Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1NetSupport...03.zip
windows7-x64
1NetSupport...03.zip
windows10-2004-x64
1Client32.ini
windows7-x64
1Client32.ini
windows10-2004-x64
1NSM.lic
windows7-x64
3NSM.lic
windows10-2004-x64
3NSS.ini
windows7-x64
1NSS.ini
windows10-2004-x64
1NetSupport...03.exe
windows7-x64
10NetSupport...03.exe
windows10-2004-x64
10NetSupportInstall.bat
windows7-x64
10NetSupportInstall.bat
windows10-2004-x64
10client32u.ini
windows7-x64
1client32u.ini
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
NetSupport School Student 15.10.0003.zip
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
NetSupport School Student 15.10.0003.zip
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
Client32.ini
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Client32.ini
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
NSM.lic
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
NSM.lic
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
NSS.ini
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
NSS.ini
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
NetSupport School 15.10.0003.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
NetSupport School 15.10.0003.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
NetSupportInstall.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
NetSupportInstall.bat
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
client32u.ini
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
client32u.ini
Resource
win10v2004-20250129-en
General
-
Target
NetSupport School 15.10.0003.exe
-
Size
146.9MB
-
MD5
50c6a195ea8b2cac825a3bd2b2e5d5f7
-
SHA1
7704b7bc735066139657919cc589fef8fdfd76a1
-
SHA256
f1f0d729245cd9272510e8fd258708ead8ed7ab0db39343c6f69cf9d35a35c2b
-
SHA512
838332cb950b70aef47ffbff2dbb1503b26ee0fcb702376fbf6633e00bd33aa2b8add3432b28ce79ce0b44d51a7812dbb9c749782d4efc21c5df7c7a78a53088
-
SSDEEP
3145728:7ghv5tQmlmVPMfix3deHWzomfJ4dbOO+2iX3gvB159GRiYDNAC77:7gF7QmlmVPguPRfy62KwvO/BAe
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\nskbfltr.sys winst64.exe File created C:\Windows\system32\drivers\nskbfltr2.sys winst64.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nskbfltr\ImagePath = "\\SystemRoot\\system32\\drivers\\nskbfltr.sys" MSI90C9.tmp -
Blocklisted process makes network request 2 IoCs
flow pid Process 18 4840 MSIEXEC.EXE 20 4840 MSIEXEC.EXE -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: runplugin.exe File opened (read-only) \??\Z: runplugin.exe File opened (read-only) \??\A: runplugin64.exe File opened (read-only) \??\O: runplugin64.exe File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: runplugin64.exe File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: runplugin.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: runplugin.exe File opened (read-only) \??\L: runplugin64.exe File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: runplugin64.exe File opened (read-only) \??\H: runplugin64.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: runplugin.exe File opened (read-only) \??\X: runplugin.exe File opened (read-only) \??\M: runplugin.exe File opened (read-only) \??\N: runplugin.exe File opened (read-only) \??\F: runplugin.exe File opened (read-only) \??\N: runplugin64.exe File opened (read-only) \??\T: runplugin64.exe File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: runplugin.exe File opened (read-only) \??\U: runplugin64.exe File opened (read-only) \??\Z: runplugin64.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: runplugin64.exe File opened (read-only) \??\R: runplugin64.exe File opened (read-only) \??\H: runplugin.exe File opened (read-only) \??\U: runplugin.exe File opened (read-only) \??\B: runplugin64.exe File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\G: runplugin.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: runplugin.exe File opened (read-only) \??\S: runplugin64.exe File opened (read-only) \??\W: runplugin64.exe File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\S: runplugin.exe File opened (read-only) \??\V: runplugin64.exe File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: runplugin.exe File opened (read-only) \??\I: runplugin64.exe File opened (read-only) \??\E: runplugin64.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: runplugin.