7eb1fdd3d7483394
-
Filesize
8B
MD55b408bc70e6f369b82e4fce828cfc562
SHA1b4d85108fb8c8a60d1c158cbea2787d7dd5cd8d3
SHA2563f7b3835e7978aacbfbdff52ecfff10fd389244abaf8ea80abb696d563c18992
SHA5126f7848fff4e4df471618fb7f1b28c502c8521f6f18c50f8532eaaed020538b5322146c6e42bd1be3c94779211ef009a272f6409740689403e22550ffa2568e13
-
Filesize
8B
MD5116dd56a1c6d975d51358ad056cd664f
SHA1f068aee91cd4660a03cb4421ccfec99552199d30
SHA256afe421ce8feb86d636ac653f7268e6ef3d82d453bb772346a84249676cfbaf3f
SHA512928e0817bfc2d05b8bf9604c47207afc6ae152bec08e3a086c3cc5d12ce34aeaca39d6920320f4e8628cf4a08dd82658d03a8ecdd58ce9559f06522454fae9d6
-
Filesize
8B
MD56bb29da2a4f6e0a040d20c89930e7be2
SHA1566dd7a4638cf5bb6f9045cc73753ec638235c4e
SHA256c36f6464376da9838511ca3b9c5cd05241baac88e78d155afbff4cd1a6262d59
SHA512392746932d803132f38ac6236259df881a8f75e6c77e3571569bcbcd583092ce3cbb1e701824b7a10521dba437884752a8d54c66a1fa85df59a63bf3b467f553
-
Filesize
8B
MD595ba8df04c3a6e8a54d7b634f223ee7e
SHA13bf716e2e7882aa6bcf7c83bea7de952176665cb
SHA25651af757853186edbeba0b0be9a90fcc4154b6dd5fbf64d3d19d5f172a3872e10
SHA51209d5787a1f4453be832f05b6a8e24f4c03fc8049e9b2df60e725d22208e937876be898e17fce8c4ab2edbc7cfbbda9049ca56009fb529996f9f6c0836e0faeb6
-
Filesize
8B
MD5b2d7d22b9d9d49a6f00073d4e1a3ae67
SHA1ad79aae7ba26d286899153d0d22d00d9ce0fdd9d
SHA25642230953426c08fa255fa4ce275279660e14e88233593e6214e6785e18e736ee
SHA51284bf5ce40b4bea28e1832311b6a911c7c6cefc512005776da83b06cd7d3230ab30c65fcfedf2440c41ed6413cab7b528c8856127550e5c30b7cb8061abb01a9a
-
Filesize
8B
MD5287ad53ee46713928b1dc3cac247e290
SHA13aca916f119f657a487d634e59ef5bf309eaffe7
SHA256cf0b4000188a958cc2b12f6f839c94e699d1756322056101c7f17d27910a4305
SHA51293182faeadad7fbf43d31b447b50ab6e93c5d00624c1aaeafa389be7cfb9d0795861666b18b329df71a427632d3a3f46b9bb70c1dbae6b206dd17d90b45f9bed
-
Filesize
8B
MD56d4caeb8ec82a77e7deec3a2fd1167f0
SHA175703ff567bd0e86616a1afd0abf09e6044d61bd
SHA25644563566f49bf77d2061e22c50d85c580461f6d2468fbdff94de2e6d97748b20
SHA5120f154e060777581ea6bf4abc866f40ebaf23fd04e159185b50be865c22e5ae673acf3e5f6e9045fe09aa63e5eed92194722721063136daaf8d29555897d1d13b
-
Filesize
8B
MD55278334b6c39ffa0e83f1f68419a181d
SHA17160804951553a173c90bd9ca85c61810025bfc2
SHA256f05f7b56a9ce77bd48dc74c187267723b51c011f13f6c9b559b6578087933b53
SHA512c8aae0d7b9cc98bed9fa9ba221d0108561a8393d66c23377010a1a54d4de05006bb6ea36dd9617306b928c8d39850543220283d87061d60e19eb0d388e0d82f2
-
Filesize
8B
MD51d1911e56cc17f99f13ffbe5a62db207
SHA1d9178f62689b2038b59d2c2b8fe09ba920afed30
SHA2563625aafbc40215565fd2a507280b042a02b26e8c08f744145001afadf4e8b27b
SHA512b949b5c4afd6fd9bd92bab185678bc6a398af00ea287a0eb30513e00816db273aecc7ca07ef70970eb50d2604d3b009537c932ace059822a5f1bafe96a04297b
-
Filesize
8B
MD511478500dd9cd22e9baf71980a6c0a1a
SHA18284afd2d4a650f94eb374c9252b2a192d707242
SHA256157bad26100014669ae3f4166fabe76a30e09114330d2ada90a0ad5e97b2cc61
SHA5124d0258c6bd58416c077cae2695c344768e3987d52849066e0264b6909ee530a616ac1b411fc0c1601d81a15103ed27ca725a5357c0dba2dd5a60d38bd626991d
-
Filesize
8B
MD50a8f6e87c600bbed4e4eb3a294eb68fb
SHA12a61017c3c931aec3741df6265479a872b2ed0a4
SHA25636bd27972134c59ee1b6b2ec8d8127c92845a9ee52fdcc8b6c28e7cacb4c7706
SHA512a30ea58e2eb58785b6f6ef8ab76c2afbfd99f1845e803f6b4cd9b0f6a74c69a0b754e4b94c113cbcd952d9e7627fada424f8a29b7a3f435ba9a84e001b5a34d1
-
Filesize
8B
MD51b48a2b6cf4ba07cfecfdefbdf62b080
SHA1929a6c635d895fa3c5bdb142b0931793b687a4e5
SHA2568aa4fa4a48f576b2cfb274560f56578d4a23dbc05996e3a02044ef34c0bcc9f1
SHA5121aeac47c67de796d8b0dca21b1aba24d6c9a9f7a8b56c65d4cbe2df9a7e885e667ce3d075370debd9bf6ad465f3c0ad274924cec21665b44395f071ba8333ed1
-
Filesize
8B
MD561b7990a7a0171f76649dbb3d29501a9
SHA11ebe5d3bf402176e999f7ca63e30684d2b46b095
SHA256c1ce1aec0a754089e85734b501bc7185bfad95a167aa92f803a73b6234ba249b
SHA51234f1f2a3af78058b6675a30d49afad29e4e9233a12731053ebe78cd283687350b9280c1d0c5c190fa25894fbff66b4a7a77054d4abb5824f1d93ae65bf3cde02
-
Filesize
8B
MD5d4d5ebc3aaa0cd644e099dda62e2a5b3
SHA1418f29293ddcf24c5f68d95efedb1a21476f5f2f
SHA256198c09ce86df7fc9ecbcdc20a7c315283773ba9927f07b445e1c9f07eb76b2b5
SHA5123bb54712d6b840c6b47ba5941bd0d99accfedd18a88c6150c33302b102c2641483b737be98097ff2923d16bc75e07c3f32652a26ec8afbe71745355c0f91a696
