Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral2
Sample
a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe
Resource
win11-20240611-en
General
-
Target
a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe
-
Size
1.8MB
-
MD5
19a38385f077241168986482aca1745e
-
SHA1
72eebe027f024674814b165393af33b917a77e7e
-
SHA256
a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f
-
SHA512
0df2c4752effe858bae2edf474116ba517e7f03dcbc861b0f6da36b0e15f80e968012146d223bc03e1f269e830da381ad99153158c655992b0f49f3806ac33aa
-
SSDEEP
24576:x6/rcC6mfBhc/wRRcxFeUTLYf6/eJj95FUHMBzp0ey08kkaIwHh7VZwZD1ltmEOC:xMFMIqxF/WrRhzKS8kk6Hwr3uQYP
Malware Config
Extracted
amadey
8254624243
e76b71
http://77.91.77.81
-
install_dir
8254624243
-
install_file
axplong.exe
-
strings_key
90049e51fabf09df0d6748e0b271922e
-
url_paths
/Kiru9gu/index.php
Extracted
stealc
jopa
http://65.21.175.0
-
url_path
/108e010e8f91c38c.php
Extracted
redline
LiveTraffoc
4.185.56.82:42687
Extracted
redline
newlogs
85.28.47.7:17210
Extracted
stealc
ZOV
http://40.86.87.10
-
url_path
/108e010e8f91c38c.php
Extracted
redline
newbuild
185.215.113.67:40960
Extracted
redline
@LOGSCLOUDYT_BOT
185.172.128.33:8970
Extracted
raccoon
1a5d06870a6b84740b2c11dce573e9a0
http://95.169.205.186:80/
-
user_agent
MrBidenNeverKnow
Extracted
lumma
https://stationacutwo.shop/api
Signatures
-
Detect Vidar Stealer 1 IoCs
resource yara_rule behavioral1/memory/1460-474-0x00000000010A0000-0x00000000010DA000-memory.dmp family_vidar_v7 -
Detects Monster Stealer. 2 IoCs
resource yara_rule behavioral1/files/0x00090000000234db-359.dat family_monster behavioral1/memory/3516-548-0x00007FF60D760000-0x00007FF60E99E000-memory.dmp family_monster -
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Raccoon Stealer V2 payload 4 IoCs
resource yara_rule behavioral1/memory/2804-534-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2804-538-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2804-536-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/5368-643-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 8 IoCs
resource yara_rule behavioral1/memory/3384-99-0x0000000000400000-0x0000000000450000-memory.dmp family_redline behavioral1/files/0x00070000000234b3-112.dat family_redline behavioral1/memory/1668-126-0x0000000000330000-0x0000000000380000-memory.dmp family_redline behavioral1/files/0x00090000000234b1-147.dat family_redline behavioral1/memory/4048-161-0x00000000002B0000-0x0000000000300000-memory.dmp family_redline behavioral1/files/0x00090000000234c7-227.dat family_redline behavioral1/memory/2376-234-0x0000000000400000-0x00000000004E4000-memory.dmp family_redline behavioral1/memory/2360-235-0x0000000000360000-0x00000000003B2000-memory.dmp family_redline -
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 536 netsh.exe 4000 netsh.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation Bitwarden-Installer-2024.exe Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation surfshark.exe Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation ix4A2DreBBsQwY6YHkidcDjo.exe Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation axplong.exe Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation Freshbuild.exe Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation Hkbsse.exe -
Executes dropped EXE 29 IoCs
pid Process 1408 axplong.exe 3040 streamer.exe 836 TpWWMUpe0LEV.exe 3372 crypt6.exe 1668 newlogs.exe 4804 stealc_zov.exe 4048 newbuild.exe 2364 Freshbuild.exe 3404 Hkbsse.exe 4548 leg222.exe 768 fWBwyZTaGu.exe 2360 6a99WN8liR.exe 2820 1.exe 1460 Bitwarden-Installer-2024.exe 4732 build1555.exe 3516 stub.exe 3840 surfshark.exe 2216 Raccoon_crypted.exe 3456 Hkbsse.exe 768 axplong.exe 2132 plunge.exe 5484 Hkbsse.exe 5348 axplong.exe 3748 plunge.exe 3572 FRaqbC8wSA1XvpFVjCRGryWt.exe 956 IIZS2TRqf69aZbLAX3cf3edn.exe 1304 HM3SOlbpH71yEXUIEAOeIiGX.exe 5456 ix4A2DreBBsQwY6YHkidcDjo.exe 3936 mswabnet.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Wine a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe Key opened \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Wine axplong.exe -