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "0" MSI90C9.tmp -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\client32provider.dll winst64.exe File opened for modification C:\Windows\system32\client32provider.dll winst64.exe File created C:\Windows\SysWOW64\pcimsg.dll MSI90C9.tmp File opened for modification C:\Windows\SysWOW64\pcimsg.dll MSI90C9.tmp -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1644 pcicfgui_setup.exe 1644 pcicfgui_setup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-errorhandling-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-namedpipe-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\remcmdstub.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-datetime-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\NSS32.chm msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-libraryloader-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PCIMSG.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pluginprintmanmodule64.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\injlib.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\NSSecurity.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-rtlsupport-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-runtime-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\KeyShowHook64.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pciver.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PluginCountersModule.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\DeskDup.dll msiexec.exe File created C:\Program Files (x86)\Common Files\NSL\NSCommonHook.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\nssres_125.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\supporttool.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\mfc100u.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\StudentSelected.wav msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\LoopbackUnblocker.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\msvcp100.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\mfc140u.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-string-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\msvcp140.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\nsdevcon64.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-private-l1-1-0.dll msiexec.exe File opened for modification C:\Program Files (x86)\NetSupport\NetSupport School\_Data.lnk MSI90C9.tmp File created C:\Program Files (x86)\NetSupport\NetSupport School\icudt51.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\StoreInvDll.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\product.dat msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PCICHEK.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\vcruntime140.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pcicapi.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\blockapp.jpg msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\StudentCorrect.wav msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\nssres_150.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-math-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PCIIMAGE.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PluginDevicesModule.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pcivideovi.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\icule51.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\_Data.lnk MSI8F12.tmp File created C:\Program Files (x86)\NetSupport\NetSupport School\pluginiemodule.DLL msiexec.exe File created C:\Program Files (x86)\Common Files\NSL\winstHooks.dll msiexec.exe File opened for modification C:\Program Files (x86)\NetSupport\NetSupport School\client32u.ini MSI90C9.tmp File created C:\Program Files (x86)\NetSupport\NetSupport School\wxmsw322u_core_vc_custom.dll msiexec.exe File opened for modification C:\Program Files (x86)\NetSupport\NetSupport School\client32u.ini checkdvd.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\DBI.EXE msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PCIHOOKS.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\keyshowhook.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\x64\gdihook5.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pcisys.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\StoreSoftwareCtl.dll msiexec.exe File opened for modification C:\Program Files (x86)\NetSupport\NetSupport School\client32.ini pcicfgui_setup.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-heap-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-localization-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PCIAPPCTRL.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\keyshow.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\ismetro.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-file-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\gdihook5.cat msiexec.exe -