-
Filesize
8B
MD5634024029c240b93f4bf1291770842d6
SHA1913c073b3487b810e63700789dcc9c8d8740d8ff
SHA256dec1451befb11604c7b2510c65937842f9682380de8b99cd144f238b9bb72f2c
SHA5128c7e051ab2036f45514742e59993846a26710e48cf933f6cb23a9928d011135ebc1b18d3800b1f63465968f7ddaf4e658afd3b6ee6ef1f73aa1b1de72ca3b7e1
-
Filesize
8B
MD51c3e0968da2d87c6cc7add73c14de9b6
SHA1e30733d2861bb9dac89583146daf0e045d320737
SHA256a21df363a8b797e769a9ce9cb66a52c24bb350b1dd9afe0ff714a62945c4f0fb
SHA512ceb1790467237d2b35e6c261672a99e7fb519c899ccb82b9c2c0860ea35b293de86444f542634d53cd2969f3e9759aed35c7bbb1d7a33a9a47e559d7d95eb428
-
Filesize
8B
MD5ec6a8d40740a925f23b32b15137c5416
SHA19369aeb7a2443381f453b46241c2a9c14f1d4754
SHA256275ff4693cb3d231b02bcec413397969a555678d81ece09c84f24379de24b7e0
SHA512b6e26129c8b3a037f7698055a67b400e0d9b1af15696612879efc16c1bc6ad0c04c44a550d1294064a47b3603797cf3827728ad8565215f03f79763fa300f393
-
Filesize
8B
MD507eaf3dec654e342c68fba119f5fe966
SHA1d642bd9a8de334e0af73c4983b0b84bae4d301bf
SHA25687cb8e4a17a1f1e4b7dacf046d85a4cd95f6dcbd905a8be0a3f98c96a425bdc6
SHA512dfea7e37b642e46e15d6ddb5de060b9e03a03f4e3bb520540738633431c642f30798239890559d6de6857009bc4f7d73423dcd89df64c1ee5c15e9aefd02c729
-
Filesize
8B
MD55906d57cfa90a9146fb7df641053f3ac
SHA13f7f3a474ba7de744d60b8573fde38612a5d5fb3
SHA25674fd002cb37cb5143332a3c2279e674ddad2dfce48d767282f21559f61380ec0
SHA512671b0922492848794a6bd208d370892f189c5db12d3b2ff2d7ecee4c21208f0349e71ba2613c340bff3eb54e6fa33d506f577e0c5421ea23b98bc9946f434b62
-
Filesize
8B
MD54322bfd02cf29031388a98d5b969660b
SHA195a62cfcee0a5934cb1c84dc00165f1c5e74abca
SHA256575f7e3c9a494b6dd68143512b5ab688a09c3f59e44029dd04a860070d05e0aa
SHA5121e91f3935f0a47571a513e38910eb8cd0dda5f3e7e3c43cef7b5a46efda7b0e4672d8cf7320689181ca7e67270a8e6a0266de28aa3e205229be6f4dc55ce8ae5
-
Filesize
8B
MD5860c29a102e6d95e3ee8186b52f4172c
SHA1ddf7b26c0695fd6e083348b04896a1519dbe68c6
SHA256baf3bd1328e571d542443cd8042f0acabe122321e72207f4c42f7c138a0707ce
SHA512c9d35f307cb808b0ccf17410e7d8bd519f47196d6a801a56174c157e2124f0f1bc5135215726a53e5350b2884d5ada801e310b80b76ef03734f0ea5574dcbb8f
-
Filesize
8B
MD56967d64d6e4ba2f98fc1a929ca58f4f9
SHA150cd9174c5888ba0443bffbc6d9c6de01963c2ec
SHA2563ab91981e0eb31b76915f5f350f332461037e06250397583c220053f9b94b511
SHA51213441429ab4b5cadcac04044d5d4912c0e8ba8216c2332359a6090dc5709169880c56456be24c8c02134b1a6e92bfa849b0bf26315079d04dfe0d745298ec1f2
-
Filesize
8B
MD5181961cbe1fcf18a083fbbcd58955bf7
SHA10c818e71d9903753d83e7fc68fd548270373790a
SHA2566ce321c56c51d21bddcfe05c88bd2d6f3f79479462169c4c6c027f559192745d
SHA51266b721a6b893a637486d8320a8592dd188b7054963b9d65d98c17f2cec6cc278febc71aa81201729a5ee4b54815d359addba019e3ce8403a7921dee1902fe919
-
Filesize
8B
MD570590cf0928eb81e6a768ee476e1981c
SHA1925dfd3af3a1792d2efabd64e56fd9d17331890b
SHA2569bd22806a9015bb0854f7f59a141a1956980a8a0469f3f44a40513202be1190e
SHA512648c7f1f21fe0b97b2a01b7b011e1b7ffc763e8b6625521afd5ba517cc9d57bd405c055832afb88181365165e41bedbb7584c6007a9abd7f7e1782dc53acb44e
-
Filesize
8B
MD5779bfb3d785173c196a4b2c6b134c939
SHA161cb7fa928181cc41cf1d706efd1a9726d63f503
SHA256065224c36c60b093a6f8b945cbf96286a1060e51088dd01489acd7f71cd689a0
SHA512d77adc7bb4f1574da60bf8de48cde19182031c4784ad762559346189506ad99bc3a5ac56fe933401f98ae4b91f323fb95bfd7b56596bdc227117ae9322b2eda3
-
Filesize
8B
MD58d5ca8aad5471e55d57193dc788344d1
SHA1b85c801f13aafab729cba744f92718091bf86adc
SHA2560115c8b6625ef6404a5980c4851c34c88c20ab6a2a423fc21f8c5d91c8dc52a2
SHA5128e8ef92df79f9728987019f90bcdcf8a04b0bc823de244edfcd3c438912e736c281fee296aab4446847e74c8a96b61f62a091ee918c77f13392edcb987208604
-
Filesize
8B
MD5119d768e38201471172c12331946eb97
SHA13e72c494b6da3524cea0310085f1f4a440e6f92a
SHA256559d5f46ad0c74a756623b6ccd4bbc5e6c50aebe1ce70f55d8c2cb9e26cee450
SHA51250def4fe84eb29d68fdec57e9be0d4d6e419ec5ef5b353e214ef1eb8c3060f918c779ae637891234406dc82d22bcf120102dfe47d5cb775c22db0cf5d26a0b6d
-
Filesize
8B
MD533d9667ab6ed62ec44bf2587ee2cee62
SHA10d8e2ac289781c78aead5c91684f8b87033a30fe
SHA256c1459906ee4477421b2c6e6c48e5e4fd0f6df4e5046721f06283c4baa8296a55
SHA512b5f93d4a61efdb1bad1b343c67678a39398990d0724c5dbe1f222be8862e6948a2d11b23d1a9610b9dc3e5a45fd67704b8d0c9cdc37b08d8c5b137103c5fb1ed
