Analysis
-
max time kernel
51s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2025 22:55
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe
-
Size
552KB
-
MD5
11b518a4746e388d6cf19dd90c5590e4
-
SHA1
f2fae24804c1743b0c5b1e05083b8a44c15ad59b
-
SHA256
e9e38fd5709db5467537128fe6ecbd40caaa18053ebd005255be0313f79ab923
-
SHA512
4cfbe4796a530422399907d4240d8e7455db81d0485c89e42d33bef736845d1ed01f92bcff1850631337667bcfd90ecd9918ba3458bd3aaf7068457f9661d6f1
-
SSDEEP
12288:gHZQt/YOZT7pYtVeAtpVxag1bvgx6NdC62kVJ:gHS66iN1bY02G
Malware Config
Extracted
cybergate
v1.03.0
SEGUNDA_FEIRA.31.01.2011
127.0.0.1:999
clientes1.no-ip.org:995
35B5TPL22T2R53
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
calculadora.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
giza157
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\calculadora.exe" JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\calculadora.exe" JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{0170BPSR-1W1V-N774-6DL2-048K1P6ABO8K} JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0170BPSR-1W1V-N774-6DL2-048K1P6ABO8K}\StubPath = "C:\\Windows\\system32\\install\\calculadora.exe Restart" JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{0170BPSR-1W1V-N774-6DL2-048K1P6ABO8K} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0170BPSR-1W1V-N774-6DL2-048K1P6ABO8K}\StubPath = "C:\\Windows\\system32\\install\\calculadora.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe -
Executes dropped EXE 2 IoCs
pid Process 3900 calculadora.exe 2788 calculadora.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\calculadora.exe" JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\calculadora.exe" JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\install\calculadora.exe JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe File opened for modification C:\Windows\SysWOW64\install\calculadora.exe JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe File opened for modification C:\Windows\SysWOW64\install\calculadora.exe calculadora.exe File opened for modification C:\Windows\SysWOW64\install\calculadora.exe calculadora.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2616 set thread context of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 -
resource yara_rule behavioral2/memory/1360-8-0x0000000024010000-0x0000000024071000-memory.dmp upx behavioral2/memory/1360-12-0x0000000024080000-0x00000000240E1000-memory.dmp upx behavioral2/memory/2452-75-0x0000000024080000-0x00000000240E1000-memory.dmp upx behavioral2/memory/2908-140-0x00000000240F0000-0x0000000024151000-memory.dmp upx behavioral2/memory/2452-176-0x0000000024080000-0x00000000240E1000-memory.dmp upx behavioral2/memory/2908-334-0x00000000240F0000-0x0000000024151000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language calculadora.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language calculadora.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "436;41c;401;801;c01;1001;1401;1801;1c01;2001;2401;2801;2c01;3001;3401;3801;3c01;4001;42b;42c;82c;42d;423;402;455;403;c04;1004;1404;41a;405;406;465;413;813;809;c09;1009;1409;1809;1c09;2009;2409;2809;2c09;3009;3409;425;438;429;40b;80c;c0c;100c;140c;180c;456;437;807;c07;1007;1407;408;447;40d;439;40e;40f;421;410;810;44b;457;412;812;440;426;427;827;42f;43e;83e;44e;450;414;814;415;416;816;446;418;419;44f;c1a;81a;41b;424;80a;100a;140a;180a;1c0a;200a;240a;280a;2c0a;300a;340a;380a;3c0a;400a;440a;480a;4c0a;500a;430;441;41d;81d;45a;449;444;44a;41e;41f;422;420;820;443;843;42a;540a" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Voices\\Tokens\\MSTTS_V110_EnUS_ZiraM" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40A;C0A" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "404" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\de-DE\\VoiceActivation_HW_de-DE.dat" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Universal Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\tn1031.bin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Stefan" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{14E74C62-DC97-43B0-8F2F-581496A65D60}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SpeechUXPlugin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Japanese (Japan)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Pablo" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5248260" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Male" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Mark" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5218064" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_HW_en-US.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_HW_fr-FR.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 ~ 0009 aa 000a a 000b oh 000c ax 000d b 000e d 000f eh 0010 ey 0011 f 0012 g 0013 hy 0014 uy 0015 iy 0016 k 0017 l 0018 m 0019 n 001a ng 001b nj 001c oe 001d eu 001e ow 001f p 0020 r 0021 s 0022 sh 0023 t 0024 uw 0025 v 0026 w 0027 y 0028 z 0029 zh 002a" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\it-IT\\VoiceActivation_HW_it-IT.dat" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3442511616-637977696-3186306149-1000\{4984F1D1-D252-40D5-BB32-0390177612B8} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\VoiceActivation_es-ES.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\r1036sr.lxa" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1036" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\AI041041" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1036-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\sidubm.table" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\tn1033.bin" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "DebugPlugin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L3082" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\tn1041.bin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2908 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2908 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Token: SeDebugPrivilege 2908 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 632 explorer.exe Token: SeCreatePagefilePrivilege 632 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe Token: SeShutdownPrivilege 4540 explorer.exe Token: SeCreatePagefilePrivilege 4540 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 632 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 4540 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 2788 calculadora.exe 3900 calculadora.exe 2376 StartMenuExperienceHost.exe 1556 StartMenuExperienceHost.exe 4160 SearchApp.exe 4828 StartMenuExperienceHost.exe 3800 SearchApp.exe 1536 StartMenuExperienceHost.exe 380 SearchApp.exe 3928 StartMenuExperienceHost.exe 1564 SearchApp.exe 876 StartMenuExperienceHost.exe 3068 SearchApp.exe 4384 StartMenuExperienceHost.exe 4896 SearchApp.exe 4312 StartMenuExperienceHost.exe 4768 SearchApp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 2616 wrote to memory of 1360 2616 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 82 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 PID 1360 wrote to memory of 3408 1360 JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe 55 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2452