Loads dropped DLL 34 IoCs
pid Process 836 TpWWMUpe0LEV.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe 3516 stub.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0008000000023510-458.dat upx behavioral1/memory/2216-470-0x00007FF649650000-0x00007FF649920000-memory.dmp upx behavioral1/memory/2216-539-0x00007FF649650000-0x00007FF649920000-memory.dmp upx behavioral1/memory/3572-618-0x00007FF65EA70000-0x00007FF65ED40000-memory.dmp upx behavioral1/memory/956-622-0x00007FF647340000-0x00007FF647610000-memory.dmp upx behavioral1/memory/1304-625-0x00007FF6C5700000-0x00007FF6C59D0000-memory.dmp upx behavioral1/memory/956-644-0x00007FF647340000-0x00007FF647610000-memory.dmp upx behavioral1/memory/3572-647-0x00007FF65EA70000-0x00007FF65ED40000-memory.dmp upx behavioral1/memory/1304-656-0x00007FF6C5700000-0x00007FF6C59D0000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Network Agent = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Network Agent\\mswabnet.exe\"" ix4A2DreBBsQwY6YHkidcDjo.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 65 raw.githubusercontent.com 8 bitbucket.org 9 bitbucket.org 64 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 62 ip-api.com -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 4332 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 4376 a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe 1408 axplong.exe 768 axplong.exe 5348 axplong.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 836 set thread context of 5076 836 TpWWMUpe0LEV.exe 88 PID 3372 set thread context of 3384 3372 crypt6.exe 91 PID 4548 set thread context of 2376 4548 leg222.exe 104 PID 3040 set thread context of 4980 3040 streamer.exe 110 PID 2216 set thread context of 2804 2216 Raccoon_crypted.exe 198 PID 956 set thread context of 5368 956 IIZS2TRqf69aZbLAX3cf3edn.exe 228 PID 3572 set thread context of 4792 3572 FRaqbC8wSA1XvpFVjCRGryWt.exe 229 PID 1304 set thread context of 1488 1304 HM3SOlbpH71yEXUIEAOeIiGX.exe 230 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\axplong.job a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe File created C:\Windows\Tasks\Hkbsse.job Freshbuild.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 624 sc.exe -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral1/files/0x00070000000234ff-377.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Program crash 4 IoCs
pid pid_target Process procid_target 4944 3372 WerFault.exe 89 3636 4548 WerFault.exe 101 3668 2820 WerFault.exe 112 3460 5076 WerFault.exe 88 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Bitwarden-Installer-2024.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Bitwarden-Installer-2024.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 aspnet_regiis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString aspnet_regiis.exe -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 1656 WMIC.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4192 timeout.exe -
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 4524 tasklist.exe 536 tasklist.exe 4556 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1656 ipconfig.exe 2996 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4576 systeminfo.exe -
Kills process with taskkill 1 IoCs
pid Process 1380 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 6a99WN8liR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 6a99WN8liR.exe -