-
Filesize
8B
MD5829caf19da30c4cc62911ebaeb43b66b
SHA1e0bbedbea0c41269e7234c162d068eea90c65960
SHA2565c4598d0c0bf3d96e6c87dc623bf8fc9c59d0e275b10f234f839cfa5d71b0b1d
SHA51212be651877ebe70ab5beb567f5213f00736722848321ab6bde28764221557a8507288109646fee87a0225f5e2ea27c6d2388eb135dce00013ea1ec024741593b
-
Filesize
8B
MD552e2cc0c625532ffe785c987d54f30e9
SHA13f8db3879e45a89796cdba559db7bc3e05824de6
SHA25644701526d2fb9be3501698b653389307e47149d8fbad409c288413482c1420bb
SHA5129dcc07df6d11da769e476812f0c8bdacf43bf47cdb4d5e50bcee50fc726da585f991c91fe3d974a147f4bcd970d5f92626276f9ef23bb808d7bcc2153772f853
-
Filesize
8B
MD52908c6afaca3ddd0df908840e9a9d4e1
SHA19ec1cf04d1c9e0dbaed9ed4f0b96131f886f45f2
SHA256f159e4256a4871a823c607a0c28ea79234fdf8216a00b202d6b8a7e3bd02675f
SHA512868b70ab8bb6e2fd0857dac1dcf8bc5bf86f47f81a0400b9c51e69e1c5575aa9c41bb15a313608f185abfefdb184760d5215107464e1e7a2cb1210a7f893b44a
-
Filesize
8B
MD574e49af531c1036334d067c636ab073b
SHA18df0f9bd94ad872d4b74df2c855959b4055f2c4d
SHA256e03c7982620f40886d9ec418128d26bda69e3f4ee6447acac632d0ad961379e7
SHA512c48bf0520fd2d23a8ea6d570d5008123bf6e811ebc10ae617d509b12bf84eba0e4dcf1c0e344c0e7bedd031a845a63504e657eed84b1418c772378fa4b5e6166
-
Filesize
8B
MD5f94c607c8988db9cd078b6db5b2d1b81
SHA1df581b338f5dd18ea3a5788a69b600e8e97dc16f
SHA2568a1c26e72ee69cfb1fd4d57ff8f9bfce9aa73369740a8e2667b0a284735717c6
SHA512d4fb827898d808d015e53db22e099bf3f568d1917546e54fdc9dff039bd18dafa9e6d303cceea6e82197266a5134367bc6f88e35435e1dcd52ab5cc3682142f1
-
Filesize
8B
MD58720ab4ed352ffd5149699377f7738e6
SHA1aaf48b8d0c2f0d81a02f9044d3bca9aa406b6942
SHA2568eb02e4cb28aa56bd82568084068ca66052c541740deda7dd660408b74c695b1
SHA5126d1de48191558f44cc8434cde8b440cd87cecdee4d587df72dbdc5f5d56bd9fcaa18c8cda547caa66dc456a6da95e6ef7e42d9a3a436bf7a5660fe29b2ba6951
-
Filesize
8B
MD563470d95be639549c16ee0cdb928e78e
SHA140e22396532ec2327eb22a89f866c524a22be240
SHA2562ba6745e86bbf86ce9628d5c7dde4f364f499f1ac0294a878fef96ee133ccdf5
SHA51277099ba457eb7f1c7e242f2a4c6ebeabc95f12d554b1011b26c644ee89fddc0ed5c30fe59100112035ff99d4401255ff91ad4e4c48e6dbb5be8b636da8a4261b
-
Filesize
8B
MD5d28274d6a64812f1990c8a75bedc9cda
SHA16c590d5a2df1135d3a17fc9f81d35773e81d56b9
SHA256178702dc8569ac9061dba0cb09c6df31b33826d6086f5cb238c7c790f9c5ce4c
SHA51216e2a617644e77b8c26ae2437e0988dbdc39b0886affd26cd125efae1121ad2d864df133761d083450a1f1f62ac4b1039c15bb21055b2566b76a5d0f2eb6a6cb
-
Filesize
8B
MD51e387ffadaadb62cd2afb870ffc6b85d
SHA121599156f6aaee7a2c69696c0c1479c6bf4002d6
SHA256ca0b5e654750019846e578f67ab5eb8da4155759364a3664d6ad80255f4d2cb0
SHA512adf491cd4bd734159829a6ba020b3b35f00975de742acdbcaffe4f2f185ce7b52cc3417be833004895a89bf43a0850d8eb85348b30cb8fa36bfb0a122e1d1b2e
-
Filesize
8B
MD58f0be5dc46ad6ffa90f485ecf69f349a
SHA12de705f1ec8c4a6a3df1d2d7992618b0665465e0
SHA256898aa764fa53c6c5637168222aa8b115de94f5f83f0f55b9de6addf7e0153518
SHA5129f00f4f5dafb3080c69ad2cbd56df5958c2e0653aec5be51daa895a6020e4fd7e79ba5bbed74852ff10892756a006164db0cb03c3b4c7cb7d90c0cd67930cf07
-
Filesize
8B
MD56e2fe5faad0ec90af909152b15432430
SHA17ca3c54bb2009f010bba084d23e14c524d4487fd
SHA2569014e2d3abe3b559fa6a7a6d64a64973ed73d89569bdc852f22b76f7ca1bc2c6
SHA512725a3bdb8313100ec2bff5bb0d370cccb526aa3ffe91401cd375316537418ee63b5595e67a8a89529043dd121f0b7e20f0bcd2cf8a45991687647a7cdf162b5a
-
Filesize
8B
MD5ddafb8558ef6de00edbd2559ff39eef1
SHA1b5224bcfb3a0f7d8f8fff75229b3920fbbe2f478
SHA2562f8d41a89a18ee3226bfa0e7a2dfccd48aa2cb8c47d5a4dad27ac217ca7731aa
SHA5122b2da1635820d46369c31bdeed8f8386edacccef86d19434c36be088b9190af4e833671b46f7eb9180ffeffac816e11a9843778c538f285fee87d266cf1ea5f0
-
Filesize
8B
MD5bb323cfcefc871e63d3047f3f53f1290
SHA14098c3a9af6191d013b4efb9b36d083c35a92374
SHA256f123ca6a516a286f666f708469924e18ef2672aee6474cadc0f587aafb693f47
SHA512d9c97f12a2c803c788910cd18f78a813fafdf212554450006aedad781c701a52f20c02be082089b6d756623d5cae2cd56c2f89ec78ac5b2ef7eb44bd6647da95
-
Filesize
8B
MD5ee05d3eb8d94149b6a5a56260e935b52
SHA13cb7aebbe55f7fe53201ff8260d3b3bf2e4cd8d9
SHA256d03f3eb0302b7152fec200965a8c7ad1c9e12572ad1a39f5a4ed24f1dd20ee99
SHA512fce6ad3d41eb5cb37e5500450c446ea89012b2d6cef294f39100b6d7700b2fca7dc6fdfd82dfe6e05787789ba9b17c961437c4063635412be444ceae9bab810f