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11b518a4746e388d6cf19dd90c5590e4.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2908 -
C:\Windows\SysWOW64\install\calculadora.exe"C:\Windows\system32\install\calculadora.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2788
-
-
-
C:\Windows\SysWOW64\install\calculadora.exe"C:\Windows\system32\install\calculadora.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3900
-
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:632
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2376
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4540
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1556
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4160
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
PID:1052
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4828
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3800
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:4260
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1536
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:380
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3536
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3928
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1564
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3320
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:876
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3068
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4364
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4384
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4896
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:832
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4312
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4768
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1256
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1560
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2492
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2148
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1148
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1540
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:768
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1824
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2072
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3704
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4852
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4368
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3140
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2424
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4164
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4248
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3796
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4268
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3456
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4212
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3068
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3636
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3980
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4360
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3876
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3456
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4948
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2608
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:380
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4884
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2248
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5068
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4632
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3456
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2604
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3684
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:924
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1032
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:832
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1412
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4320
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4040
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1608
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2668
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1156
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4192
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2364
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4584
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4316
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1736
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:184
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4816
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5080
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4536
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Filesize471B
MD5f9128bb8d29036190effdd498b081442
SHA1639c03179c72c8ece261f2c30267cd35149dc71a
SHA2561b0d02ad59cfd790431bbed74cafb68aee2ca8918e6d00d1282c208ba327c4aa
SHA51281378f6720867ec67ee5d4f5120b16327d8e707ec908b890bcddd2319b3abc35848098f828f8e5db4028f997ffa17ab764608e61a9acaacbb837a92e9587ec8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Filesize412B
MD5d5f237792f77ff46b6bc2e76db5c87f5
SHA15991e197e515ff30fdd380e98d20437e8b33db89
SHA25663141a5c61bc00cfcee02517370690949b5b9a6c8503a5318e47647e8e4cd262
SHA5128c6e9027ba08aacf58062bb0db3147f4a62a129ab8262d53c25d08d0accd6343f2f2645ea8bad5fae8986ae94978fc61557027558e97a17a8f6685ae90d7ccc6
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
Filesize2KB
MD5e6406c424d51c0d4046146eed899c580
SHA130648366435d9119cbba1748cc41482bc457f56f
SHA256250897e2d3c5db87b5eb6dc1ebfbf63a0ab969bde89746a5cd91fc129bafff23
SHA512a59773f85c383f7909b9db14542df00e84395c363e42269c808b7b06b869a993a03b1be334224c3e5f91451161f7fb94e892bd33091e8c706d6ab9244e257719
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
Filesize36KB
MD50e2a09c8b94747fa78ec836b5711c0c0
SHA192495421ad887f27f53784c470884802797025ad
SHA2560c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36
SHA51261530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
Filesize36KB
MD5ab0262f72142aab53d5402e6d0cb5d24
SHA1eaf95bb31ae1d4c0010f50e789bdc8b8e3116116
SHA25620a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb
SHA512bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80GI1ZH7\microsoft.windows[1].xml
Filesize97B
MD5742f1cda58883699ef753f83244412ce
SHA138531f396e1d9dc9ba6bba0604149c377605f57a
SHA2565ef67927e9fdebb14515728d51548c52536519b35b5a52728ca1d660d957025f
SHA51211acf77cd15052ae9cf554ab666f6c1e629e174fad16659738a11bee6a53b857f375fe99701e7c14c14286193864449f5b88a208ff34f4874e8351dff6a3a6f2
-
Filesize
8B
MD5c7ac4e0649e2f5c6f1e75a2f18dd8c20
SHA11a19071fef8c90e51a9f049cb8eb39db3526c004
SHA256d9b81137d4308e73f34cc2aa6c6d59bf696131c5403330295452b1741c2e0eda
SHA51289447f8a0e2c8a5cf0db98b328e7fe392f3b7b75bfe8c84822f54f5566f2b4d082473f21697c5c3a4c2d1e196b10cc38673af29ac6c0452c54fc0b075f3580e0
-
Filesize
221KB
MD50e7936ece2e228a465270538865e61da
SHA1b914806c9bc47b8c504e97dcb4328751e1c2a721
SHA2564331e91b69ef00e040852dd6fd981d328e56f50fca50e3c7c9b3c0dc0db70533
SHA51213d47640836d1a20e74f40b44c90858c1ac29f31b80ad75dbd503a5269b2f31cb6a733f635242d85a9fdcdb37ca66c94bb89c4be206742047ddae7113d5ff576
-
Filesize
8B
MD52ed7d96d6a16888cc492914a075daf66
SHA1ffa58c1fe78ffb3ca8e2f960a895d0e7ca37e7e8
SHA2568a6e747f70a2ef8858c688cfd8fcd0bed91f824fe2d1de41edf481bccb9d0cb2
SHA512e71c858d66cee66c180b9f3e0673af59c5aab36cdca3c0b98e0fe89fab82b53ece7cd000c9d45e0a75dd5c178581251b00a473457358d14fe2278a2bb44fb807
-
Filesize
8B
MD5973cc291ee712adfc7f4fdb2aa6c715d
SHA190826066d1e52e60f84739c8ec9a70367fb49bfc
SHA2561f52f481ccb10f41b0f3fb7931d7c85e65826c55cfee220e8d03536cbb4d8d2a
SHA5126c1358860161f8733f2360bcb0293302d7b48749b779f90c1ede42a09ea6c3abc4d2187e4887b5cad52f9f246781c82f19513339e9b29354d3d312331ba5a58d
-
Filesize
8B
MD51e4f46ff0fc70166407f1198927ad44b
SHA171d3742b018e4e3254b30cc8dcfed0c926e07faa
SHA256f408e8bd77ea5c94d45d70fc14d70d71742a31d81b9e504abfba86122e8523a4
SHA5125e71d3c186b15cbd11cfbe8cd18c0f44c40bc043f8ae76dbffcf8b9b55d7ab503adbec1dbb4ffb1a5601027c5eb27a5b63810cbd111e620ae2998479ef68538e
-
Filesize
8B
MD535e0fc1de3ab3ff57bb3b3dc4481edf3
SHA14c695b7709e6984f4b0083b44d1ea770bf2206fc
SHA2560780e70165b94589247bdc76125d017c90c4ef5ae1e20f0d4ab342eb03002d76
SHA5120a7e319b950ccdafc6631d511278db8fe43607ec243f40d76b7282378bcc73c9e1d94a768622520d8400d92a4fbb9b1e30664accdbe32db2b21f98f043bebe5b
-
Filesize
8B
MD5579e9f1b353b038f7c8765a42b6a34b6
SHA14734912e4e1b56ef9d74145817055eaa657c2848
SHA25605473bdd0f93c98e60321615fa2678746751c768ebdd7300b586e16b469bc7ae
SHA512109b3139ac909d2d8ade4365a7fd126e8449e3af0ec749949ac7944f484637505429af1f566f958e07ee37654d6cd1ba183a5208e6b970043704c954e3f3b663
-
Filesize
8B
MD518df716c5a20aca9df9c05828477c8b4
SHA19976bc009ffab19d6b70554d16dc7af8c7941add
SHA256cc9726e7cd6a79324348de9ac1e71cbf6194587a9571ec650728a40f83d42344
SHA512775df5df14caa4284db46ca8df4dc5946a033952697c4b90892fca4dab315bef24536a511a3b54e68fb630ad8ec62530ac4e5c5638064b9e792ba6e05862d339
-
Filesize
8B
MD5db8e9ab49ca83498f4af32574b55240e
SHA175b1ebf5f3642e87f1d036e1fc2c4fa839a591e9
SHA256b88c835c10c265e48d2bc610432ce5b187929e252d7e3d9e4038a47fb57fc311
SHA5128c9cb131449e0cf5342f000286b828c3bbe7d585b94a230321da72bcad6db7d9dc64434a78502405374e2ea3ad212c0a96eee1d85eb624610d54190d98c4e7a0
-
Filesize
8B
MD57d03a3a7819e07ccf19b9475789fc404
SHA16e54457d71a83b981ec1d54174b8f62fc5c94d0d
SHA256a600e8737fc68a4049ff5b9e2aae203c7fc4cea7b02e6200c78084ddc02e323d
SHA5128922ccd124e95f1ec5b4a6e2aa7741070d51ce56ec127beedf292871903b13741000f80e7ecd4d9e9f73bdc3602d0a43e7a7aceaf3eb32d49822b10c85533d81
-
Filesize
8B
MD5be45fde16fde2a78f653b95d95b60d43
SHA1d43cab1c7e28017f7e47cc84d48c5cfafbd59344
SHA256c717e89a178458ff28416df07d3eb4eb4400b7a68f41e56719a378d162d9e6b7
SHA512d2c9c0fc2448331b19babedd94b32e199445d5f7e8c69ece0c0891145bbb384524f1c54bfe2f113e8844f4589183ea3c79f5f63341daf5a0d0f97c983a050348
-
Filesize
8B
MD568243f5c1f1ed14be2efbcd301a99877
SHA1196ce61fdca90b28946aa7ff1492b297d5209b16
SHA256e28fa269a160a1dc90c07f20eb6e50874bdbfdf33967353108aada883ba13b91
SHA51220516f3a7e96e1e00defd47acecbcc6978f7dd51204857edf3c2f93215f950e627b736964cc7434fae4ea81a795c8863729ec1e186352d116dea05dc20d17b4d
-
Filesize
8B
MD5c38b450fad209d994c7beab623254999
SHA17c9f95461d4184c950e0f5fa36f7f88255c57c20
SHA256cca3130373984de4e8d0e902435353459e5597bec3ef9d119a789afe7ad5ef40
SHA512205fec98b6a8bd9b0a90f2c1e2f1b0c8674f679a762aa2cd71982663a2c6bcc94d5df33d6af1c1f7f730a76c1a8a2420dc8e8655bfc542c6d09f72ccbab5e0f9
-
Filesize
8B
MD5ea20896b5291d815a55f8b4217dbae8e
SHA1357ad2052847861268cb3d94b896618fe8754508
SHA25613acb789a1e86527cfe5f11f6c615048d816e1d9aec8f2d42bd82a1300309207
SHA512c8dc14d67d6ea408b5f71c301475c059f1e2144c8595479722445c9ab4a61369c5666f87775c4919f204e340807713023ae3c3114e2a9ef19feddb4814244e2f
-
Filesize
8B
MD591325d7ecadc877de8800afe9e6accc5
SHA1bf1c46ebbbf89cbd9cc9a85aa923ee8a92b12736
SHA256aa7bebcb523fe61d015629c7ef6e83012b401e1a5d91f611669f22ccc340bdee
SHA51273e33dfaab4e0b2d47c45ee67d0ae964fafd9bb42fcaa32a0bc9fecf39adb22b5a732d9d7019f555fd9fdb00ae3133417507b0e793f3ec2bb3b7fd20b760b16a
-
Filesize
8B
MD5cbd9c2ec9c14d3fb81f1d59a3af2bbd2
SHA144ae5d701202d00ba2cdb5ea67bd78e57f8bb0dc
SHA25688c4b7e57841308f93ece600abc5296f36c4d3239bf5b3eaf419e3de97c9c47f
SHA51287abc23f7f6e6a369ea2c13d95e359153a962e037dc3eaf890767f4ef4c2a4b090a66c536b886729cc9c694fbc5a0b91a5be0717175d001623e0eda8bbc71d4d
-
Filesize
8B
MD522dde6ec341f201d180950d780fe057d
SHA17574ea4df8f2ee2ab7ee3053b390f1b874766ca7
SHA256f877ab9494f9ab8905a14293bd3b097a5bc66843b37b4196bdd8ccb0da512ce2
SHA5127510f8b7c95371962fd96c635633ae1230e25c86bc7be2beb2d20b3bd53d58f896c54cdbce6e481e28fe7ab4ac6594cbffdb5b6e52ac075e40d754cefa840b5d
-
Filesize
8B
MD5627a3f8796d1331911cd56c428fdafa5
SHA168052421d527bab3d78ed057dd7472dffb13f325
SHA256971ec0b4088d6c7eb5c31aebc4db16aeed30d0b7f4900c3697c9175b5a925806
SHA512d50d441e997b774e1bd2380591309b1066b3810c49e62ffdce93621a53af4ffa0050fb485d1675ccb4b181f8c1250c0ec8bc88ab7bcaf5863505786009b2723c
-
Filesize
8B
MD517e3d002160c38395c7dd731dd30f8df
SHA1f997521bc92b644e1455b2b74021325aa4f45eb5
SHA256c2949118fbe326270658b58c5d923a11dd1bacacfd97cc5ef9561526d7ea5eb4
SHA512866addbdb39ba6e88a6e7e548c50a2d2eae33966776f8114fa80b3f97773c3ee94bec4e5c34514e2fa9411fed7b148cc0b3df2eee8da4a1a23c415996415e7c2
-
Filesize
8B
MD5f054137419ea3fdd4ad45e24980d5c43
SHA1e94fc0378aa5a6689b2e72f710301519337a5980
SHA256fb3f9113772c9825db022965dc08c5f56c0c362c1062d5971b41d212e9b5c166
SHA512dfe0bcf4137cbe14bfe9eb4d78dd868ebf2cff052627d359d1f7117ba8a20f3ad8b6316110192d97434ef89615dd466b093cd253a3956abc930c8092a3db2b76
-
Filesize
8B
MD5bc915142b09e65d28adbe7494cfedb20
SHA15c629cf7b95babab6fec932bfaa96c7084900fc7
SHA25612a24967c4a0e0b4c0c86aeb9593d9900c1d7c008f3c1f588b82dde7adfdbc68
SHA512ae6a53b8cbea4af9011aa7dd99a9f0abc86d98cfb85d146127e382b98ac4a172332a139141ea4eb0bbec91c7fa82b131f1a2c625b5c4ef159e1b303ae54b88a4
-
Filesize
8B
MD5eed9605bf3e432fca82d2ea52e4d43e0
SHA13ccff169f794ab5bd20eb4cd345d875f993cbcdf