Drops file in Windows directory 58 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI80DE.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\schdesigner.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI8F12.tmp msiexec.exe File created C:\Windows\Installer\e58783a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9BB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8050.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcideply.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\VideoShortcutWin7Abo_484D413D0D3342A2A692F037061C1AA9.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI7EF4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI852A.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut5_0CEE40B1A09F47C29DE0582B6A44A9EC_1.exe msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI7FD1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8060.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI852B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8869.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut3_80D45F4DD8E3472CB2C7080AAA34AB2A.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI8EF2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7FC0.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut3_80D45F4DD8E3472CB2C7080AAA34AB2A.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI980E.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut8_134A4E1756504D7CA2A1E16C4AA879D9.exe msiexec.exe File opened for modification C:\Windows\setupact.log MSI90C9.tmp File opened for modification C:\Windows\Installer\MSI7C6F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8352.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcinssui.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI8312.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI90C9.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcideply.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut8_134A4E1756504D7CA2A1E16C4AA879D9.exe msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\VideoShortcutWin7Abo_484D413D0D3342A2A692F037061C1AA9.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI84EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7C92.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7C81.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut1_1045CC3CC07549BB86C478A6B724F98D.exe msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut1_1045CC3CC07549BB86C478A6B724F98D.exe msiexec.exe File opened for modification C:\Windows\setuperr.log MSI90C9.tmp File opened for modification C:\Windows\Installer\MSI7C70.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut5_0CEE40B1A09F47C29DE0582B6A44A9EC_1.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI8645.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7FE1.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut4_28874BA5F8594ADCBE8AB571ECB4C1AB.exe msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcinssui.exe1_28874BA5F8594ADCBE8AB571ECB4C1AB.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{F021B863-9473-4467-93B2-6FC48C30E42F} msiexec.exe File opened for modification C:\Windows\Installer\MSI8323.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut4_28874BA5F8594ADCBE8AB571ECB4C1AB.exe msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\schdesigner.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI97CF.tmp msiexec.exe File created C:\Windows\Installer\e587838.msi msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcinssui.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcinssui.exe1_28874BA5F8594ADCBE8AB571ECB4C1AB.exe msiexec.exe File opened for modification C:\Windows\Installer\e587838.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI83E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7BA3.tmp msiexec.exe -
Executes dropped EXE 18 IoCs
pid Process 3764 NetSupport School 15.10.0003.exe 4720 MSI8060.tmp 4404 MSI80DE.tmp 2856 MSI8645.tmp 1916 checkdvd.exe 4492 MSI8F12.tmp 1308 MSI90C9.tmp 3520 winst64.exe 1644 pcicfgui_setup.exe 4816 pcicfgui_setup.exe 1516 MSIB030.tmp 1892 client32.exe 4044 client32.exe 3848 winst64.exe 4824 runplugin.exe 3484 runplugin64.exe 3132 runplugin.exe 656 runplugin64.exe -
Loads dropped DLL 64 IoCs