-
Filesize
8B
MD5b250ecb0ee081bee202380e83223b3fb
SHA17ce63702a7ecffe2948170aa9c42aade696ea6f7
SHA2568fc7c82b20672598f1029b785695e40985f38774ddaf2f08737b457d9b885335
SHA512d915d51437da238f6aab16db3aa058b4da85176c82caf02341feed741a180d697759ef7a882b9f0a53a0886661580ef3bd982eae93d2b2c7074ac85a16391a4a
-
Filesize
8B
MD598ca4571cea648c02be00467444f07b9
SHA1056c172133b0c61880405152e85882c0eaf80ac6
SHA2566fcc26b0cb10e18959eb52815c4f958986b5757f98dfc831ed090b79c6070138
SHA512acc81cdcb628fef8ddd17ab43b960ec31f13f395616c175ede2c4e3971b6e4b6fe0d0eb778a25b14f6d19293fdfa72dfa43c512099525ac46f78bb53abac3233
-
Filesize
8B
MD55df8fce8ea91272f983ad62ebe72f545
SHA1c0872a58491775bebf436cbbe0eb84a8d5bdb058
SHA25660b8a2a6e9c01acc557c35cf3127189a07ee47871bf52df97392463ba0026d38
SHA51265714dcb88b015d16aa121ed04a540982fcd6c69bac72091ddf375b744049d965f2851cb192a4f9021b3e9f06cce90ff20839622e86574da0eeb96baceb5467b
-
Filesize
8B
MD52b2f06c4dc57e3fa93af20d35a8b9e3e
SHA1eea99899f473570d166ad0f68ed7fa1a851b9b0e
SHA25693c329b07d28bd077b5bfb9c0475d7a33069dc7a0dc94e91cbabdf2b63974d31
SHA512505950d7fd9892c8cddf7b2b28e1f82b1d9090431efc4903c5136198f8858183017d201d9eefaf60808925a24cc610aa94577bc41aa52838ae4a7055db72201f
-
Filesize
8B
MD5f663cc53634d4db54b041af02e9b7bf0
SHA1fae4eb7bc5b3182f77a09905cb9b137e72f300b9
SHA2561adde9bec37f243e961bb06db6b851109ff6a3ebd8cd8370150759960cc8caa2
SHA512ffc277ba416293871cc3ba5f3a366624958dbf0e8a94a2f4374a765281413a12fb0b11381990981a6129a04de9576db97dae27864a195c8399f78fe531f6a7cc
-
Filesize
8B
MD5dceccf97587bf192629f47c9d2dc1389
SHA194a84ff575bbb1147c15ca3943b9b3fa9d6b5e54
SHA256cfb749b4db77052ce8c6d224960abdfe297dcf7afc3bf9614348705941b5934c
SHA512e958392eafa6ab22fd00b61eac0d163ada6e5c1a5a13c55a75977dcc260f86aca291dcbc56751ecab601076941b7acabdfb0d132c5253fe4582afc14f0b5ed02
-
Filesize
8B
MD5658f96713ea39624b2d48ab3cc0426cd
SHA1a62101c999f2f1015eb267292380f38bfae5d8a5
SHA2563f91dd00708d03336dcfb7cdb0875f1a84cab72aa796b4c4b02b213681f07deb
SHA5120a4835d8869245a90686054aab91f03974786b15073703da8037e37c2cd20ceb531d825b0920699dafbdea54283b1896cee79c2bbade28a4374b9e87077501d9
-
Filesize
8B
MD5322378f18cd1cc56d8fb2bf62ee98298
SHA189f16e27564e281701f7ea9307785bf092ca2c9f
SHA256ac87ba51103d251bd055970662e68782da5d173a4631cf84cc4cc436d2eac9f9
SHA5126824f70c4338aec3ab4468eb65363b4814762ea934390bd96b53a895de85f277e3401612bad04735ca9a14d6f607f37758557525c52b0d13c0ca4a13974af5c4
-
Filesize
8B
MD5f45a5b638eff9d4bb02a6f21065534e9
SHA12d144d794dcce72615ce2e150d3dea9f3481287d
SHA256ee291a84ce5f3749cd041fa3d62814fe5e27ce61f04d039339f8bf3772175b3e
SHA5129ec589b90aff6faed04a30a63a936d5a1f84bc42188b537fe41300d25a00245d8c0a29e51a29a0d55c02e2df3f2e5d433af787028a384da2a58e171e9c3e4157
-
Filesize
8B
MD550f8c2e15afef0c35a93cd68a910fa6f
SHA1ae27a81d6cfe897a7010d421d28f82dffef87cce
SHA256c7d3a7b559c004d3c381e83e2307cc27b0dd7097fb56a7097497df264c57ce05
SHA512718af737f6879b2800c3b718b79da4747d07eb901370805e6fe608d2d8a96a46e790c1d43a1eb1e7b19557d6e8b2d8b1c6860aab6cdb48e63cd437257eefec94
-
Filesize
8B
MD5220ca5351ac474ca01945d78b808bc9c
SHA1b71f321fafa3f231021a73736482c0d00ff0157d
SHA2568482c9c702a094e20b8e31071676c2d4656071041c2ed465857db03797f4201a
SHA5128317d9eb819782e1f2753a138fd34ad1fde4ed6447fd73c9e120119e2cf8241d6270963ee97913276b98d19bea86e05cd54ebfd13b06d3bca1b505c6824e9f6f
-
Filesize
8B
MD5024bad54586e8cd0942a10a34f40a8c9
SHA18620e6fb16956ab4088e89a3d91e0ce2e489c133
SHA25627ae73bb2aba4ac4175367cb587403018d2037339e2d617d12b65aa3c7594cb6
SHA512eeccce5e9dafa92d73bd8ea54b64773a0cd1e1155edf455ce9a2e32f011be14bfb12abeb1ad036e83ed9c248b748ed675ae2710beb96094f8a0c511a86034b1f
-
Filesize
8B
MD5a22aee6956f3aafa049db24ff34855dd
SHA132d7ec13113f72966f8982f6806eb27e739d90ac
SHA256e2b8d6c391d9be50b138b78947e7307e659a8827b516a941fbd2801bf8b1de54
SHA51248b5d89e62cc5e3b2c9884ad9f2f7aec9a4268845d0ea9178fe2bea0104d9e66cbb3b5f988ab7987f797b19cf5efe3c92974da84e68d46b1c261e1c8ee018b04
-
Filesize
8B
MD59c853d4fc65c05a75b03efd49c429aa2
SHA1bbd32e9edd22135478b4999322903f06faf84e2c
SHA256deb6ead04d354418340004220a37ace04deb8ac25cef81ce612389276f955f33
SHA5120b39e63e3056176dd2844f6436022e16b227aa690703ecfdd043b890c73fc80eed4d63462e35b0e738f90303243dbc48639a1251d7bf9c43e9d060ca08c9e644