SHA256f4f890f23427be5664c7c760cbf41ce95331f91b7d728a921a13980c519d7006
SHA51271beff529c63d9645e5f696f9ee8ad9923b50b67a2bf7d7eddbff588f073afbdc0038c078954d14d27c9054084c3c3eb2de249eff1e1ec15c1f34a6986d6daa1
-
Filesize
8B
MD5c3fd9213b67c7ba017927744a0f157dd
SHA10e136ccfa672bc046ffc7665fbe80b168394f4f4
SHA256c5d56f80a022ccaa282dd28e399fc0816ab36c108fdd74aa984032d891030edf
SHA512c94cdb23e7a953230cfbe57d867f2396454c629c7cf9d23cdc80b2bee79d5b90398cbccb11ebce52c371d11cfa0e471d0b4b3388279776e07c5994112f2e37b7
-
Filesize
8B
MD5211c132a28f6d42e5bc848c9ba80a9c4
SHA1244909481fd3671ec8f6d3bd55c25e054fcc3ff8
SHA256ed0c7ffb696ba16b24aac3e8605096c4d94c582c9b4e6cbc36aaec4aabe50b59
SHA51267220761332ce741c50a1316a842a96c4643dc2705ff25c7ef4271afab0f681c39c22187eb3709f635aefc75ae2a1c0d958c4840da0c10a89067053c86391cc3
-
Filesize
8B
MD54f4e38bb4b23903182aa2c9b80e85d60
SHA1f0fb6c50cd6117e89a39baf9008e0dc5e04e2d6e
SHA25676ff54f8fea8d6ea823e3554cdabed70d4562b45a511bfa7edfd0792c850ec5c
SHA5128d0a35ba1b1376c69afc05a974304ccbe458a92bf07147a51fa106add361d72d0a4e0c4e7d24b421ff5763c70849c656175fc71d3886976e549250986f4b32dc
-
Filesize
8B
MD58f526e1952e141a822bb797ac71b9fa7
SHA1529bd5c972da59c371e837258fe92c33f2a546b9
SHA25627436a905cde637e3a4b2ef11db29c879323b322007ffd600c9cdede3154bc69
SHA512a87afcc49810c97da32910dfafdb271a388c09d4a5b9a8024567bd6c38fff4d49c413dabc49a03a071a5bbbf34fb806c8a37644e6b5b557ac45648b503f08c0f
-
Filesize
8B
MD51eac2b33bdcdf227a677176e10571eb9
SHA1c579a334eac4d3f599621ac53522134f22d5c178
SHA256962f8a6d3f4025cf307e03c83efc018ece379f6dcbec8b3966ece9e40d65cd39
SHA5120328631f50c705565264a57114d3b5d120f8fac5f0a71e3fe1d802fb370dca901d8cbacca6b866d32748c1f3f22c9dfb954a16fcfbef98c53e5a536620c42fe3
-
Filesize
8B
MD51b43504c99260bb859c8009abc186fa6
SHA17e7c56e365d2b51ecc0bead3762d4628f1193fd3
SHA256e4ff0ff804f6365bd2aef2e994ded94541b0ea34d2a9266b1bd785ae6d1ae7b2
SHA512de0d0a7906bc263a0787f9b007370a64e1888bb4bd1f6a54cef9351434f947fe0356098d30094c5ef8b41005c7c20f00e40a5a3167b31c3a0155da54b8cffe01
-
Filesize
8B
MD5e4a310e8687e43f68c770549ee15b2bf
SHA1ad53df85e2942828316de0bf4b5978ba8ac27601
SHA2569a9ccec31144cfb0d6435b9224170c5c4ec7915a068a6dc1002817ca2807d002
SHA51238030aa801cfa188a782783fecd4444e3bc673e8a66f5727bc99a9d262ba5e36dae533c8fffe40c06a25595b6db05fc522f63289b190aa3cc8c6943a736304a3
-
Filesize
8B
MD5582ff234ee18db05aa5ee81fdf9e5611
SHA1d9293448cd9001c77051011690d57232777cc89d
SHA256c81067acdcdccdd87a53f4241127db31af44b8112f1a012eba20adb68d29b052
SHA5122f8f8857995fa1facaf4f5e5573a62b07113560d7fedd3b76d770d6d8c1470980a296e84a58063155bc1cd8e3a1aa913084d5b465d3bdfaeee0b2098bde919f7
-
Filesize
8B
MD5f7c6ef8417cc83eaee56e91a91230f58
SHA162671191d8da1ae8f11be48f0427707e6a5877d5
SHA25630bf8ff8acaa3d3cddad4fbfb79833c1534ce03149148955b866866b703a73da
SHA512f229dd5bad2afcde7eb7533855bf279b14f25da538c208ada18dcc051fb67a72924565e17369b59305b5325639cc7e2f3f08baace4c519f78365f178b3919ec1
-
Filesize
8B
MD55e1cbe7aea401f8c28a7e13ad1e870d1
SHA1bc74d5fc00c95f76ce7d46020e38b1ff14393502
SHA256e3490da9b91db173866c0ac41c088abaf4c0bf1a3450211ad13122f32a495917
SHA51288ba85447401f782b7c723174b012111aefd41a2a200d77e782e10de2a64ef97ddae29bd7997d9bda9a078ddd35b2168a22601ada04d790fdba80f9a852392f7
-
Filesize
8B
MD538482fc499be3d43583e56f29caef739
SHA1c57d5713fdbd87db0f1e1277dbebc0639891faac
SHA25678be4cfad3bddd39bf0541a47c67041f7af05a659dfe7b9d2900cec63ecd5012
SHA5124826e7041f4467bfb68b19674a685475c3001b10aba5ca273a864b53e90bd038dec91c9e485280dfc7be7a743ea3e3a3529d2696547cea07452985c97be8083b
-
Filesize
8B
MD54ee30e64bbd80c750212679611f414da
SHA1272bcebb8e5501106b9101120898406c54654b75
SHA2567f809d5dda2952e699915bf49a3cc090a26fab78cac8632c4ee57b8da8580ba8
SHA512b0fb9fad1bf168cbf1a8df176287ebc319dc3c7dcdd81b1e3d6698da8c9383e4263d5a86cb1914ee055cd56f0d0d250fcb483cb3002d0e978d9ae6be8925d896
-
Filesize
8B
MD5981a3ab9ed0a8138c56a4c546535319a
SHA1874e6c5b8a70fcd05fc264035e41301d3d7cb60a
SHA256fef9ea7af73058c6630ef9d2411f9c6996764375a88428613a9ac0ff44eb8119
SHA51216c26dc2abb5625cd816929c186868965b1c119336b78cdf5f38d2cc7f3e97aa01e66e9921577cd35b0b92847afbb0d8764a268562d7c7c86ccaa36e3fdfba9a
-
Filesize
8B
MD588f55bb629bfa75ff48efd290378e553
SHA13cabcc803ed63a3283f9558d9825e69846d142f3
SHA256f7de209103e38b282f1fe8de51da85e6e6ca968868a4b5fcca094dd1c67a7e76
SHA51206ebf745bc53b81b9032bde104d9e5e0e65e03265bfe5193dde3adbe0e4a99fe8d96212301fdd2c81f8bf0924663ffe30ae934f4a6a441cfbbc79971ec67506e
-
Filesize
8B
MD5dc51df74e7124f07f7b9d217dad64085
SHA186bbdd818199d884a8b5f83b37037c77aa8013c4
SHA256af1b68e1ede73ff38f2893dd5d94d8e6ab72d6fa97cf09d1fbd0fa4f12228dcd
SHA512fe2bb914f356cf6faad8b476563a8a9ea9a2a01009ac5abd8b61d5bfc2d9d91c9e469fd5af6ecc45268a4fd938bf21312ccb0c15b962ff2aba0cfeeaabe8ee89
-
Filesize
8B
MD517742d7978b5ba2f59a8212ea019cdc4
SHA1716559e0b6dba47b149f43fc2d8ca10d3adc93ff
SHA2565a733de55c35f8c4b9f54020bfa948783d112db27959cc2d2490950b99b6b476
SHA512f35d3e51365cedcbf313bef4631f5d72b0a60f46ab139498b5138df3b91ca1afd73d6b44eb56e3bc9f8c2ec323082682c9aaafe88b5069b95919c3267c3093e5
-
Filesize
8B
MD5564b84c57d3385fca973813eac5f5c72
SHA107845dee2313c4c53b0ec9df1ac44bb46433f821
SHA2562230eb6b5bc05b6f4b5401c2d84a7c9ec9c3dbf88bd2948cdc6d179348febcc5
SHA512e8a61e9ff1a7bca25edf3dba7126f268f3200638747b640055c98329ea90a8d7b80ff373f2ddc85768cf3dfa4d6293d55a1552ee29aa94bcd864177a08fb21e3
-
Filesize
8B
MD5ffedd0828f3bfa86b899d675bd254bea
SHA181381d2ba22e028ec3a166c33705ed443bf3cfab
SHA256cf7f007e530a6fe3b44d5aeca2b976f449b4ccab7b9e80f2272b166f6f9b7b54
SHA512f4147c7a72fca2985a19cc5c6b5faea868481648b58f685f552c7e86ecb3e06eadaf5b5d670594c62e166841dd6468569020ba33b65ceb02d1683610dfa28837
-
Filesize
8B
MD5d0944b0b355aeac459c0cdfe607b87b7
SHA1fcb23ada3c267e9df048f1349fca819a8059e2cf
SHA25674b2b49d44324bceedcbe198f666fe753ce97fe4722ce3363e0272fc3ef83a16
SHA5129f2109c50f9366f2301b3720dfbb7681dcba9be3567b9bcec55ceff04ca218a3a8454e6d75c5d3fc7f1c5597723a9061e3d4ed5c019131250c5164fd69ad0580
-
Filesize
8B
MD5ba50a39ab8249dc02fd6930d6bc7daa7
SHA1558dd85171e19393afa642ee1f75012cfba875d3
SHA25622ef3addbc12fd24a2480cdf8e6115ca1435c34f1dd1cff6f3df959944e6a10d
SHA512a4289052fb07a416425831c1a19e71e4238cd6cd9a8b88104b416903e95cf39965267053429656df53e64ef42e53d529272a287176c1d581d25b69387734011d
-
Filesize
8B
MD58052c872ebcff42836870f9e60f4cab3
SHA1bb22c0cc34c42b16090ca1dbad556b72a2ca6e1e
SHA256d791a70536f2d0ac60ca6d77e66bab1542137cba083f24bcb86a103fd07b69ae
SHA5125f061af1bf0f93012280936a3cdd9c54632b9d1880bc0fcde954c9f140fad5ab946b42f4dc92feb411f7056b1c012c60e1a017a6d9cfca69fc0ea2abab2fdb56
-
Filesize
8B
MD5bcdb0ab4f0b96fc2afd66977078f17d3
SHA1ee156114ad886b96fd6beeabb199db0b346354d3
SHA256d0515a975d7db522e97260bb7d361aea1bb2a846892874eede15520cc5718587
SHA512658e08c1792120ba3c810435a3d3f8a5ab52a42b14a244701faef8bd7ca073f328e9026a6cf4b34d13d78700f0813e1d2cb7dec246bb11c4359e3dfe175f13cc