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4576 schtasks.exe 5736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4376 a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe 4376 a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe 1408 axplong.exe 1408 axplong.exe 3384 RegAsm.exe 3384 RegAsm.exe 3384 RegAsm.exe 3384 RegAsm.exe 4980 BitLockerToGo.exe 4980 BitLockerToGo.exe 4980 BitLockerToGo.exe 4980 BitLockerToGo.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 3384 RegAsm.exe 3624 powershell.exe 3624 powershell.exe 1460 Bitwarden-Installer-2024.exe 1460 Bitwarden-Installer-2024.exe 768 axplong.exe 768 axplong.exe 3624 powershell.exe 4048 newbuild.exe 4048 newbuild.exe 1488 msedge.exe 1488 msedge.exe 32 msedge.exe 32 msedge.exe 1460 Bitwarden-Installer-2024.exe 1460 Bitwarden-Installer-2024.exe 1460 Bitwarden-Installer-2024.exe 1460 Bitwarden-Installer-2024.exe 5332 identity_helper.exe 5332 identity_helper.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 4048 newbuild.exe 1460 Bitwarden-Installer-2024.exe 1460 Bitwarden-Installer-2024.exe 2360 6a99WN8liR.exe 2360 6a99WN8liR.exe 2360 6a99WN8liR.exe 2360 6a99WN8liR.exe 2360 6a99WN8liR.exe 2360 6a99WN8liR.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 768 fWBwyZTaGu.exe Token: SeBackupPrivilege 768 fWBwyZTaGu.exe Token: SeSecurityPrivilege 768 fWBwyZTaGu.exe Token: SeSecurityPrivilege 768 fWBwyZTaGu.exe Token: SeSecurityPrivilege 768 fWBwyZTaGu.exe Token: SeSecurityPrivilege 768 fWBwyZTaGu.exe Token: SeDebugPrivilege 3384 RegAsm.exe Token: SeIncreaseQuotaPrivilege 3728 WMIC.exe Token: SeSecurityPrivilege 3728 WMIC.exe Token: SeTakeOwnershipPrivilege 3728 WMIC.exe Token: SeLoadDriverPrivilege 3728 WMIC.exe Token: SeSystemProfilePrivilege 3728 WMIC.exe Token: SeSystemtimePrivilege 3728 WMIC.exe Token: SeProfSingleProcessPrivilege 3728 WMIC.exe Token: SeIncBasePriorityPrivilege 3728 WMIC.exe Token: SeCreatePagefilePrivilege 3728 WMIC.exe Token: SeBackupPrivilege 3728 WMIC.exe Token: SeRestorePrivilege 3728 WMIC.exe Token: SeShutdownPrivilege 3728 WMIC.exe Token: SeDebugPrivilege 3728 WMIC.exe Token: SeSystemEnvironmentPrivilege 3728 WMIC.exe Token: SeRemoteShutdownPrivilege 3728 WMIC.exe Token: SeUndockPrivilege 3728 WMIC.exe Token: SeManageVolumePrivilege 3728 WMIC.exe Token: 33 3728 WMIC.exe Token: 34 3728 WMIC.exe Token: 35 3728 WMIC.exe Token: 36 3728 WMIC.exe Token: SeDebugPrivilege 4556 tasklist.exe Token: SeIncreaseQuotaPrivilege 3728 WMIC.exe Token: SeSecurityPrivilege 3728 WMIC.exe Token: SeTakeOwnershipPrivilege 3728 WMIC.exe Token: SeLoadDriverPrivilege 3728 WMIC.exe Token: SeSystemProfilePrivilege 3728 WMIC.exe Token: SeSystemtimePrivilege 3728 WMIC.exe Token: SeProfSingleProcessPrivilege 3728 WMIC.exe Token: SeIncBasePriorityPrivilege 3728 WMIC.exe Token: SeCreatePagefilePrivilege 3728 WMIC.exe Token: SeBackupPrivilege 3728 WMIC.exe Token: SeRestorePrivilege 3728 WMIC.exe Token: SeShutdownPrivilege 3728 WMIC.exe Token: SeDebugPrivilege 3728 WMIC.exe Token: SeSystemEnvironmentPrivilege 3728 WMIC.exe Token: SeRemoteShutdownPrivilege 3728 WMIC.exe Token: SeUndockPrivilege 3728 WMIC.exe Token: SeManageVolumePrivilege 3728 WMIC.exe Token: 33 3728 WMIC.exe Token: 34 3728 WMIC.exe Token: 35 3728 WMIC.exe Token: 36 3728 WMIC.exe Token: SeDebugPrivilege 1380 taskkill.exe Token: SeDebugPrivilege 4524 tasklist.exe Token: SeDebugPrivilege 3624 powershell.exe Token: SeDebugPrivilege 4048 newbuild.exe Token: SeIncreaseQuotaPrivilege 1656 WMIC.exe Token: SeSecurityPrivilege 1656 WMIC.exe Token: SeTakeOwnershipPrivilege 1656 WMIC.exe Token: SeLoadDriverPrivilege 1656 WMIC.exe Token: SeSystemProfilePrivilege 1656 WMIC.exe Token: SeSystemtimePrivilege 1656 WMIC.exe Token: SeProfSingleProcessPrivilege 1656 WMIC.exe Token: SeIncBasePriorityPrivilege 1656 WMIC.exe Token: SeCreatePagefilePrivilege 1656 WMIC.exe Token: SeBackupPrivilege 1656 WMIC.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4376 a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe 32 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 1408 4376 a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe 84 PID 4376 wrote to memory of 1408 4376 a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe 84 PID 4376 wrote to memory of 1408 4376 a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe 84 PID 1408 wrote to memory of 3040 1408 axplong.exe 85 PID 1408 wrote to memory of 3040 1408 axplong.exe 85 PID 1408 wrote to memory of 836 1408 axplong.exe 86 PID 1408 wrote to memory of 836 1408 axplong.exe 86 PID 1408 wrote to memory of 836 1408 axplong.exe 86 PID 836 wrote to memory of 5076 836 TpWWMUpe0LEV.exe 88 PID 836 