-
Filesize
8B
MD581bc12f0c2da9d332f476f391f6f52a0
SHA10336d72f391523740d993ea9a44354ecce1fb932
SHA256d55bf1e3abf8c53fe4c1d402dcef34b057ffeb43070f801a2be287495f44df32
SHA512ed264bb122e4e088240cd2a25b11fcadd894c33a8a0d49fe86068ad306f40faafa186f9718255e72dee748dd4b982c3998300e1ddb44326065b3c6792a1811f0
-
Filesize
8B
MD5917762c615e124ccfcc2b329d1217ad2
SHA1212cebb7512a4883dae5b54e4c202822518961a6
SHA256986ffb66a7dee28119b5887f80a81af3e37c63391c45cec4ccbd61342212d474
SHA512ca0da84a659c35bd9a7d7216ad40f6970a9be686748ffc0064e1123480af8e09dbcfd48cec787ae98e5dd7c7ab16911051522892c89398d374073861dc5bbb2a
-
Filesize
8B
MD5f8886e120b8c368f588fd81cb529426e
SHA110436b33c622ae369096a022220fe42da471b13a
SHA25646fe8c40fafe132a0d3da9ad4d151138dbf8dde4500910cda91ab07642fd9e95
SHA5122c70b300d70ac3d67e41b6a4cb58eeb4bfbc39433e6eabfe5ec812c5f8d2145d503184026e236d34b7c4a55897b68c34f43ac407b22d5744214ba5c0a5ca00f0
-
Filesize
8B
MD511c8783f2384e7e4cb0276de29179d73
SHA140351081ae1811f4c7a8419e4adb2cb922eba6f6
SHA256b70ad1c30ccc562d721e694c75023f67d34be6ed27b24340cd518fd2bc45cdcc
SHA512fb966e0e643c58aa23e593b3b6a6562de56dc1d6e8c3c5fcf6f169fb1a975bf97712d26db9f4fc6e378cd50a6e51da0b2942d04662a9cd95666b88338d92f93b
-
Filesize
8B
MD54936890e1fd0d837964c5a436afdfd9d
SHA10c262d8b1addc7f4be567bb9ca7c4574c8354de8
SHA2562004b16f605208a642e482fc64a8349994e62719f1d3da1d6b2ee49e6faec526
SHA5126af00877cada822ddd181c8d118848ca5b87492aeded93f6f050eb781175432c0d6f772b1ad8bdcf13d505d4763f907af83a3b3ad0c110f8ac76214b0bf5c0a2
-
Filesize
8B
MD5594fb562af1d890f2464f3735dce33cf
SHA1e3e13fbee2033e085065b79decdd5c6f0216d4fa
SHA2561c030a6055f0d0dd87dcc5830adb532c61cddef55141358478692441ac1f981e
SHA5120b150f0e8b6a49fd1b66a81a14143796b3b1b2d99677266c019ca115db300d69b24c836c4383eccd493b6b5303b1801fc60545b0d0c880aaf1c69d9d0e38374b
-
Filesize
8B
MD536ea2c9396fd14bcca21068dde8f37c8
SHA1601fa20224e5f0976d8bf9828bd2a1f94204b7f4
SHA2567afd01cdbff50121575b11a3ab5e2384455f28e88abcbe73ea1e5d1e6096a9a3
SHA512f56ed747884f8aa9036276695f1ce2a73bfc32cb1afcaa72e896e6abbf5e72fdb97ddb66bb557cf852d949bc97575d24c5620c7633c3b2d9a39f7ad70cc2e313
-
Filesize
8B
MD5a780865be40e9ffa618a8ab6615e09d3
SHA19f1c199842c3430d3ae9bd6c8fdb486478e63cdf
SHA256979723c390b838ead3078e6e31de58944a425443bb1a651cfcf2a776b69bb1b0
SHA512f7c7ca4c4c9bfef859e56de10c70eae25217910c6494578ae50978e190818161ccb86c47d38f6f5d4dba7112c25f189c5f59bb0d0c43b678d46b85eab2af4c4e
-
Filesize
8B
MD57a31139cdc6e2a108ffd4f1dfe18ec46
SHA17a867331027dfb4b7e938692228d271cac7f21b7
SHA256908564e5756d9ce5f53899568f91a67cb4185c0ebaaccdc46280016d65e5a480
SHA512d24a15405d30ad49ec501aabf6546bd918dcf79d9c77e13dcf52760e66587d377e592401d66471033c87b743f4e3247de770978578638d0fa1f7647479d0a484
-
Filesize
8B
MD5a7f6c071abad103f6595237b851c83e7
SHA1c50da3e082c8d8cccaddf065eec81c9e0a4011d1
SHA256e727f9007ba89e52c1246da224e9a8ce9b9f77e006325d2bec4cbec385bf3158
SHA5129f95ad809137f276e501b3c055f818ea1098814486ba6ac2adcbf60722f192ce5a98b21235b59f35968fa3971b0c358684d1853c8b3f91d1c6a005d273846ded
-
Filesize
8B
MD5a1108183fec031076576e1a4795da45f
SHA10955ff1315523c9886cb3e8d150a5a011ab81ee6
SHA25627d6bbad7764ae2f79134b7e7830faf515e7bebe69f5c7158c39649bbed48af4
SHA51208a7fdcc97ff093b20d308a80fa98ea33299c0c63181f888bbb0ed016ad47b6e4714cd90599ac747d5ca28ac4330393cbcf543bc8ff7ecea8a1ee009617d6cd0
-
Filesize
8B
MD54126c03895d91bf59e0a4570b0af1fbb
SHA13e7fe187ba4cc3f04565be839f43ae2225cee0d1
SHA256a899da837fb9c3bf053fc487b50ed94aa6b3673dee07f35750897241b2dd763e
SHA51211c6e0f6c3b1487e09bcb3667dfa5588d6d64e743e969aa5c9f4293dd56178ce9e3a689f825bee1f34c5c1d0a748454696091865e5c0a6fc345f68c7b93d4838
-
Filesize
8B
MD5e5d4d709293750c4ba79f687ffae5e0c
SHA1b6dcd296dda5c96622820fb50d27aade6cd01137
SHA256b8a6828b4e5b119952c0d3c7767aa1f26e10c80623419ad8e0c702fc7e2b867c
SHA5123deffe8f19c3ad85de14018e0e44f897d8e852628df6c1118088362beb54ee025fba98aeff266519d264209d757930b7b027f71627a41e452f63b51b08c5b100
-
Filesize
8B
MD5581078e82a88a72e13e4c4b0d3d0ef88
SHA15834c2c8d46358ee5c3e0cf3e70ffe07b8e070c0
SHA2561dd163384cadb547adb6d5e21580912497138fae7a2ef2f1d7d0fa6becadb07c
SHA51211296e33f447733c1e569790b41a1a00604bfa9d966fa492e78ccd6e1ae423a29ae2ab3fd0b5edb33d1e55f1e66e079c4e98a45d3a40b09fb8f207fb04862eb6