-
Filesize
8B
MD5587020663620ba076e54d822f17e8615
SHA197cbb9f68f0e5ecc5c18c64f67da46fa3a9c9417
SHA2568be16fc486e3d44991a6e08bc2005878c67ce8ac267befc8f3066c930970f594
SHA5122c6d4869219ed00041759a723ff00b8c0bb83bde83a41e8923dd66a236057408ad43c80ac37a308c9affa6d10a03674978d651ba313eb92713531e2f847275c1
-
Filesize
8B
MD5f846a42a0ad1ef76b173620777436dba
SHA1c7580d89a38e8280b497350dfbb1af7dead9a65c
SHA256c30f1e039c40afcf883ac9202c602f3e417b0d85f3fe00f8fe2821e43928faa7
SHA512e75895326afca58e3002cdb9c4ffe15fdfb1a5ab05cf6e5edf0e61e9c00a74a8fbc92937108c879a942da9a0d9942a2069c2b29c68894a3e4545d82b5c97b1aa
-
Filesize
8B
MD58e36a7cd4a248182f81388f395583adc
SHA1297f9b9114904a3fdc52e8de2240d6e2863d0663
SHA2563a6845a0c508d244cea29fac5181449ac027519d4fc21ff1ee506e1c64692028
SHA5127e396231eb7960665b491f13ff2f77b37b289d72337c865acb007df10b5c42327aa68aef492813ae96e441ea83ff7ef6c37a4b1cba350f3435df5a537c23431b
-
Filesize
8B
MD5d67aa1a20b641079dd47d917d9ad9b75
SHA1faac8df542dc2f618df0f719eb7216b4539a2401
SHA256a7f0006788a7b8f55ca12a5529db269928bed940cd0c50b73bab0164a2322959
SHA5123730059fa806db8707922c3f79c5f7cb34659809b00e6eab4f18f57b4a6dbebcd9f82b62c262e1617db3e7a77a26a9a46f61de77b2d9d100d0a7b60556dfa960
-
Filesize
8B
MD530a16528dbde0fcd53df51b6e8884c45
SHA1482d27fa052db8768b8119919e0f6889a3d5145c
SHA256a8dc78846d7818e3917b4ba0f9c68c3a56acfea20271136eb2d511bd55484d91
SHA512258653e855656db92c6ad25c023f9750e261b56f2430389e9a44615dad6a0a4ec3d2c3f60e69344df92f258da80d7575ec516285f9b4c3a2bbb17b061bf6ff94
-
Filesize
8B
MD5a8a546556a018810a373bea4e02a7915
SHA10f12a6f408a8336844c87a9f437f4a9a2cbee0ce
SHA256c8b9a14933261d8d02307468d6e7551d2b2d8214869089517f47cc83848f0f6d
SHA512558a39190094294d71efb1e21ba554675a0bfb35bfd2d27f5223d764ef71b53a1df34d2bd2875e9e8499b4f99f90ee0dd5b72456a65ca2e2570cf5d9185c13a0
-
Filesize
8B
MD55526715b2430e6b50fea75a17c8f3d83
SHA1657f13e4dbfc61fbae90749df31b9f9efb351c79
SHA2563d4ea9408882d26073227d89fe3e9237efd72f5f4a9bb487b8bcde5c90785b98
SHA51245c6f27f622316dbd248e18cb2d4ea4889938a7e3ff3cc4ee1a01ef65133c9324fc4371024fbd982727db30c6a05c7dfabd0aee1be50f4ae85a26f89f8045fa6
-
Filesize
8B
MD59f4a207ad0e4b5fa28c1ad5f1ba0eefd
SHA1d3827ede02fc9a0de2b4e9973d3cb64c98719a67
SHA256f0d414f27815b4658753a24f291ea8d50306b1931395f0313b5540aa8cd9cc32
SHA512a3666827f996f33150a1a561a052b7efb86b99302e817769c7ab5947c6c21df1a396337c9fbe533020b7ea765484755f2a59f7e8257c2959d1712a2df6eea086
-
Filesize
8B
MD5d56a24239ef1db5afeac83d9eb2bed10
SHA19260a737b6ae80d8734e5b11b77ba6af7832f6e8
SHA256d954f818c1e29d560ca301d93ecb19e3b365ae73ccbb2eb4520a5c4098a45650
SHA512562acefce36b2675458218fc60c92a5c1b133c220a9a66fa900e7f137956dc697d8b5152632e88380199c0141c0212acc270a15baaa6fb00c2abcbe5e19e7237
-
Filesize
8B
MD51e5e240309c2527a4cd2398ee56961b2
SHA12c7ff44aaaf133176e097daaafcbf806529b5d65
SHA2569c9c777abe8eb7caa382a6b473e1a04ed3de3313d2d07036e3d67c282cd1dbde
SHA5129d66a3845576a94e6a008230c596e6059194d1cb2dc3c0deeb67a0def72208f7f85fc7b1ef6203f6f1a0b59c246a24954f61d1df7eee21cc5e232c6f7ffdc3d7
-
Filesize
8B
MD545c2d301f43cd324281fbf49b1ba5b58
SHA1d7cae9da48661ac12be540fc610d771c952b90f4
SHA256c1611b8bc2931360ecbf3227726df0056ea963448d466fb37daab985abd98a63
SHA5125c1d33abde01f7554b14c61bb9cf8b4aad10cf23ccd5e58820546be89a0063134f7b86cdb9ff6bfc661df10f20c00d71ceffbd9e2efdb326f6c6d8e84189f619
-
Filesize
8B
MD5f86056b2247286c38b2285a1a2d7ab4d
SHA130be64820cbb961dbbc5218ad43843e33992ea29
SHA256b74cd90672e53c6edb75700263f2983b5031315bf306c810eeedb0b14d648013
SHA51202f0a930d39a9f243c7ac8ec294783409ec14b961bf6b9886cc04dd5899f9117b04dd33c1d7cc38736c4339ce060d761910f0f3058cff40904128ef44b8bfc03
-
Filesize
8B
MD549b72e2d549df46ca57b0d9058c05457
SHA12117091834720d00454ead87cb92101e54816e51
SHA2564b394b6232138e5db4cfd05b78910414bb45cf4661d69c11dc244f62494b7eec
SHA512d23bf06516c87477abd9b9427966f77a3c98b8b152237a1592a1e3dc0cc40899d0ae02ac49e0fd9228eb34ab14cabef0ddeb01cc9f2ebae7838006a4b4046d2b
-
Filesize
8B
MD5ee863a214021703c4e8863556438d674
SHA148d598043a6dda4cd8d00518035fcb0b46e9ea23
SHA256cd6c780c8bf5bab9ef233aed270ecd1dc2d3960fcf5c8d2491db758b61175558
SHA51239af353f5d46fb4a77a532c1f1e92737bf9995be4567b5b80ad59e4e0abae86ed0abfc3d9239609aadee004db8630271c96cf7e31e77734705d77273ad7d83da
-
Filesize
8B
MD551889ce901d98adf335ee5191bf13cf2
SHA1f2d2a67fb674d405795dd874f91aa2ffae578dcc
SHA256128a8e0ce6e2c06f275efb5c956406391ba3c6cb90dcde75c07dcb62f3fe33c5
SHA5122924d301d6b430a9fdd892ff83a82e02617602eb16dac9846ef5a1a0ec955071a4ce431abf069fc3d62b9e1b97cbce6ed209cc8cf4f496f2026c6c04078b3ef0
-
Filesize
8B
MD5a8b8b6103f6e944113c1d4c256eb39e4
SHA12dd5e7d6734d8337f472ff4b082e9c0031460574
SHA256b9d27579faa2f62c17e394e3d91a71637be1381361a3741f76b79bd635aabe70
SHA512e2d075086f32565eaa595235f586def257cbc61223338935d9db6e656ee2d8f4ed681badbc3206429be9f06363c7b9960864b0870a1c01329d8fa13acb34b2fd
-
Filesize
8B
MD5b835ed06ff70ad04d7523b55f269efc9
SHA18d9ab5f6a251aa84669db95d980fd748f3f32776
SHA2569a5e36a44da3b364a345350ba3e5bb141190e39293ce6217b329a7231bd809b0
SHA51213c652df1fa76ba4f6ce97d62d1a2f364dc4a8293ada303770ca0369c8b4c244423e75c7801b18795b151f56a1895e0d55db16a2d04ea26a5e4553c9a793ca74
-
Filesize
8B
MD5e5a115c4d6c33c8d0841edda80ae4a62
SHA1c788006be680ed454e5ee0bb7a56486400658b98
SHA256364c27589fb5889b11d3b581a2c8fcee0edc2fbc877a6aa91b6324f15fdd2139
SHA51271a9658c278cb7ca36ea4bc09a6e3050b3f81ce81a50573e1ddbaff1f74540b532fba90fb204fd99e651746246a73747c87747b5ac28480edd353e8cd0572568
-
Filesize
8B
MD530168900553dce03253e2691056aa71b
SHA16d2cc767aaca634388748f7148c576c0689770fc
SHA256f0c578fdf19162d80f2a0846ad6e1bbf0e7b2ed20ddab27454a391bae2e6ad54
SHA5129cc37a5fd787019800a970ce3a72619686a0ee2cf2fc42dd9f9e2c53d501fdcbdf4535f8853c3f6d53dce2431f53d16dc006dfb23e514f3f06adff4dd626fb72
-
Filesize
8B
MD531cef617847527e5c6687ad9ef2ffc0b
SHA15bf4e75df671b9c6c0729c0bedd5c04552caca64
SHA256ef5b0c8f6187e5ca27806e79d537cd3148309a661450531c353bb4d498baaf56
SHA51258311529c4eab09e9f9dd35d000482e58691e90a1186ca91aa1c8badc3ee3f679b9ce425c38dfe698d1880437c698ba1504958df039a6d752bff95177ad0624d
-
Filesize
8B
MD5ccfc2e42388ff6a236838787583bcbe4
SHA1dad0245fe02815d30e32cef32778f619b48b0027
SHA256af34189e5169bc2b1208b7d646f94c504033fa608408fc0f384f212d61e57fea
SHA5126456677775d76d344c0edfe0f5f4a7de350f2be14ddf3856c05942dd09a8a446875883ad018c186c380e8bfe5a8918bbf53c46967907825feb16518a9a7ae7bb
-
Filesize
8B
MD5f8424e085886a9ca62da9e4c6d3d9725
SHA129917afcb9c9bf4d8e852dcebd11c07ee1ed1335
SHA2566d415bf202992ae480a440b697a1928d05c83ccdff07f5784991daf9d5643069
SHA512e9cd39482461ed1ae023aabe61a45e7bd81fcd3e1f4af5c89933ae6c587ab9a3196c4bf059dd9765456286cab0ae2574717491a5187a402faed3bcc8c266f5f0
-
Filesize
8B
MD5b371692cc5fadae80626dbe4b7557221
SHA17fc4c996787d62e7829379830eb2f04725a8001e
SHA256ceb996708b210cd0e9eca1b0ce68ad21a4dfb52fef9a909015882f568552081d