pid Process 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 4900 MsiExec.exe 4900 MsiExec.exe 4900 MsiExec.exe 4900 MsiExec.exe 4900 MsiExec.exe 3520 winst64.exe 1308 MSI90C9.tmp 4900 MsiExec.exe 4208 MsiExec.exe 1644 pcicfgui_setup.exe 1644 pcicfgui_setup.exe 1644 pcicfgui_setup.exe 1644 pcicfgui_setup.exe 1644 pcicfgui_setup.exe 4208 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 2784 MsiExec.exe 1892 client32.exe 1892 client32.exe 1892 client32.exe 1892 client32.exe 1892 client32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runplugin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI8645.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language checkdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI90C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NetSupport School 15.10.0003.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecEdit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pcicfgui_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI80DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIB030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runplugin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NetSupport School 15.10.0003.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI8F12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation_old_student = "PMEM" client32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation = "PMIL" client32.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-15 = "Balanced" client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-13 = "High performance" client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-11 = "Power saver" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\"" MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\"" MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692} winst64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\Common = "NSS" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\ = "&Show with NetSupport School" MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\NetSupport_Tutor_Templates = "\x06Tutor" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\AuthorizedLUAApp = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\EditFlags = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.rpf msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\TechConsole = "\x06NSS" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\NameServer = "\x06NSS" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\TestDesigner = "\x06NSS" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\943C1EEA70369E845B409AAF32BEB8CD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\PackageName = "NetSupport School.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\BrowserFlags = "8" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show MSI90C9.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\client32.exe\" /r\"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\"" MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\DesktopShortcutFeature = "\x06Tutor" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\TutorStudentUpgradeFiles = "\x06TechConsole" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{E1A0795D-2056-471C-B277-236D085EFB11}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\ = "Play" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\ = "&Show with NetSupport School" MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\command MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ThreadingModel = "Apartment" winst64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\Student = "NSS" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\UseOnlineHelpYes = "Common" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\RemoteDeploy = "\x06Tutor" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\PackageCode = "FB5CF6184E1C03947993AD8D0BD0DFCB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\Version = "252313603" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\DefaultIcon\ = "C:\\Program Files (x86)\\NetSupport\\NetSupport School\\PCIVideo.exe,1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rpf\ = "NSReplayFile" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\"" MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\Tutor = "\x06NSS" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\ReplayConversion = "\x06NSS" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{E1A0795D-2056-471C-B277-236D085EFB11}\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\ = "&Show with NetSupport School" MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\DesktopTCShortcut = "\x06TechConsole" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\command MSI90C9.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile MSI90C9.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\943C1EEA70369E845B409AAF32BEB8CD\368B120F37497644392BF64CC8034EF2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32 winst64.