-
Filesize
8B
MD56fae5d7a69cf84fb77341deceb5d6426
SHA1f5995ba73c89df4c71df6887412e4e58a09fcf17
SHA256d0648706108f40fc612da42f50bd836647ed7643a8ad69e90f415a76f5990673
SHA5129e3a1b9efae42e9b0f077e7d393667ce0936e4e7217797a486927d3044c67b606353074772c262b32cdfeab38e7224b3a0eb8f4fd10b1a04195e7e4d04e2d702
-
Filesize
8B
MD5741c1781dcf8d5c4f90c3490ddff9d4a
SHA161bfb52c21ecc5890d729522b78cfdfad6e5a8b1
SHA256c8725d3d876b01cbeb4eb4e68d03e8139b5515d1227a16b149a68d28ae9cf244
SHA512d86c71e32efb527079c27ebc577c533e78686eb4703913ffdd64f49b3e0ee44ea7ee569144a71674b72d9fd745c7a217deba66afbd7da03a28dfe293106cfdd0
-
Filesize
8B
MD5269165cd683782e52c00ea40571d025d
SHA1b2cb8403acbf25bfc72cd6edbdef5357c51cb2c5
SHA2566c5a3bcf8c2ae6db0e70d3773d315b17704a5a3cba1fcd1b728c375ed45724e8
SHA51288b2d01e67cf27d51e87ed1650907bb57976b722de85e03b2ab65bf645bac6ba896d216ecf3217d26c836d1c39c37d3d5ca297b4bc60f370f396beb780ed244e
-
Filesize
8B
MD513f1a2b5922d068e90d13a5d082b7170
SHA1b74139a24d1acafc7e13357a558683a2cbdb4c5e
SHA25614f9612e905589efa83e1b0a8234a347684466af93835c5ead2b99d51a3055f2
SHA5124ee7859eca2a537d23ef6cbd0b72b8ac4dbbc7ce1d829658e6fc3876647e02660850157cd60a10e3ded5e7b038149fd560225679c81977266c1d5c5c9d21045d
-
Filesize
8B
MD5e7a8b3c1a58cef83fb314d992fec3c98
SHA1877c75bd5c67ee233f18700e8c3a5e0b9d3bd7f5
SHA2563f2f5ed0bc6774ce2dc9e5b24f96c012eca16ff5d71947511008c2ab9fb6c5ea
SHA51200e93b69b5d0cfd6843380861bbf21b93c034ea76543e64a0deea300b6330a474b340da53387d092646906cc2bd849bc6e49aa3a7b3adc7b2e873d717af2a268
-
Filesize
8B
MD5098150ad64a3d47e2f9fc2190b211c32
SHA1eefdf6a13b0b748eb71fc137674d67be9f88a8fa
SHA2568f71375819af3d26971d3e474169028d81033f8cc6d381e599d2faf34a7c77ce
SHA512a2f4eb54428338bcc31f7482beeac0b270d86bcfe5976aa10c5ab56ac30196e3e68fa80d0e724b70160301d95bf23cbcc288b9eaec2d1132bb184d71bd0ba5dd
-
Filesize
8B
MD5f86d6897eb152d530acce4d0c15ce6bf
SHA10ecd2c8e00743f44152f078ed701da1e6216f2c6
SHA256ae0f2d6ad4dddb356a17225e607a92beac675daac9f80f4f8f8187a4b3503ac6
SHA5120361f81ff0ab7bb505c6dd47bce3d41b174e167533e68ca128b1ca52a05842b878187bf9654c4d02e0d394b23b0c32d9ef2565b73c4192ecf1f2df78e0e3cde3
-
Filesize
8B
MD5afd44dc17c554ce5e962313f69b3b8f3
SHA174a2ea42ba43ce5e13e1719d700fb268e9b5dd59
SHA256841cc23dff762207ddf4bdffdcb51bd52af97c94023299d14953473661ee3bef
SHA51211f527a7d4cbe1f45ae90e868ed37b08936d89c93f442729e855b70710d58754c0d46d7cac300e94ab6969f3c3e32fb67220b04a95b36684d1665b7315c9426e
-
Filesize
8B
MD5d2fc2ff9fb94662bea755cb203f388ca
SHA1d03779ce8271ea84a1046dc1b959bebd059874a5
SHA256eb7d8815749b74590f556984f430e702a6b89f43c45ae5deff281b9fa4b47e84
SHA5123b006dd51d87c5fe4fd5294c329904bdcac4d701e03ad3acae6bd788297f0610aff8a8f2414307c246489fa13d3289401388967125e6164787ea1b23e760750c
-
Filesize
8B
MD55bf7cf81a0f18c66ff2e3602e48bec3e
SHA19af98277d9a4c8a7a76e1d0f4322fcf4ae17ba51
SHA25650c6ec6d8e94bb240f62c9aaa0994d23946078d6a41c1d4bf35f2bd1abc5cf24
SHA5120c8420042f505cbb6d6e38c2f9e11f57d88df712c938c99fc33ad505d5d87358e5b7f5c4231d4d26ec440392f390adec930c87bf74fa17fcb28534670f7da3ad
-
Filesize
8B
MD5cb6ca98f678d4117d0162bccfcfcbfd3
SHA14e45e888476199271b667dc3dca1d8e9ebae356d
SHA2566fdd133f97329abb8f3ff4d3cadb2d30387f76b487d33490ec866249f6c9bddd
SHA512549f37e848fb8a4c73f124c62666f0683b29d362f5788ba554b8152418e3015a2a26e4ac84c0e2219d231bfe6485fa7a49d33ce9f78d3929245d9030a5fc31a6
-
Filesize
8B
MD5f860d6a731ffa3bfc3652b4b06c2284b
SHA15a70736c62439e4237f640ffd5a6fe16d8323751
SHA256b134d83841ff6a333fc79e54f990895899381e04ca0973697459c829f74d1882
SHA512ddf4e8349d298063c977c1ce531f5ff315cd9b9a832855e8069f0a047f98719bba0e19d91a73924df1eb3f82fb4b41a26ea2b3ab61e5cfcad2d68a12da26cbee
-
Filesize
8B
MD588a08dd4417d9e2228cb9198a21c4c9e
SHA1b0ea15e08b631a5e57e7807a62633a8f6117135f
SHA2565e02b265c677a877b38883a1cc02e73e12abf46e114e5b3e609af74de196677f
SHA512a31e570c3bdada8b3fde2a517602707ce4a917b7749fd07fb731b6770b3b2afe2e7bb87fcdb985c22aae0607f73ebbc3610cf085bde2ed7c66d209abbcc91071
-
Filesize
8B
MD5b72868077db7290a35a00121125ec94a
SHA187579e511b16086f981331c37c20f0686603521d
SHA256178b28b135bed5a6b9d077f0fc57e73ff7999d0c45b3809240aab08acc01bcd7
SHA51246431c870c39ee5e42ee7a4fb98a032f63943a86db8a491feb9b47d6fecfc24db24a7d4542fc0850fd89cd144925f35aba964b7f69b5244976e3e8aa9f4acf9d