SHA512b77d558c146bc9e8e649698c157731f5275994f04b4d11c40d182360ba9699a72115703b797581af6e4cdb65df1838de410a7ebdd9c694777f8f7e2406180927
-
Filesize
8B
MD53685983728fb421cbc3f06d25975570f
SHA18cf445ac5c5c1468fb0463ded49e0415dba68b86
SHA2561ba3f042da8c2410ff8eaf811ba48afe42f6d2090c6cf24c10b07ab03c662b2e
SHA512f141705ea6af54f49f7bb1cade6515fa1bb029b09ae31f57257a2c3ac2d73c1c7bfcc4e1852ab567866cdaf1c10f3a5a0e73f9a3fb6258fb8d905fc78f0071a6
-
Filesize
8B
MD57d529109989d7d8335a30a695d4eab61
SHA1b0575be3a2cd832874c6ba510a8c6ecd18d9dd51
SHA2568d2e86cddd354523244b94e90dc107a83d6f0711ed5d5dde07b5d93294badc8f
SHA5126f5d85de807ce29e4aa36cf41e1a305a247a79f9d8e845f76874e4b77522933b193e73c4689e3af950c3e00bef902d6ada4bb7b030af743272638361bee2c12d
-
Filesize
8B
MD5d3deca1d6b429f09650feb35ac29845e
SHA1b7575c2326ce12183afa0ccd9332c468d110db18
SHA256fc9f8cfe9a61f9af130402c97e8211aeded2f1f0c29fee4cfd4bcbc163056039
SHA5123f95e830e62ec64862e000aa8cafc0ef984d2d183cb2965f7a8a6a531932001a00b08eff758902c77456469740bcdcd3c0ba585fd686743792b98184f4107ef6
-
Filesize
8B
MD50b0ce4c30e6a8b7ac2627e6d6c8a7a6b
SHA1fa590fb215df5e826bd8e01d2cf1077445709109
SHA256a114369f941dd8454c6c30321017154fcf3145101e65b4e5017537028f1d8f15
SHA5121bd3bd05c8f68401a7d6b64ba173a271d076cb97cb9fd5c274cc5e0d991160aee841bda84481a9fdd0503ade024ec08c9c1a4a542def2ed9350e842849fcc7e3
-
Filesize
8B
MD50097e72d028abe24899f24e65950609c
SHA184013bc8151d1468ffdc2ccb09c815873d231f6a
SHA2569f0793b91109537655293064045a25bd08c4bf8de4e5a2794b4c8ee5733e4305
SHA512d9a679bad1be342a6b8181a8fb488a80dfceae7524de27a3f91ee29d4d8a64a4673ce5af6e137232970f0501211d3feb146979b2464b062856a1f207ce2fd043
-
Filesize
8B
MD516661d0f89688b001578c0ee724eeb59
SHA18319bae97a9486c0ca3ccb653d6bf4a2ff713c14
SHA256f0a20230587114983ad4039c006dbec133602c62384c72184cf3dc6e956ee682
SHA512c943951cb77c01052e6b5075d72cbdc4408f72728d92082e3c0a6a608e88eda16564d17cf9a89ea516b148340d4f367c2772d5f32db09f6dcfcc174b61777f6e
-
Filesize
8B
MD599e90c5a9cf95fd9e3136317f0dc6c57
SHA1ce83bcc32798e431d938f8cab36904d965da5550
SHA256261bfa90b78ac25520f20ca815d80feee5fd75ca66421b7624f80c91df0294e0
SHA512101a128637ee6a41d507b7ccc3d54411f4c8b6115d1515ff491f6db34c7893bf4b3da08cdaeff08b35ef6c558b57d904e343fecd529f223a9f5ef69c1f59f5ae
-
Filesize
8B
MD5c1c20ccd50a04c5bf2d3ba6ae39e3e73
SHA19bd305fe869e87c013b1a1f2058e23f927ba5f41
SHA25660411fec59ebc81c2569db69633ebc250840e5cfd8ae07a9c601710e737044ab
SHA512a8aa35f5513e0113a5b3054f02b0de0c8b4ce7ee24bb56f19b26956a21243a71c5ab830871dfc55909eb429112dfdc01c93f139762dd3c21f5fe1ba64d935a18
-
Filesize
8B
MD574553e803dad7ce6a82d0620b6b8b2f7
SHA1cdebadacb34ed8c5fa318c60865b11036ff0a3c5
SHA256fc043a6b56164e30cc737940915d0d876e25a8dba5b94a83fde4363b5c5a8ea3
SHA5128a093786e4292f864cf6d6569be27aeedf6a2162c145d6962cf8e9fa821c431751ac8d5e17e92fe9948d1872ec649aac8bc8b029b2f98f7764bcd8deed7028c2
-
Filesize
8B
MD5c795a8a682dfe7010e18f0e5e56b8786
SHA1ea5a790b78725894dbefd3445240c30e58fd4271
SHA25634424abcbf450914c7fdab7c80e1c5c162a1d9bdaa3360b628506c81bc4c7033
SHA5120a4192b0122c3697fb42e8f31cc71035a8ea00ef8932ba2ba6622746954ecb551ed46fe4a9488bc2e8db86efd98763ea6a9392e486b7597de821ad4ed6f022bb
-
Filesize
8B
MD5819709ef1259a8da2c6f55e73c6942cf
SHA1d3806514762fc4f1f7331ec0f5dca49c026852e6
SHA256a3ede03214071838a862ebad0bfd6e7c99a8f50b9b35859a82f337fcc50b4542
SHA51243c49de070dd6a56e939256e68b81fef476e6b5c95a6b48c844314250571008d46d5a47f58ae528634d8bf94c3465d56ec02eb79051ac82bc55922a5e6802c54
-
Filesize
8B
MD51aaefcc8847ee51098d8e07b3426495d
SHA1fc9225a605416923d950a4b26db4f2ad30f7e738
SHA256668e72d2e44c59e1d084adafdf4bfd2c98241668e1a75c7a108059f1992f3b87
SHA512ce826690eebc43350bd0dde1eb88be96f0d44773d361cb8da4f633c36ecac56e01c829a73708cd7544c11298d73762367426360f362b1aa0bb9b61bb9f15a25f
-
Filesize
8B
MD597f1703d27b31f6980b7b31e5081afda
SHA17cad750286671766fcf03ecd7ab9e81f64ada135
SHA256dcb6c1253a7da26e36ec1abbb98362171b4aa7e94e0c63322b9472d2e67a8367
SHA512e45e8ba8f99aa8eae46a9b81fef65bb5e6706acf008760e2c2546e2d0dffe8761b406c70d8d3c2fc1218b947e0a7a4594525fc00852b515691e07cac5ce5f98c
-
Filesize
8B
MD568bac3a97050028a59f9877647642b16
SHA10cdf6d3229dfec93977e017cb35a737d568437ec
SHA256c65a2cbbe417755a2f4eaf83dfaad5b13888556b11b20f0b28652629d8dfa8b3
SHA5128a2fd277b4a3789efcad72cb5db269ec903cc9635bcf63919e82937cbb34aa03111025c308d60ddb574d1a2a9e8e2cd5a7e6594932b9a6631ef2a5dd5e9141d8
-
Filesize
8B
MD5731e08a36f1948e8b56b727cf252e751
SHA1df5c42f3cbbf85cc0d050ca8c8b1577445d00472
SHA2568816f25dab32a35541b3be0832495005a1c2a000302b3a3d8184c7c1719eac42
SHA51248d45eabcbad777b0a400c4ec600127192fedbee99f2714b34e016cb475431c3f157ff1feca768e51c807ef9b5c767153c8644621f3c9a2a796657ecaeb617c0
-
Filesize
8B
MD5acf1e11223827802d41de6577fa05b85
SHA16064a849ee2cdf4dd151f636eb6e0ef172ff4bda
SHA2566b2a1429a2b90e31dbf0342733f75ac5decf468af039aab1f39b7f6d1296b305
SHA5127f6293b5cd67dae5f947dcee8e25f4be83a2c9ac338def6ad66359acc22f24c77684057382f2428de5bcec8158ef81a5718adb8997edaf5510894321ac53f763
-
Filesize
8B
MD58b35a8c3a76c15067fd6f66704f37e2a
SHA19bb6484bcb245aede6841c35ceee3e242b637212
SHA256d378ed77412fe56f2027b53ac390353d97f12047128816d3dcda9ed2ce9c1106
SHA5122458c147e84616d1cc2aa356bd656c8c720381dfee3c5db98d95fa0781da40ce345d1e31bc6ceb9b7f9bd9791f52c9df1f451e71ba616ea2bc8c1fea47529a2b
-
Filesize
8B
MD50a668468d412f2a0cb159823d14b23da
SHA16747c31deda7669ca7d5ae1dd067af01f3ca0621
SHA25631ac9f2ebda2372be8b3d982a10e52778816e641d4c9039bf9d0a90d835a922e
SHA51288d0e228be0615209fad6e0a70da72c2a22201c59428f8d8f8bc25d33838b2e675e69627f0fe3448e47ba89b623d2bfecd00cbeb5895e37058475c268ad90263
-
Filesize
8B
MD5bed7e7c4ea721d8bb0d1d414685b2274
SHA1733fa356127dd98c66ae4a435bb95881301f864e
SHA25643f617a5aba88d7dfe2d7efad6d0330f90c9513de21e05395e2274e969058e23
SHA512c90225a5a2798a270233fee04d7b948b41042d50ad254a2f562448778bfd81a56f1190cf79641459530d656208e8af23308580064a563ed13b64bfa7f11a194b
-
Filesize
8B
MD57c605822ce9d1d0471bb1ea7ea72392d
SHA13d08898d8b58d13752e61f7181abc2ee3aecb29c
SHA2565a1e9e6dcbe7043e4caa8de65f2fdb1e855dc87a611a2a8e3942bbbcb57cf75a
SHA512c5abb8a34724d0f5278a8ace2986ef9ffd510a4eb6665fb228dfd6ff27ab44c1e7eb94bb4605362cea1797e2c06828c04d1d4f142cd20ac19f9ecdcf5ed550dc
-
Filesize
8B
MD598ef53e5a07da1dc00a381df0d671641
SHA10626f30b3fd3e2735d29a56c968b9d3d0c563f85
SHA256f43181df2ec712d58ddedd0a9a2cc510128f75d8c563795db7cf722583795fff
SHA512cb07d11b250199fc2ac8527e2debc7359de54f8c6485eeb30a2279be03a0333869d28d3a8d7d567268165b1b1f71203ddbcaadc9fae3410182fa41796a0f99c2
-
Filesize
8B
MD555b23e0ed7c90d23fe1542522795b903
SHA16ca3bc7ebdb23097b77199da7a9209e6ab022d2d
SHA256605cfdfaa58050dc7268f82e4237dc306446f9051f314abb9deba416d0fea05d
SHA5126a7babc7cb05297c8653f6c93e92731e66591ce3b9bd7da996fafddd935570bee8137260148dac6cb3a7dc71c8195d813e3b6c56259e33a82b58937967d73bbc
-
Filesize
8B
MD55ca8ad70182fd0396c4deb09fcddc8d9
SHA1e4751ac46ab31dec0c4766454e29076861414bb4