wrote to memory of 5076 836 TpWWMUpe0LEV.exe 88 PID 836 wrote to memory of 5076 836 TpWWMUpe0LEV.exe 88 PID 836 wrote to memory of 5076 836 TpWWMUpe0LEV.exe 88 PID 836 wrote to memory of 5076 836 TpWWMUpe0LEV.exe 88 PID 836 wrote to memory of 5076 836 TpWWMUpe0LEV.exe 88 PID 836 wrote to memory of 5076 836 TpWWMUpe0LEV.exe 88 PID 836 wrote to memory of 5076 836 TpWWMUpe0LEV.exe 88 PID 836 wrote to memory of 5076 836 TpWWMUpe0LEV.exe 88 PID 1408 wrote to memory of 3372 1408 axplong.exe 89 PID 1408 wrote to memory of 3372 1408 axplong.exe 89 PID 1408 wrote to memory of 3372 1408 axplong.exe 89 PID 3372 wrote to memory of 3384 3372 crypt6.exe 91 PID 3372 wrote to memory of 3384 3372 crypt6.exe 91 PID 3372 wrote to memory of 3384 3372 crypt6.exe 91 PID 3372 wrote to memory of 3384 3372 crypt6.exe 91 PID 3372 wrote to memory of 3384 3372 crypt6.exe 91 PID 3372 wrote to memory of 3384 3372 crypt6.exe 91 PID 3372 wrote to memory of 3384 3372 crypt6.exe 91 PID 3372 wrote to memory of 3384 3372 crypt6.exe 91 PID 1408 wrote to memory of 1668 1408 axplong.exe 95 PID 1408 wrote to memory of 1668 1408 axplong.exe 95 PID 1408 wrote to memory of 1668 1408 axplong.exe 95 PID 1408 wrote to memory of 4804 1408 axplong.exe 96 PID 1408 wrote to memory of 4804 1408 axplong.exe 96 PID 1408 wrote to memory of 4804 1408 axplong.exe 96 PID 1408 wrote to memory of 4048 1408 axplong.exe 97 PID 1408 wrote to memory of 4048 1408 axplong.exe 97 PID 1408 wrote to memory of 4048 1408 axplong.exe 97 PID 1408 wrote to memory of 2364 1408 axplong.exe 98 PID 1408 wrote to memory of 2364 1408 axplong.exe 98 PID 1408 wrote to memory of 2364 1408 axplong.exe 98 PID 2364 wrote to memory of 3404 2364 Freshbuild.exe 99 PID 2364 wrote to memory of 3404 2364 Freshbuild.exe 99 PID 2364 wrote to memory of 3404 2364 Freshbuild.exe 99 PID 1408 wrote to memory of 4548 1408 axplong.exe 101 PID 1408 wrote to memory of 4548 1408 axplong.exe 101 PID 1408 wrote to memory of 4548 1408 axplong.exe 101 PID 4548 wrote to memory of 3896 4548 leg222.exe 102 PID 4548 wrote to memory of 3896 4548 leg222.exe 102 PID 4548 wrote to memory of 3896 4548 leg222.exe 102 PID 4548 wrote to memory of 4524 4548 leg222.exe 103 PID 4548 wrote to memory of 4524 4548 leg222.exe 103 PID 4548 wrote to memory of 4524 4548 leg222.exe 103 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 4548 wrote to memory of 2376 4548 leg222.exe 104 PID 2376 wrote to memory of 768 2376 RegAsm.exe 107 PID 2376 wrote to memory of 768 2376 RegAsm.exe 107 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4944 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe"C:\Users\Admin\AppData\Local\Temp\a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\1000111001\streamer.exe"C:\Users\Admin\AppData\Local\Temp\1000111001\streamer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3040 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4980
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe"C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"4⤵
- Checks processor information in registry
PID:5076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 12125⤵
- Program crash
PID:3460
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000128001\crypt6.exe"C:\Users\Admin\AppData\Local\Temp\1000128001\crypt6.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 3004⤵
- Program crash
PID:4944
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000130001\newlogs.exe"C:\Users\Admin\AppData\Local\Temp\1000130001\newlogs.exe"3⤵
- Executes dropped EXE
PID:1668
-
-
C:\Users\Admin\AppData\Local\Temp\1000131001\stealc_zov.exe"C:\Users\Admin\AppData\Local\Temp\1000131001\stealc_zov.exe"3⤵
- Executes dropped EXE
PID:4804
-
-