-
Filesize
8B
MD5671ec07dd0d69b5e55ba605119b2cf41
SHA1db43ccb9064d14e171eedf9d9168e87f10a0bd03
SHA256c256a3ca157358fd8ee958b721d073fbc74d98d61631600183844196bdbde214
SHA512174fefc6f02f96863b0bd523ef7dd03014504924293db2810fc782f7b1ca08e5183acaad5ffd0ce9860752190a66852e9dc387ded05e5fbfdb08a636c9120bf3
-
Filesize
8B
MD5174979915531d26e9d455556c5f06c88
SHA100f19eb55f722cefd3b1cf58eed92f860c514aec
SHA256bf8771885920c0cb63635b799b5119bc1f67e757842daabde78fc105127cf5a3
SHA512a6d12767855bce1ed6ccd259965dc263c0b3d71ebf0d45fbcd62e6b61299f1a62fd7bfa19d566c55371fa16544be67fe326a35e5d6aece00ac7798e5409a8c0a
-
Filesize
8B
MD5730c34644e7bfa9b14886906c4b6ccb2
SHA15037df0525b8450d422a60c83e88f6fac6e263a0
SHA256c137f564b2d4b77badd04f11aca374decf2a866ac9bde534859e0db07f48835b
SHA512eb69e245bce91daa24db9e5d18709d534cf43944dfcc1f4c34db7084f9920e6444e9ee820f960f7fb81d60fb1b0030241286a17076954cf83dd10b827edd59c3
-
Filesize
8B
MD5193020b6fad44ecb647e8d879369397c
SHA13ca4833754a025d1374aabe3095b3eb1f8bf2245
SHA256832a900f682043ac32927ec63e43652856b1153d19658a7c12866db9f69fdbef
SHA5128c47ed2bc60c2382cb37cc57ab2172679b44588aa5fd9c71bed336c1584bccaee798d7d6811a0cc047888f47b3166e151b08fa894156bf1e02087540b67198e8
-
Filesize
8B
MD52cc0037317e628d3fc73afe08513706a
SHA1a58b06b3bb450a9d574f3c7b6e990a4378010410
SHA256746409846538292a0b72167a9b2a50ddd2b255176abdf7db4cbbc06264423041
SHA512527496144311f76d2795c2d73552655877b3586a63df9f0e36e6fe01ff67641fea54ea1eb4532c5b19334e5c689e0dde309a307ad9a3ebf43b8ee5ed6582f9f8
-
Filesize
8B
MD590267db1c7eb43f4cf00666706068ab5
SHA1a3fa5b82275c29df36a8eb371becf0f8daca6a8f
SHA256803ea5606848ade2fd86f3f0b0d4e104a5e38d5088f825eabc8df5e1eb4ecb5e
SHA51291c077f9e7f3fad8df92a0944b3bcba4eaa4f5b76ac0e249e0d638341488aaa16b6c7491e6c573e0d327ee4c86ecea4461048676270df33e8e0da8475c305816
-
Filesize
8B
MD556356fb53186048a53ad0d069a2951f8
SHA1a5b4d741441456b3c030f23f5bb3c9a7f9915ec8
SHA2561a52c698bdc9e818ab9fe27a4e682caed2fe0041c4c67e879f2bf9a724571a2b
SHA5129a72b70940e1410aa12574002223f5fbf0ddfda1681561c9d70b03a86210309f9d6119cd64909f9a229f81f2a7547ae2827337abd4843cc6382e74e67be808fa
-
Filesize
8B
MD5f61afd3e9afd059f306fa28b9b2b6dbd
SHA1fe59983df1dba3ee531bdabd5e405bfbb7e14f52
SHA2563bbf1cfb87f17c2a4beb0b2c12c7261890e9d07fd223f34a68f5b94c5a46966e
SHA51227e0ccec24e2f74f94736707dfc5b5eb529d80e98bab19599adbf22c24c62fc8e13c494dd2acf0b95de09417051cc95febe68708a0e0e3c31b2e21b22bf0c940
-
Filesize
8B
MD584b319181e910fe0d682164f114d7be6
SHA1611d7a28cbaabdc10e89c192395a8680f0df8287
SHA2560a06cface6711f6259d827ef93dbc2e78faacda2ee9fddda941c05d3fdf5b0cd
SHA5125d9ddc54ed326f0e30184f576278efcb897b865e751c60728ae7cb7f944e7477770f97352a8ea195b5c185f02356a7a59658e28b3eb561f9fbf062ee03a866f6
-
Filesize
8B
MD5154bc818edff5c176d98fc800973f6a2
SHA1853a6d18494aebf94483ca190362d7b53ed17743
SHA2560548cc341acef40a497b3857ecef611d8b317a3a66235425221dad8f8ca3a8b3
SHA51241ad61516c57d6d8a87f027bfa45e7bb7fadb72dd015a4ebe939a20f19ca99a9f32726da7fe17738bed467b240b21370dc2df22f1d3b168e2457c712108409c1
-
Filesize
8B
MD5650d13260d8b78bc7b8982f6c04ec4a0
SHA11ed45627a3b8e2a81d085d7ccd81d3e328229e02
SHA256a9017de7c3f9e94ae5533ff295dc3328201f82ea05694a12f4e0e556158587fa
SHA512147444e16c54aebb1127843bcc20a0105d8428b1e13e661c46740670fad6472c7a96ac900d07051fde7ee52444924b64370db4ff110e0e67a49443657047c4d5
-
Filesize
8B
MD593cb9173eb1a1c8b7563084d19c1e48c
SHA12f04c745629a8dea02367a0cb96f1551f32e2e8e
SHA25632dc46e2c7740fced4676d6a12ffc2f8f4888f80c3cf347c72cba6e82e30147c
SHA512042039278e12e0a13b7b3418dbfef5cd37f5f363f9ff8be8bb691e4ed4e724ccd8c70051f27f8ada45fa997e6035b7d56a0b79c82d8d1db551647b21fca5659c
-
Filesize
8B
MD5731cb28f4120be9f9082cd15cbaa44df
SHA1f4afc1155890228b29cb95df43e3095f1ee69507
SHA25629fef8cf309187a030bcf91fb692113e9c7259494e1c033e200500786fd54443
SHA512222b5a756839226755b4f852a9ec72ca8f67092c0962e4bf60c620713168f0e893b32f5a07fa783fe2f27984096a0cfe6bfabb72d49158cdb558931186501a87
-
Filesize
8B
MD59293e1652c00f1373b6dcab76ec19ebf
SHA129de47accf643aedf66ba2346432e12a8c4a6e76
SHA256dcef8cf0ebd8b7d50d675905d84c38ffff0f3a2e14e628fcd4a5aab6a0d1ce96
SHA51296b5c4aec9e547b463fbd62de65b216d75052524714bee9cbd75c5333494012954bf9e115d713701b7e61b92a5921801f0de28a3f315b31c51d41ef6d785c7df