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4044 client32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2784 MsiExec.exe 2784 MsiExec.exe 3444 msiexec.exe 3444 msiexec.exe 1308 MSI90C9.tmp 1308 MSI90C9.tmp 1308 MSI90C9.tmp 1308 MSI90C9.tmp 1892 client32.exe 1892 client32.exe 4044 client32.exe 4044 client32.exe 3484 runplugin64.exe 3484 runplugin64.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4824 runplugin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4840 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 4840 MSIEXEC.EXE Token: SeSecurityPrivilege 3444 msiexec.exe Token: SeCreateTokenPrivilege 4840 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 4840 MSIEXEC.EXE Token: SeLockMemoryPrivilege 4840 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 4840 MSIEXEC.EXE Token: SeMachineAccountPrivilege 4840 MSIEXEC.EXE Token: SeTcbPrivilege 4840 MSIEXEC.EXE Token: SeSecurityPrivilege 4840 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 4840 MSIEXEC.EXE Token: SeLoadDriverPrivilege 4840 MSIEXEC.EXE Token: SeSystemProfilePrivilege 4840 MSIEXEC.EXE Token: SeSystemtimePrivilege 4840 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 4840 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 4840 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 4840 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 4840 MSIEXEC.EXE Token: SeBackupPrivilege 4840 MSIEXEC.EXE Token: SeRestorePrivilege 4840 MSIEXEC.EXE Token: SeShutdownPrivilege 4840 MSIEXEC.EXE Token: SeDebugPrivilege 4840 MSIEXEC.EXE Token: SeAuditPrivilege 4840 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 4840 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 4840 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 4840 MSIEXEC.EXE Token: SeUndockPrivilege 4840 MSIEXEC.EXE Token: SeSyncAgentPrivilege 4840 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 4840 MSIEXEC.EXE Token: SeManageVolumePrivilege 4840 MSIEXEC.EXE Token: SeImpersonatePrivilege 4840 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 4840 MSIEXEC.EXE Token: SeCreateTokenPrivilege 4840 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 4840 MSIEXEC.EXE Token: SeLockMemoryPrivilege 4840 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 4840 MSIEXEC.EXE Token: SeMachineAccountPrivilege 4840 MSIEXEC.EXE Token: SeTcbPrivilege 4840 MSIEXEC.EXE Token: SeSecurityPrivilege 4840 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 4840 MSIEXEC.EXE Token: SeLoadDriverPrivilege 4840 MSIEXEC.EXE Token: SeSystemProfilePrivilege 4840 MSIEXEC.EXE Token: SeSystemtimePrivilege 4840 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 4840 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 4840 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 4840 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 4840 MSIEXEC.EXE Token: SeBackupPrivilege 4840 MSIEXEC.EXE Token: SeRestorePrivilege 4840 MSIEXEC.EXE Token: SeShutdownPrivilege 4840 MSIEXEC.EXE Token: SeDebugPrivilege 4840 MSIEXEC.EXE Token: SeAuditPrivilege 4840 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 4840 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 4840 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 4840 MSIEXEC.EXE Token: SeUndockPrivilege 4840 MSIEXEC.EXE Token: SeSyncAgentPrivilege 4840 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 4840 MSIEXEC.EXE Token: SeManageVolumePrivilege 4840 MSIEXEC.EXE Token: SeImpersonatePrivilege 4840 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 4840 MSIEXEC.EXE Token: SeCreateTokenPrivilege 4840 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 4840 MSIEXEC.EXE Token: SeLockMemoryPrivilege 4840 MSIEXEC.EXE -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 4840 MSIEXEC.EXE 4840 MSIEXEC.EXE 4044 client32.exe 4044 client32.exe 4044 client32.exe 4044 client32.exe 4044 client32.exe 4044 client32.exe 4044 client32.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4044 client32.exe 4044 client32.exe 4044 client32.exe 4044 client32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3848 winst64.exe 4824 runplugin.exe 3484 runplugin64.