C:\Users\Admin\AppData\Local\Temp\1000132001\newbuild.exe"C:\Users\Admin\AppData\Local\Temp\1000132001\newbuild.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.co/1lLub4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:32 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d48b46f8,0x7ff9d48b4708,0x7ff9d48b47185⤵PID:3400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:25⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:85⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:15⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:15⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:85⤵PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:5332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:15⤵PID:5348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:15⤵PID:5356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:15⤵PID:5756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9089996851872295908,7025978727985801643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:15⤵PID:5764
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000153001\Freshbuild.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\Freshbuild.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\1000037001\1.exe"C:\Users\Admin\AppData\Local\Temp\1000037001\1.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 4646⤵
- Program crash
PID:3668
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000038001\Bitwarden-Installer-2024.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\Bitwarden-Installer-2024.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1460 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KEHDBAEGIIIE" & exit6⤵PID:6128
-
C:\Windows\SysWOW64\timeout.exetimeout /t 107⤵
- Delays execution with timeout.exe
PID:4192
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000160001\leg222.exe"C:\Users\Admin\AppData\Local\Temp\1000160001\leg222.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:3896
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:4524
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Roaming\fWBwyZTaGu.exe"C:\Users\Admin\AppData\Roaming\fWBwyZTaGu.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
C:\Users\Admin\AppData\Roaming\6a99WN8liR.exe"C:\Users\Admin\AppData\Roaming\6a99WN8liR.exe"5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2360
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 3004⤵
- Program crash
PID:3636
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000161001\build1555.exe"C:\Users\Admin\AppData\Local\Temp\1000161001\build1555.exe"3⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\onefile_4732_133645966756094666\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000161001\build1555.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3516 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵PID:1768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:4144
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵PID:768
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""5⤵
- Hide Artifacts: Hidden Files and Directories
PID:4332 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"6⤵
- Views/modifies file attributes
PID:4944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""5⤵PID:2932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"5⤵PID:1420
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:4140
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"5⤵PID:428
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"5⤵PID:5012
-
C:\Windows\system32\chcp.comchcp6⤵PID:3896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"5⤵PID:3088
-
C:\Windows\system32\chcp.comchcp6⤵PID:3272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"5⤵PID:2960
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"5⤵PID:3820
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:4576
-
-
C:\Windows\system32\HOSTNAME.EXEhostname6⤵PID:4328
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername6⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Windows\system32\net.exenet user6⤵PID:4496
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user7⤵PID:4000
-
-
-
C:\Windows\system32\query.exequery user6⤵PID:3372
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"7⤵PID:2984
-
-
-
C:\Windows\system32\net.exenet localgroup6⤵PID:4496
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup7⤵PID:1116
-
-
-