SHA2568075538c244f176eec7865da44033c4b98bb30b53ae3e9158835f7a8eb35b579
SHA5126bbcf0b47067d0563b87c23c9e4a0a69cc9ebbb28332acaa9297624b7223953d956efb5387e4456077bddef3faf45aca4e42850626641ede7bb65045f6b9abed
-
Filesize
8B
MD5e1faa4299a0b854a7e989d279a97916c
SHA1502d603fe7d0ca454a0471bfb62fb8363a9787f4
SHA2565f999a76807fdde5354d47eb42d40837123a19bf74a68af9faf6d923eb5ca1a2
SHA512a48f34ebee810399457c67bb932410e355486a1542c92129b3a0803c57c814d0d7e55496448179583fc5793907bd9a08d74b2df47e4757fd00e5f1f6ae452f23
-
Filesize
8B
MD57bfd6fa224fe98080cbbcab9678770d4
SHA19fd16a4cb8c0af55dd21df5e1c84a4747ebe5f82
SHA256274dca0ab57f5441ba89fbd4a13d2b2fcdf7003c0bee252446e8ec9efa658745
SHA5120253b7e58f5d155f905a8b4f825c354fdfe6521d05cc159f469de89a148b4136b6d2eec342d5e6e385f8459b16e0c2278320a3d01d824c05b31a7a5964b57168
-
Filesize
8B
MD535758e7b95036acd3814fe6b76281835
SHA1ac254721dd4e8be631639bbcdad0a4372a57daf2
SHA256f1c931d47c71f333ef518a92f3e7d8aab23ece0cc07756736197d055956f3d4f
SHA51291fc368b734bac45ce9f1583721e6f66b027ae20efa86a386457cbecf3a366d98e05e43089bb7511a638e423db92d6b4428973a330e12f633a7a6a4af1811a34
-
Filesize
8B
MD53a1fb3fcf3def84a2db5111020414c09
SHA1ddfe14ffe2ab22c91a6504a35a8c986d18045855
SHA256adfe46060df3203e26237109ac00227f6fcf006954ad0c8af691d9e482906fa8
SHA512ef4bb86d17a13d611f45b0f7e56e1a5e400617506a80cbf8b61ae85fca36e2d939ca00b6a0c58aeec02118b0b8490ae4f98498ba54132e91d3886fe9f62a9589
-
Filesize
8B
MD57e89ceab2d26bd546712b9a9cb7c7a65
SHA1cdc15674cea697eb22a3f2f2a12e3ff0b11027d3
SHA2567ba4ac02635fe5e451316ea190a37d63d6c920a689b05f4f07a206940ba2b0df
SHA5122a70f8ee59918e991d75a4689416abb66266a3f2c4366d48aae531cb3eeeba4b5598f09fcaf009f820ed56a27639b5d93f5ec1b0a88d41dfcc538ec90044a4f2
-
Filesize
8B
MD53d49eeeb05b86423794f582407fbd757
SHA11cd4736a73ede18ea9a7ede24e23785b7d4e8c10
SHA256ffc35e7b9ca2255c102849c02a80b8bee4bc96603ee6ae23c3e189cd1e8b6865
SHA51212cec4e97a7e7ab6b903484a99d7ef90404811540e008442acee4359ac467502e38b1eba06aa6ea7119971b7a082b8082e978c6795423445b51d75bf917e8450
-
Filesize
8B
MD5989977e7e2017f5c9eade21b3c2a0b73
SHA1e7fd88be1de0b70bf0ba6e68a1d21ef7cc2bf6c6
SHA256f604ebe74073bf03b7748ae95922fae5e2d1e64c1890048f8669e9dc7dd026ad
SHA512f8f095d7d5a5531370c9740a05b5875dcb0acbd976477c575a009ba8827f834dade44fc5049ec91dbb7931e5973f530913e641d8aa49755ff71e717f56e82994
-
Filesize
8B
MD5c3c8f5ebc2fe3c8ae7c7229445975f35
SHA1d414c961428c02da1a2bdd5b070ad7216712e376
SHA25698b9941c3cc6d3da3f643b8b85bd5039bc9b86e2ca18dd0b057257ec0615cf2f
SHA512ccc40cede04edd4266ea221e8fbcb8d31142ad119db151225a75098b26f5d239cb38b8d41e36723d6ca5ae477caae62020946367369e18e86954726e249202f7
-
Filesize
8B
MD5506fbb6e752fbb78e0200783dd6288d7
SHA159b7e252054414324694988fa31020e813d50415
SHA2565ce4418802988a7fd5c084f87afd6dc9e027368ca6d7fdc52f21f4d25a1f488f
SHA512cbb44a6543359475b34a71e70d8d323af039524f20997fea9534ebb2a2b77739a8544ee16e6b9fec33a4d1c7bf7fc1331598d9dfff323db67b87d3700585b8ba
-
Filesize
8B
MD5d7b3ac8477e36f7d186e9250203e5f14
SHA16c56eb06b92b486054c160d68e018abd86e4f25c
SHA2568dd6101101b2328ef5baa177352ee47df64a3ce6ab6ed04865f6169629e910a2
SHA512a002d28c6b4fea8bd49f4988057941e47cf2ca668d178d86223ce0f27b34138bd80228b65be21c8fb1e6ca3b134808bc2e8e98731b6a3b37f27c35a110303f22
-
Filesize
8B
MD5420c171fe3218e98f986e3fb8701adf1
SHA1adc710d7a57abea6de1849b5419f70d6a7d4cc39
SHA256ae7c8285fcf55211147ceee95fabed185e58efd42ace1ef1a2a4015838851b93
SHA5126ff477eeae81b1243ed0c994c78b297139d12d298ea7dcfa8e923e2aaa61e9e46ba3fefa54adcb0b8304b3aa8d1ae722a05c1436e2af2565e13501a1f201c05f
-
Filesize
8B
MD589b60cfd8790a66b55428874695b754f
SHA163e0a6a52429e33f9bd503ab959dc78b443f3a0f
SHA2562c03c35bb9ede1f79693842e80bb1e8a3f3e058970f7162771cf1fb1ccdd9b6e
SHA512b3548021f5f5673740a886b81721c78fa4983b4f3adb2a57f3bc1fcf1b802577d528b8f5000a2b97b3a58b2b4a563a21eb9fae385cff4c9cb77a5142acd8bdb8
-
Filesize
8B
MD5fb8ecefbb6ffdb37b96ba23ef5cf9f95
SHA1633d9d8718fbe0f0490c70c139d1503e3708eeba
SHA25697a0b4e5197e1c61ca9b45a4b202993319911f5a27dd83d1e47611d0207b2182
SHA512c8963a82c18c64f033370f3c640289eba66b4cf08207026663774326089c6feff29218a0b4a134cad5f9fdba79eb320f49b3a2da0fe720240885fb79d3ad15ac
-
Filesize
8B
MD555c9c3b36058b06d03709eb3817f0581
SHA1896ce8bd34d0e0c797f6e75ca2295ea709e6b53f
SHA25610310c4a13907db9ec832b9e2dc6224f87ce869172eab58bc7240bab9fc516fb
SHA512d24bbe4a45c54b48dab1824af923419f80e45ddfbc16ddfdae3a8531517527af9bf64f06a8bc8b99a2fbcfd8c7af877c2556c82c7c77354af36edb9b6bf6b16f
-
Filesize
8B
MD5e78dfbaf80f13cfdf9d089fe0c82cfb5
SHA134953b7b1e504f5243741699ecb5861e0a0c2aad
SHA2563a2007d352f8acb3cdef13866911df1667c5654687911b55b6de2fa0d23258a5
SHA51204dbee2ec59d0dcf3b2474b7949697e3ca3ff07c62559ac68f3287cf14055e6f287d402b5a28ef8f230c2a972c670837bacb962f3ca61c4b055e746a49571954
-
Filesize
8B
MD5fe8abed94a176e2962cfd24a7b3a0337
SHA10a398c36329164c211e97c6d71d1dfd35c536569
SHA25625e18467896aea9bf64bd966d67b2797cbc0e4d7daa6d0bec7dfbc595642a675
SHA512cdd6249673d5128a5c9ae6b3dd3127d6c05cdd74f8414f9183277f6dbec0b7014adc63db374d5ec4d001bf53fab00a45ee08e2dc56be60d77ba3daf623c166e9
-
Filesize
8B
MD5bc1e5f5a2423cadc985361eb0e2cec41
SHA1ed90f3f949a4e86465b870b208a59d16d3e70d22
SHA256504aa24fc5b7989819c47ce96cbd602ef4bb3ee353018515dadf2949bfbd4ddb
SHA5125ccbb20ad204f9e7a4258bc812855594b59a009bb7d057802d65599d9d1f5ba064dc549ab929e52e33adca3e3450f262ac6f2e8e2eb2405a15921b7c7047d8fe
-
Filesize
8B
MD5ec01ee1490dc78ffdbd93f0ffe997a22
SHA114d02b27a5951728b328df027178a5c1db314455
SHA256bcf03360ef3ecceb975f1ec61bac1fbbce51228d4acc6af8f11066b585bd5117
SHA512f0a93e781e08b637bc930737b6352cd66c0a0156e5fbe2221d3b662bf244ddac4e7330e245e734683e7fc0a81cd5798e560801fbe4b4f78d5b35e36038142fd5
-
Filesize
8B
MD55a9e4b6105288a50dfb4210b932de442
SHA17df5b061a6b52fd4d29e4e849169f8ca1e85094c
SHA25695dd53d268e5277914871500715e431a0bd27793558c84d38363f202a95ee027
SHA51225107678f57a0f7e97350afc0dad6b2d940594e85bed7dd9da85a7091553a75639cf6e0d7a99fcfda1ac0003a6479cc6b60b3e2ab9baf7348697fb9a52e81bb6
-
Filesize
8B
MD5581c0e856730a4fd864f0a13d88f7e51
SHA186e74826e1d18ce9624417b6d6e137e8363fd94d
SHA25694371896a0a1ebc04fae70b50f79a9e421aa6131f88ec0a5f1badbc4b803e15d
SHA512a196de66dabdfb1f18272828e673a18e42af63ffa51d2acdf58fdaf2c1ea06494618f51c22261cf8e60d8c3e128c1ee8f0eeb1d3159b1ac90a98cf8220692003
-
Filesize
8B
MD55f82773cc70e5384e61dec7fba4edb77
SHA118ba510d70d4af96e33a6d9ef5020feebacba33b
SHA25626998b66ba5a9dc9d7e05fa4c35ac4095b254ac1c617a0a068379e3ca305fba3
SHA512361fdbbf1854e2f9f94551fbdc56945c6996a044cce924cae444b4ae4ad56efb0e0eb7afb2bba507f93854d07648116a8c10c6860581e25a87d53fdf1baefe87
-
Filesize
8B
MD5711b0f426afb499601a8932218c0f468
SHA162cfb5a217679711d16bd8f0acc283831edb7a26
SHA256f729013fdc69b07fc065c1fc62f474704ab39537e648d7d719d402bb725ec080
SHA512bfe38e5c62d01909046bf0814b854726ab735187219f222ce6706732509396a78f42bba6846d00c9c8241e17d052c383311c86468d57b8b1b391f346d10cc893