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4120 wrote to memory of 3764 4120 NetSupport School 15.10.0003.exe 83 PID 4120 wrote to memory of 3764 4120 NetSupport School 15.10.0003.exe 83 PID 4120 wrote to memory of 3764 4120 NetSupport School 15.10.0003.exe 83 PID 3764 wrote to memory of 4840 3764 NetSupport School 15.10.0003.exe 84 PID 3764 wrote to memory of 4840 3764 NetSupport School 15.10.0003.exe 84 PID 3764 wrote to memory of 4840 3764 NetSupport School 15.10.0003.exe 84 PID 3444 wrote to memory of 2784 3444 msiexec.exe 89 PID 3444 wrote to memory of 2784 3444 msiexec.exe 89 PID 3444 wrote to memory of 2784 3444 msiexec.exe 89 PID 4840 wrote to memory of 1944 4840 MSIEXEC.EXE 92 PID 4840 wrote to memory of 1944 4840 MSIEXEC.EXE 92 PID 4840 wrote to memory of 1944 4840 MSIEXEC.EXE 92 PID 1944 wrote to memory of 1296 1944 cmd.exe 94 PID 1944 wrote to memory of 1296 1944 cmd.exe 94 PID 1944 wrote to memory of 1296 1944 cmd.exe 94 PID 4840 wrote to memory of 2312 4840 MSIEXEC.EXE 95 PID 4840 wrote to memory of 2312 4840 MSIEXEC.EXE 95 PID 4840 wrote to memory of 2312 4840 MSIEXEC.EXE 95 PID 2312 wrote to memory of 2104 2312 cmd.exe 97 PID 2312 wrote to memory of 2104 2312 cmd.exe 97 PID 2312 wrote to memory of 2104 2312 cmd.exe 97 PID 3444 wrote to memory of 3672 3444 msiexec.exe 106 PID 3444 wrote to memory of 3672 3444 msiexec.exe 106 PID 3444 wrote to memory of 4208 3444 msiexec.exe 108 PID 3444 wrote to memory of 4208 3444 msiexec.exe 108 PID 3444 wrote to memory of 4208 3444 msiexec.exe 108 PID 3444 wrote to memory of 4720 3444 msiexec.exe 109 PID 3444 wrote to memory of 4720 3444 msiexec.exe 109 PID 3444 wrote to memory of 4404 3444 msiexec.exe 111 PID 3444 wrote to memory of 4404 3444 msiexec.exe 111 PID 3444 wrote to memory of 4404 3444 msiexec.exe 111 PID 3444 wrote to memory of 4900 3444 msiexec.exe 112 PID 3444 wrote to memory of 4900 3444 msiexec.exe 112 PID 3444 wrote to memory of 4900 3444 msiexec.exe 112 PID 3444 wrote to memory of 2856 3444 msiexec.exe 113 PID 3444 wrote to memory of 2856 3444 msiexec.exe 113 PID 3444 wrote to memory of 2856 3444 msiexec.exe 113 PID 3444 wrote to memory of 1916 3444 msiexec.exe 114 PID 3444 wrote to memory of 1916 3444 msiexec.exe 114 PID 3444 wrote to memory of 1916 3444 msiexec.exe 114 PID 3444 wrote to memory of 4492 3444 msiexec.exe 115 PID 3444 wrote to memory of 4492 3444 msiexec.exe 115 PID 3444 wrote to memory of 4492 3444 msiexec.exe 115 PID 3444 wrote to memory of 1308 3444 msiexec.exe 116 PID 3444 wrote to memory of 1308 3444 msiexec.exe 116 PID 3444 wrote to memory of 1308 3444 msiexec.exe 116 PID 1308 wrote to memory of 3520 1308 MSI90C9.tmp 117 PID 1308 wrote to memory of 3520 1308 MSI90C9.tmp 117 PID 3444 wrote to memory of 888 3444 msiexec.exe 118 PID 3444 wrote to memory of 888 3444 msiexec.exe 118 PID 888 wrote to memory of 1368 888 cmd.exe 120 PID 888 wrote to memory of 1368 888 cmd.exe 120 PID 888 wrote to memory of 1368 888 cmd.exe 120 PID 3444 wrote to memory of 1644 3444 msiexec.exe 121 PID 3444 wrote to memory of 1644 3444 msiexec.exe 121 PID 3444 wrote to memory of 1644 3444 msiexec.exe 121 PID 1644 wrote to memory of 4816 1644 pcicfgui_setup.exe 122 PID 1644 wrote to memory of 4816 1644 pcicfgui_setup.exe 122 PID 1644 wrote to memory of 4816 1644 pcicfgui_setup.exe 122 PID 4840 wrote to memory of 1516 4840 MSIEXEC.EXE 124 PID 4840 wrote to memory of 1516 4840 MSIEXEC.EXE 124 PID 4840 wrote to memory of 1516 4840 MSIEXEC.EXE 124 PID 1892 wrote to memory of 4044 1892 client32.exe 126 PID 1892 wrote to memory of 4044 1892 client32.exe 126 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2104 attrib.exe 1296 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NetSupport School 15.10.0003.exe"C:\Users\Admin\AppData\Local\Temp\NetSupport School 15.10.0003.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\{E1A0795D-2056-471C-B277-236D085EFB11}\NetSupport School 15.10.0003.exe"C:\Users\Admin\AppData\Local\Temp\{E1A0795D-2056-471C-B277-236D085EFB11}\NetSupport School 15.10.0003.exe" /q"C:\Users\Admin\AppData\Local\Temp\NetSupport School 15.10.0003.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{E1A0795D-2056-471C-B277-236D085EFB11}" /IS_temp2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{E1A0795D-2056-471C-B277-236D085EFB11}\NetSupport School.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="NetSupport School 15.10.0003.exe"3⤵
- Blocklisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\nsm.lic4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\attrib.exeATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\nsm.lic5⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1296
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\nsm.lic4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\attrib.exeATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\nsm.lic5⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2104
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSIB030.tmp"C:\Users\Admin\AppData\Local\Temp\MSIB030.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EI4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\system32\explorer.exe3⤵PID:4204