C:\Windows\system32\net.exenet localgroup administrators6⤵PID:4440
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators7⤵PID:4464
-
-
-
C:\Windows\system32\net.exenet user guest6⤵PID:1808
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest7⤵PID:4996
-
-
-
C:\Windows\system32\net.exenet user administrator6⤵PID:2996
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator7⤵PID:1344
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command6⤵PID:3372
-
-
C:\Windows\system32\tasklist.exetasklist /svc6⤵
- Enumerates processes with tasklist
PID:536
-
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:1656
-
-
C:\Windows\system32\ROUTE.EXEroute print6⤵PID:4996
-
-
C:\Windows\system32\ARP.EXEarp -a6⤵PID:2788
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano6⤵
- Gathers network information
PID:2996
-
-
C:\Windows\system32\sc.exesc query type= service state= all6⤵
- Launches sc.exe
PID:624
-
-
C:\Windows\system32\netsh.exenetsh firewall show state6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4000
-
-
C:\Windows\system32\netsh.exenetsh firewall show config6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:3960
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4440
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵PID:4496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:1344
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵PID:2468
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000169001\surfshark.exe"C:\Users\Admin\AppData\Local\Temp\1000169001\surfshark.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
PID:3840 -
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN plunge.exe /TR "C:\ProgramData\F01FF211\plunge.exe" /F4⤵
- Scheduled Task/Job: Scheduled Task
PID:4576
-
-
C:\ProgramData\F01FF211\plunge.exe"C:\ProgramData\F01FF211\plunge.exe"4⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN plunge.exe /TR "C:\ProgramData\F01FF211\plunge.exe" /F5⤵
- Scheduled Task/Job: Scheduled Task
PID:5736
-
-
C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3572 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"6⤵PID:4792
-
-
-
C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe"C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"6⤵PID:5368
-
-
-
C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe"C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1304 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"6⤵PID:1488
-
-
-
C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe"C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:5456 -
C:\Users\Admin\AppData\Roaming\Microsoft Network Agent\mswabnet.exe"C:\Users\Admin\AppData\Roaming\Microsoft Network Agent\mswabnet.exe"6⤵
- Executes dropped EXE
PID:3936
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000170001\Raccoon_crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000170001\Raccoon_crypted.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"4⤵PID:4144
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"4⤵PID:2804
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3372 -ip 33721⤵PID:4192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4548 -ip 45481⤵PID:4164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2820 -ip 28201⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe1⤵
- Executes dropped EXE
PID:3456
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:768
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2132
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe1⤵
- Executes dropped EXE
PID:5484
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5348
-
C:\ProgramData\F01FF211\plunge.exeC:\ProgramData\F01FF211\plunge.exe1⤵
- Executes dropped EXE
PID:3748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5076 -ip 50761⤵PID:3900
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5770945b05b64b4fd7399f06797970dfd
SHA143620aa3423833789a92846298e3e7690e21b4b6
SHA25622fd687d2da21d880c72bd1da301ea0f4bf271debaee2bcd87523fb263ea2d56
SHA512e7512919c732313f3a8d803dea5bca4779a8eb17b5eceecb0c6f1ad8397c550e6aaecc572607a8f6598b447d8e69f61419228e1813850f36f429d47a081dfa41