-
Filesize
8B
MD5fc701c5656dc4c7b453a553f49ae770d
SHA18337abd0ea4b04c12f3cf02043308d986ac00852
SHA25677f82a92841eeaa9ccee0a40e6547bc1cc2548325d21700688036b286777bc22
SHA5128c687aed1c29dabe7be0bed15d11e52828256ae8a8b6ba97ab015198adfbd4fbe3ccc2e6471fa91ba51391c219a7d1fe1f4b9648b0f5f572191531cf6591371b
-
Filesize
8B
MD5eede984ec652998aafd8ae59fbd5753d
SHA13434567cc0de067dc812b9110a3bc0c9a05ff34c
SHA2565305bdec6f9f8569e8235769f298b4febf333572ef4cf08a242ea794b8d0b451
SHA512772578cedb5e75db7456d46adc2e3178317395fada9162cd686da89ea946de6830a76b8792c0ddde757b758919633a76f27a9a6c018ee1b9a3bd6a7bbb51ba31
-
Filesize
8B
MD579f7021d50b42b8fcbb917701a1d14ba
SHA12969f3aac4be31f0e17749083ab494ca5fbb48e2
SHA256d4e48050d631ee8e0c7c72a82dc1504a8973d6d7596625941944d076152f5b5e
SHA5129e82186ef07094d70681cfb10a0500ecfbcff2ccf6585b0563ef57767f309d27168dd8dcac31af4aac59ac6de45466277f150b922ae77c9ec736a46e54d66ebe
-
Filesize
8B
MD51083e691e0919f6999f9802ec4d7760f
SHA1bb7855cb12c37f598b74622b35005546551fef3a
SHA2561660f22e628c8225345f92debadc9855e13e002bd2e5ada69593f9c0bf590842
SHA512cec3a6ce907cc5fe271383dcd4e5bd3545921feea840ce832964dda7c5e6bc369a6487350607a5226a4601692fb6f9ce7c470bbfb6afd655916a5e09691ad2a6
-
Filesize
8B
MD5470e245147124598858c70a6c9316986
SHA13c45c7d0ae0e27b6ec7b07883235107580c03271
SHA2565a145cf444549f11142a91ac0307b62c752be0ca0f3bc33115bbae7c4c617ded
SHA5123bc83a26328a714a97821741404ae31374cfe6083d430fa4ea2540b821124f36df350568d278f17cd4857cea4901063e09d1da02326eabf9bba9460288c66872
-
Filesize
8B
MD5104afb30676c0d1485bfe666d05536aa
SHA17cd4143604cf3dd3e837120e915304be7027238f
SHA256f42b1fe42c8f9223bb0884f353342047bd231114a68101d28de2d2ece0d4a7f7
SHA5123173c6ff1faecdbba7fb0751c884327a901a9b7cfcdf6d75303829a75ee518ba2eebc085c218ceb4641fc3ea110882064b0348490a20bc3d4958a7e5ee8ffab6
-
Filesize
8B
MD5e57f9cb9b3702a4a0b875998250d9729
SHA1149a2eb2ce87bd6288142a446088e5ef3562dcde
SHA25625bc66e5521c4e4b93b048f4ef4e00223f163be2fc6baacb803a5c1d5100c2f6
SHA512ddce0717b81bbc3058e5b15b672425a1732bfef8e17fe905b4e75a42536a6693ab20f403b17a631851025f5077f3d01994f5e2aa1a5d2a7bd08bdb1fe6c10836
-
Filesize
8B
MD5a1d1f22f190f34a189f5aa35b175572b
SHA10a1d006cedc062135b24d6d338e8ce0cbcf3f97c
SHA256fb4731dde727882f897264f67c63d287b087fd4fd69a7b78cf4191c46f0fd39a
SHA512b20766182a05066658cde6dca9e111f70293f7b4ee5dfe55ad74e9849e804f722a83412527b039cf04b97e066f3164d4d0ec2cc8d465ecd6c71532538c31ac38
-
Filesize
8B
MD54c87ce4d5476cb9f556469a4fc7fd1de
SHA12a9e2fe339498f676b2898fae48f613e66dabf0e
SHA256b21afba7538d4e111607c74743e021c3892bd87a50b16b44000f279866165b22
SHA512278c4648af699baa3d4b4601ab8f1daed725822131e4e4ab7e01d0dac2f16190cc8af5ba9f4610d40dcefa53cee497e7493b3822b14cbf734ec0b72616add703
-
Filesize
8B
MD56754271f6c660ed50cecf78cf54dd922
SHA1dbb0ebd469608e67ef9b92a322e35fe85aec0670
SHA25600501db29e016e4564aea75c8ab99fe03d0b0464d5c17c26b7598bb4ba1280ee
SHA51293c93e72282d2ff16dfb579b6194b022b4d9a5772830294c1a5d796368b2a7360a61590508804ed5167baef599f5113830102662371bff966c6f7892939d98a0
-
Filesize
8B
MD536c0ed0aec0e7710e2c681bb99170915
SHA17445e32c245ff41df0bafb6c52536704bed7a7e7
SHA256502b9b7b70de3b3839479ceb028113d4ef645d495f55f13fa2b8d5fca4e06a6d
SHA512a2700dc860857ced51d87ad67f35bdf53817390057b385d46ed71ce9485d23d98eb3f247264ca93eb57b7f86e65a19b7306ea55d4de2749ee80e4b451a45ffe7
-
Filesize
8B
MD5e8b8c05496805758c68db362071ba0f2
SHA1b76bd08a87f307e9878186f90b3cc5fda920cde6
SHA25676fe1f2d1a253e13196684cbdf7b95955cbe3aaef59220a97baeb13bf1c4e0c7
SHA5123a4a63f34857f323ec89627285cad16442ec304b6c19a561ca92a531eca0a423f9113e0a0d8829d203fb504fa305bd81c83fed663cf56bb12cb5387fbe1e0975
-
Filesize
8B
MD5273d62bd668733cd63c3f5d3c6d5725d
SHA1e41d8affe1fa53b47bd7dedb9ecd6c9161044a22
SHA256a9782d9da601356d4c448e22bac60d3297828062e20b36324396d26d691ba7a5
SHA51271995f56c9ce7a55839841d21724aa3fd441a2412bafd3a8d3bfb9b202f381ed25049df2a0c28c9d4b01856f5f64f9e9a86867884220f5b5b548110c16420c4d
-
Filesize
8B
MD5af66c37631764b1bb65e2fc96a26aff3
SHA1276023de5f4c915524e0d8d80341177deccc5301
SHA256ced766f94ffa364ae13df74fb397e9727c3cb4aafb245d8b87f6a2ae934754fb
SHA512fb25ae3131021ffda60420f74283ea2b7323a18f6a2a5263766b531d87e19b479617588740c790085470c4b0f40b6159cfcd776c4d2cabf27afe4b6156672ba4
-
Filesize
8B
MD53c9932dae74dccc91827a82f0e39f151
SHA14c1bdab721aa11b424bd89ec22165af43fc7082e
SHA25649819be253d84338b9080aaef462a15ccd169d9d02c4174e9fcd17720d10815c
SHA5120d45b49966b898dc0b7f9ae5469b28d17ac852cf64366d52ebf96d81cc0fc8c614922e07aa3f450f8279f83180610957ee75911f84df4e876251e6ed34a742eb
-
Filesize
8B
MD56c950fd79985051b7061321379b8f702
SHA1f52576d36cb856047b00b40ee4a6d0a62b7697c6
SHA2567797149e2431cb095c4a850758bc0b0e921e7bc4a47189854b580543fee8139a
SHA512628c8d128ea6058f93412e640c7994c47ef73ffa7d0b4b11e4300e0a537360957f7f4f34fde5dddd3fa9b6cdb60f09a594602fe2061d1e436d6bffadc856975d
-
Filesize
8B
MD5f4a10c8685dbaa50c5e2bb1458eb25ba
SHA1d45bf198fe4054290da15633d385b9e2a7e71dd5
SHA256c6b1a6e5848042dbc28321e90fba690ee91faded7be0780f30f2edc9fbf5b5f8
SHA5123ce508ce3f126d947582550701ecd4bc07e54c2394b98279440b252a59c9723a93573205d35065b4129ab51ff92a3043c82212371df7a8715fe1d26646886619
-
Filesize
8B
MD5a99615d085f4dd4d2b7411520a489383
SHA11528839f312f5d96a4aedb07a6fa6dfd681c9b83
SHA256b8a020b68567c05553173e81229436d94fb1b22681f61394caac0592cf24316f
SHA512113c7015706e222027ac09e8f12aeb674aa7b6771b8956fff138a78c705dd0463569e3abcef16104a37aa5002b3f75d9dc8ff4f988d4ded01335ba51d5de667b
-
Filesize
8B
MD5d7c29703ff7dc789f9aa9dd4698924a6
SHA1fd6dedc7a21eed0e00958153f1555d7e35487f77
SHA256c8029598d3ed9a8fd3f81e2cba8f03403e37b86f2db4bb6790e3dc16ed77de74
SHA5121a8075189b20b5b1cb42b9f6041dcbdd0e68ae3526b35bbafdb0516d088db47409879ac4defe250ac136191da89abbb9ab2c73359cde5782325240e30b1c9f0c
-
Filesize
8B
MD5e7568517414cd7f45ce9b320026b792f
SHA1a9f31c8e4b2be45da3cfe10b388980b5f6296b69
SHA256c503b6e60bdaf67bf4c3e8bfee08668ae71efebf02e44455dd36ef20c0157a18
SHA5122237c0467935a81430aa8f70a13513f7db3be820c41fa3014db90366d64d5080b87afc7bf969f6853b173adeda3e9e02846b17d44c9c915a1f6a6bdd4255c52d
-
Filesize
8B
MD57f5047fc0c3dca78c7ef505514996c5a
SHA1311ccc080296272d6a115bab8d742431b12ec31c
SHA256561d5376f3d2d4b23bb61d5709588139076f7c5955c750a8fe329f0630a264ef
SHA5122d89084f2530475f171c6094b1f3d384522e3c7164d06fcbe3390a3605a1c6422eca723cf2c6d4cc4fa5b2d0fdd02d9373eb979847ff438e7e207c86e3607ee8
-
Filesize
15B
MD5bf3dba41023802cf6d3f8c5fd683a0c7
SHA1466530987a347b68ef28faad238d7b50db8656a5
SHA2564a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
-
Filesize
552KB
MD511b518a4746e388d6cf19dd90c5590e4
SHA1f2fae24804c1743b0c5b1e05083b8a44c15ad59b
SHA256e9e38fd5709db5467537128fe6ecbd40caaa18053ebd005255be0313f79ab923
SHA5124cfbe4796a530422399907d4240d8e7455db81d0485c89e42d33bef736845d1ed01f92bcff1850631337667bcfd90ecd9918ba3458bd3aaf7068457f9661d6f1