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 683D73B484374950D02BFAE34CE8BBBC C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3672
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A21902484077F4A0476F7F9125DDFC872⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4208
-
-
C:\Windows\Installer\MSI8060.tmp"C:\Windows\Installer\MSI8060.tmp" /p "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\Detect64LSP.txt"2⤵
- Executes dropped EXE
PID:4720
-
-
C:\Windows\Installer\MSI80DE.tmp"C:\Windows\Installer\MSI80DE.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4404
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 53FDD07F83D71AD1D4FD607C1FB2A8F2 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4900
-
-
C:\Windows\Installer\MSI8645.tmp"C:\Windows\Installer\MSI8645.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\checkdvd.exe"C:\Program Files (x86)\NetSupport\NetSupport School\checkdvd.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1916
-
-
C:\Windows\Installer\MSI8F12.tmp"C:\Windows\Installer\MSI8F12.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EC /Q /Q /C2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4492
-
-
C:\Windows\Installer\MSI90C9.tmp"C:\Windows\Installer\MSI90C9.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EV"NetSupport School" /EC /Q /Q /I *2⤵
- Sets service image path in registry
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Program Files (x86)\NetSupport\NetSupport School\winst64.exewinst64.exe /q /q /i3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3520
-
-
-
C:\Windows\system32\cmd.execmd.exe /c secedit /configure /areas SECURITYPOLICY /db hisecws.sdb /cfg "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\NS.inf" /log "C:\Program Files (x86)\NetSupport\NetSupport School\sec.log" /overwrite /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\SecEdit.exesecedit /configure /areas SECURITYPOLICY /db hisecws.sdb /cfg "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\NS.inf" /log "C:\Program Files (x86)\NetSupport\NetSupport School\sec.log" /overwrite /quiet3⤵
- System Location Discovery: System Language Discovery
PID:1368
-
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe"C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe" /Q "C:\Program Files (x86)\NetSupport\NetSupport School\Client32.ini"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe"C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe"3⤵
- Executes dropped EXE
PID:4816
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:936
-
C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" /* *1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" * /VistaUI2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4044 -
C:\Program Files (x86)\NetSupport\NetSupport School\winst64.exe"C:\Program Files (x86)\NetSupport\NetSupport School\winst64.exe" /Q /Q /EBc004e,03⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3848
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe" /USER=SYSTEM3⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4824
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe" /USER=SYSTEM3⤵
- Enumerates connected drives
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3484
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"3⤵
- Executes dropped EXE
PID:656
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD524fb6de87f5cc8d0868ceb2daa81ff3a
SHA19a6792bc8b262c6453469679f213b720b27d89ec
SHA2560c238b4a2accac3a252b1cd387c1b1f705c7a1f23fce5c40c76f890b53d91cb3
SHA51275b37e996758289d150a6664602b5d929cd9767b43cdf08622f1d8b153d2bb1a6fede58ac07b33ce51de7a2088369fc2ed0fb675c877e05f243b484a8dc578e8
-
Filesize
745KB
MD50228cb02aa58ef2876713130990c8ccf
SHA1f6766273a186b6911a6127fbb5af90125e267bbe
SHA2563651a2131f423c5c553476236be7ad4f26a63c67d872c3b9ecc135d1d184b1ed
SHA512a07664e639252a2bd34f42fb6907b95889d31657aa81fcdeea4b171bf3410bd3d56f5e404ee8fc16938d826f7cfffc46efcfe74126afec6e87cb048618d26e89
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetSupport School\NetSupport School Student Configurator.lnk
Filesize2KB
MD501d199eb7ba846d19cfc2ef5343ce9cb
SHA1484dfae304d6c84b1a833e0122e14d5f87387936
SHA256608d0197a3d8190798339dd242d5feb2bf589807819821dd68ee146be80d0d2d
SHA512079fafe7dcde087ce30ef3c47527c4199c0664da56eeee5e21a7edf4889d8898d2ebefa29ec9d57b6d287c2b2a08c920aff2119c7ab4a8c60070fa5de28da314
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetSupport School\NetSupport School Student Configurator.lnk~RFe588ebe.TMP