-
Filesize
8B
MD55191c09a674eb30eca2f66db27a34250
SHA1cad620ec8c59e1bfc875a705c1c402186f02f80d
SHA2568aa6bb4aa0f82f2d37f6a893a9df5dbb24fb2e8e26ed6157d3ab4a5ce13174b2
SHA512afbe0ad2277490a82e07eaa49c6d29c938fd980db1982c31b52964aae8205eb44ae90f782ec98a53d9c6685d40d47fd76fac2ad3fd8cabb2e788165984ebb514
-
Filesize
8B
MD5883242ba1fbd7f4b530a84266cdb01cc
SHA1cb5fac654ee4aaa61c8382931c37be07b97a1f18
SHA25641d0f51c741e9f590dcbc0456e272ef16ff7edaa75e430098c1aeb39d77d4c9a
SHA51242986fad87fcd2e59dbc518e3a3f94ff114984205e9fa7303760f3ec738bf8cc74acf83a23ecf6d3bb647a634c3815ff254f10dc57472077093c501c860b1a60
-
Filesize
8B
MD53e344fa09921db6eebf20347247f3522
SHA11d2738e48b5f6f081359f4957196164517db1b17
SHA256ee4936f3434720ffb45d63cc8e3956834c15bf4673e608426c104ea0c18112f8
SHA5123d2e84696160bf6f370afca673fc964af6f11abe7d4e9fb2dcabd4ece4ddf6a70fba5c990dedfccbc1e01829d481e18802751176f79440c84e149fe98f67287b
-
Filesize
8B
MD5d46b2b554ab56428d66faee014cb2a3e
SHA1197597afec26c0428bb08b546939dfd6f2f8ab81
SHA256d35e7653f170b74a52b25ebe55bd18d7097bbcddd36c73e3fa732b1c44e80d6c
SHA5123112f492dec5814fbf5d4471ceb72e97809d0b3acf50130b4389bd5e4b38013f913e32587489b3fa40ea5d1f88a22f1a4ecaa956d0ca7a118096957757a67a03
-
Filesize
8B
MD50a64beb643c1fdabef42baade4606063
SHA134a6ef3e91b15ebbc233b98f0bfbf4883b401517
SHA256cb3e0a0b9a351c6ae007678ee54be43566dce9e5784a2b1404b9d5362caceefa
SHA51240112fcbe4228c8b80608887249fc6f465507db0264cf8ea9885ecc104166f5970afdb45933bc2f159fe8144535f48de9f1281478b1199972a9eee697a5ab114
-
Filesize
8B
MD5835f8fe3dce43d1b9feba674b698c866
SHA12d810144c4cc1157cc6d5cc667fd003564b88027
SHA2560041b727dd0f1a42cb9c08a872eb36d9ffa2fdf4b47b5525730ca19775f01d07
SHA5121f1614879d0eb5b4f5f52db89535c33c9516a8ff74fa139d3e191f40707d1f3c0dc540de2dabbeb46e9903f9360c1311e3f6aa2b78a6eec3752479468b7fb295
-
Filesize
8B
MD54a56776a26ac9572541377bb370907df
SHA17927af0a125419058d5ee78556ee8c444d197bcd
SHA25650c47779abe1f0732a20dc6a922aebf98a53fcf14a70d62dac4edced6517c718
SHA512292879666ba013d4bb556682331e95a9e9f8c1cc72d766f3404fda5bb3e688a6505e0c669026a7c765744ef05b0494e28c4f5916362dc2e7e4a1454847b2716b
-
Filesize
8B
MD5da08246804a40f04edc226b1774225a1
SHA14a557c2388feb5b34273f1565fde334b8a83ec8d
SHA256feb6df9ea010c29aafd87046138e7d7a54257777ee4df0d5b7dda37a0a34d50a
SHA5128caba4655b804f667ab89720781efbd9252f5d30de9c903968cb95158d211d8c1cc70331e916459d74da1b589e125f48e2b35e85264da55956c447f5aeaafef8
-
Filesize
8B
MD5b58bf1becda074ee15a018ca41a1fc44
SHA19ecf9fa8361ac6ddba068be2c7192ad4948214ca
SHA25622680240a671a1f84343efbbcf0cc246375331d6ef05b9af59eec381dca81159
SHA512a395abb3333b7e46df5d807ff25683c06468ebf1e39fd52592bea21c34f06c8c462a66fe9486727ee28870cbab9e9edeaac48813c5d38a96ffd17579ca4343be
-
Filesize
8B
MD5c1c56aeb464b18f5c151b264e6b7883c
SHA1213be1ffd9bfa835a82b3105928c7fb3f91f98a9
SHA2561f7af5629413f76e6ea0bba328e789de415f436840148175b97e15b78dbbca84
SHA512783a73e42ec9b49a3346628fd52f4abb046985e1671ab78cd96fe2b836ba526c94e4d4157edc70930d23ed31e5d0538bfe541b51d4715d56858c7a879a158861
-
Filesize
8B
MD51bdf66474536df579e594b2702d4a8b3
SHA16cf2aa0e0d08b99f9dd9aea9bf385c2cf27791aa
SHA2561aa967e4c99c8c9bec18c5006218db162d901dcbbb1bfedb592e4a1b58d78d8c
SHA5129220578591986daecfc2de6fbbd2de5af9896065332700f3858ce2b4c995ad7dbccc4112993aa9ad3e5005f8d17e5782bc8e8c77216ed17a0cb495df14b963fe
-
Filesize
8B
MD521b4058dfaf3655fb220b56dc079020f
SHA1e5132c5039eed5fb0b4c21e8eff4f6a985099992
SHA25633aceb1d90ce718dce1076cbb3ec57e29af2cb40e4beb5919a883351994e76a7
SHA512dba9e8a7573f3509e6f4db90a6e0fe14529476f7c65356881e5accf1e9fe7bb97a2f722f00c34808ce672782d8272f3c6597b224d2fbe7b2b8d384eefb02c30a
-
Filesize
8B
MD5f2c769969a484adfdd8be5ac05161f23
SHA111a739c46a607c62dc48b1b387912378bd002006
SHA25639d178648059f53e944882acac2d60e33445f884fed79758cf4c26a1d161771c
SHA512c6e4c36eb5b48ff235054266efb1f47fe84ce6ba965e8fdd279410b85d06eeb0df1ba3e29c72ece7f457ef2719e39af2d5226950e118fed5dc12697b29cbab73
-
Filesize
644KB
MD501ebc7d1d7a3e9ba43d98863449432f2
SHA159059f24d5a416a06f7976508688416ae38a6f50
SHA256e36f4ee428c9abded8a7fa59bdd11f7341cc1211c73fce5069d3d7eaa66f7676
SHA5128776f3f3c9c1469db8bd37871e7d0fb8688255c57f58c72b550dd2742968db11c52b8550ae3209a788fd6ed5c354f21b68098e3a219df293b7781a5bf2c54c9e