Filesize2KB
MD57fb7b00a900d73158725e2905cd36e0f
SHA1d3bf667764c58375b8e254cf9362dd3badbbf4d0
SHA2568bc6b5aafd80c0f911286305a773d476fa1f533b91ed4633ad3bd5a759fc399a
SHA512cb89ca56d05ba3eafe59e61c36061e072c50dc6d775d111c5c1d1065547caef87020afcfcd597e67ebbe69abac0b27159dc80c2c7327f5356eb56d148e2ff8d0
-
Filesize
4KB
MD538b642a187d0cb73c7390cddb0581355
SHA1b58394979b5768e8ebb95a5a0439a556cf047a1b
SHA256ff87e93a5534020188cd3b7c21a81950b3f90774397a65beaddffc1743c3da8d
SHA512d4bccdff7ec778a5bab748d0ff6cc36ffd8588e2709306a237ef5dde06293708293b7a8a774022138da4b13b361ead6eee7978b02803ac11b5d1ae2c2ab327d3
-
Filesize
169KB
MD50e6fda2b8425c9513c774cf29a1bc72d
SHA1a79ffa24cb5956398ded44da24793a2067b85dd0
SHA256e946b2fae0b36c43064463a8c16a2774adac30c4188c5af90e9338b903c501c9
SHA512285bb7759a1214abed36162ac8be2d48df17a05278c4de97562448e20fd43b635563a6819f37e23d92a5f5ed0205a68bffe43dac0d3a67513bd0303b4e7f89aa
-
Filesize
511KB
MD5d524b639a3a088155981b9b4efa55631
SHA139d8eea673c02c1522b110829b93d61310555b98
SHA25603d91c8cd20b846625a092a3dae6a12369930c65d6216a455a00449ebb0dc289
SHA51284f8ab54122f93a40da08fd83bca767ab49eb0f73c4ab274d9bda11dd09224134df011fa02e5a3abbafcc6fbef6a60673dd48feabdf829a1e22c85a2a759b7ac
-
Filesize
487KB
MD5d21afcbb8d2e5a043841b4d145af1df6
SHA1849db8ddad9e942bfe20a50666d17484b56a26e3
SHA256c9d4fd904650e4e53de4018951906c1434420d65cdb33e48c23b6c22bc9fdd4c
SHA512ecb8fbb2826f7f47eed46897701d42873b17b7599cd785ca54e900b793e3de1179c4d6441f317aa5298ae52c1c11157ae43b11822aa0076b9ec93ad5e46f0225
-
Filesize
153KB
MD5a1b7850763af9593b66ee459a081bddf
SHA16e45955fae2b2494902a1b55a3873e542f0f5ce4
SHA25641b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af
SHA512a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1
-
Filesize
21KB
MD5a108f0030a2cda00405281014f897241
SHA1d112325fa45664272b08ef5e8ff8c85382ebb991
SHA2568b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
SHA512d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298
-
Filesize
5KB
MD56fbf86629f47eca07aaed1a95fc56777
SHA155fe7be7e600b74d5b67a66ce0d7c379c41bf550
SHA25632687c846ddb54be27dd5a4f2674ef4ce08b1d3cf8621301e36b319df28ecb26
SHA51289832543df122de7b0cb2cca77624e1f993b499f6d8bd514a2e86fae72867ae3e26f2c130cc216c9929d65ab7f55f93feafc549053f29157fcfd8061baf8cb84
-
Filesize
684B
MD5fd6e54369bb1479b9f37b80d26fe1b00
SHA18ed2ee83317a93c17028968b187803bfc5f65d24
SHA2563ba801fa9daf7cbdcf6f3ffa2dcc74ff340fdb65e344a5b78422a23b8fd9bd8e
SHA5120bd120cf5847ac51ce78aa1307d99bf3c7ee26df4dfe02708cbddea9b7a89bf1c78662277b36e8ff2f0bb18de3a7ec2732e6c054afaa329fbcbb5557ec19e4d7
-
Filesize
444B
MD5cd0d717f8a567dc2e343091013e0ff11
SHA1c230b550ad92352e9738afd6a91f4dcbff7b61ab
SHA256af1b2fd11c8d5333aa454c77685e963a6dee02d80666383d61db521c9362e0f3
SHA512825fb85d465cd834b5f98feb154ec9315dffe7da655723319e67b541e0c780c79a2d4563b6a01b17118afabbd4794d7a73d28f491eba78a5fa39d6b98f225df3
-
Filesize
20B
MD5db9af7503f195df96593ac42d5519075
SHA11b487531bad10f77750b8a50aca48593379e5f56
SHA2560a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
SHA5126839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
-
Filesize
92B
MD52891d54b321f58e1569376ebca72e826
SHA1b30a8b47cf07b0ff56735b43123dd128b5a02e99
SHA25681a7d68b8c25efb544d0bcfca92e9c2d3f98393132fecfe3a8c41337d93966dd
SHA512982134098d06593f527a3c20a31dbb7f471cd158c9ac80f7d972d7c28a90ffe1feaea025a58f3de103ba81c7f5d97f9004c3f90b99b59c753db0267303ad746c
-
Filesize
10B
MD5c7dea5b4aa8726d6e1856b151a3d5e61
SHA10e7d482333027b5381e94c945969bfb20aa8bcfc
SHA256444b6e841966e6306050fd2b2211e00dd877c4aa2b8971a3010d3e53d95ea7ee
SHA512dd3732dfdb5a56bd70aba7c298001280d76829928d8e1a9add03cfc55e26f24fb317d01b915578ac54ba920fe0e736d4ca04f82eb98e67e0bf773973dc20313d
-
Filesize
93B
MD59395ce94041387301999bcac536b0bde
SHA18150eafe6eb013ff9d887cbdfa6109804bf82830
SHA2563b3e0453d8a183b4145e1c7fb56f87a89c89900eee5c49a4a0f2bd0a028b9f55
SHA5126580a9f1000190b27a4d3bb85b371f28d7be7f2077b85f81be60c160fc16a54320a3ff05ab3247cd807a0d782a56e786c8ed1322dedd093ed923ac8ae2784781
-
Filesize
282B
MD539030ae352cc16a7fd0bf49261d97403
SHA1485f2944ead7b484a052c2f436ed950327bfc961
SHA25652703269ec26d1988de1efda21597a3faf563e980e1afc5434441ecd34d80ded
SHA5127c89c1263b693e0802379bfbbd785d354b0686f354abb2aa9f982b3c53dda316d7c584a3af0d4b3fc1a072c49986fa4b93a99b63d9dc2645f798ff8913a29a3d
-
Filesize
244KB
MD5c4ca339bc85aae8999e4b101556239dd
SHA1d090fc385e0002e35db276960a360c67c4fc85cd
SHA2564ab23609cdc64d10b97c9ccb285ed7100f55d54d983cd50762da25ecac4357f9
SHA5129185ec32545fc838d7fef6c9e4dd222dd02114c661b0b344f16287d55e6571bfe7a4233a852acc579d07bcdbab18c5c034c465b1f4bb78535ed51c3499087fe0