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
152KB
MD573bd1e15afb04648c24593e8ba13e983
SHA14dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
SHA256aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
SHA5126eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7
-
Filesize
152B
MD509c7ae658385f6de986103443217840b
SHA1298d880503edce4413337c09d3525f27a2edcd28
SHA25691e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7
SHA5124e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3
-
Filesize
152B
MD53c78617ec8f88da19254f9ff03312175
SHA1344e9fed9434d924d1c9f05351259cbc21e434d3
SHA2563cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed
SHA5125b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c
-
Filesize
6KB
MD5fc965559c6780d9c34cb3332b94bb51b
SHA1ae0ca11c9ed03a185b9ca14dd5b04fed4fff2dbb
SHA2569e590409c6fd0f3460dfac237af08275ef3d21e22fa3a89ce5e95be1a9e39c69
SHA51267877ec555e2c8ec9d4382301785634280a08b0caff0abd4ec4a943e1eb1fa65c7050455dbe0df1aaae27ab487c1e4f096d04196025c6cca48c5018e53b1b3d7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
186KB
MD5c63340e76d3547eca876360b73dd55ad
SHA18d041473de8f378930946a5457f25598d49d5bba
SHA25641e23f002c97d898b7b0de6765ae89e6a76b28689cb335d29f8edd12c697a2d1
SHA51230ee349336c0a8ce0254f7a6639664b3c328a85c4b09c45603e5ad3b9707c5ae93a10d355f8329def5323a878a3e1a8e50178447907a379787864be5493909d8
-
Filesize
4.9MB
MD506e9439beabd1813ff13295adbba48ff
SHA1f70c1c806fcb2fbbd97d4c9ecf7c473b3dc957da
SHA25647eb2e1f94933fc6da9cf436804c0a303c539de3ce93c7dfaa6b427625447a22
SHA5123143051b25bce1e2a80dc11006398309d09308ae6542e0e20c1c3e95947ea798d176ea75c8a53265846a902b2d0f9e81dc315e1343ec7d5b7fd4e16d77d7d118
-
Filesize
4.9MB
MD52502f2fb88c1ea569c0b4287ae0613f3
SHA1aae526d8ce17f59366b57d5d00ab5d14140cd6b5
SHA2566c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513
SHA5127c0e3a6f8322aafa90533bcd2ff5ab2b167ef7c1c8412710c4b3a3b4643cdb0412cf93c561ce1c01a1057643bda336fd3fa64e3a7373d41cc25319d5190ca2d2
-
Filesize
1.2MB
MD5242214131486132e33ceda794d66ca1f
SHA14ce34fd91f5c9e35b8694007b286635663ef9bf2
SHA256bac402b5749b2da2211db6d2404c1c621ccd0c2e5d492eb6f973b3e2d38dd361
SHA512031e0904d949cec515f2d6f2b5e4b9c0df03637787ff14f20c58e711c54eec77d1f22aa0cf0f6efd65362c1fc0066645d5d005c6a77fe5b169427cdd42555d29
-
Filesize
512KB
MD5a957dc16d684fbd7e12fc87e8ee12fea
SHA120c73ccfdba13fd9b79c9e02432be39e48e4b37d
SHA256071b6c448d2546dea8caed872fca0d002f59a6b9849f0de2a565fc74b487fa37
SHA512fd6982587fba779d6febb84dfa65ec3e048e17733c2f01b61996bedb170bb4bb1cbb822c0dd2cf44a7e601373abaf499885b13b7957dd2a307bbd8f2120e9b3b
-
Filesize
297KB
MD50970456d2e2bcb36f49d23f5f2eec4ce
SHA11e427bbeb209b636371d17801b14fabff87921be
SHA256264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54
SHA51243c233e6c6fb20ee5830672f68eec2a1930aff6c3da185b7af56ede90970041157755b8893a86336711c8ba8cbe3f22818de8ddc1789ed65a7aacd596771909e
-
Filesize
158KB
MD5253ccac8a47b80287f651987c0c779ea
SHA111db405849dbaa9b3759de921835df20fab35bc3
SHA256262a400b339deea5089433709ce559d23253e23d23c07595b515755114147e2f
SHA512af40e01bc3d36baf47eba1d5d6406220dfbcc52c6123dd8450e709fed3e72bed82aac6257fa7bdf7dd774f182919a5051e9712b2e7f1329defd0b159cb08385d
-
Filesize
297KB
MD59ab4de8b2f2b99f009d32aa790cd091b
SHA1a86b16ee4676850bac14c50ee698a39454d0231e
SHA2568a254344702dc6560312a8028e08f844b16804b1fbf4c438c3ca5058d7b65ea1
SHA512a79341ec3407529daa0384de4cac25b665d3b0cb81e52ecada0ebfe37d7616b16da96b47b04f50ce0a6e46d5fced3298a459f78a087c6b6eac4ed444434c5fbe
-
Filesize
415KB
MD507101cac5b9477ba636cd8ca7b9932cb
SHA159ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1
SHA256488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
SHA51202240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887
-
Filesize
1.1MB
MD55486fd5b8200f34b23f23a21f8912ade
SHA1379f7b095751116c9a6c56d0945ca12ae122d253
SHA2561ecf603a32b23fdf06e0260f314f5390e9c062d74fa2fe65b05754e83c41df46
SHA512e9ad33509efc7303b09a9633f9f6136bba807deca3b9032a91475a66c038b4a1df44e036d9f7acae63f1854df65d47c00c59e6e3d79e7c44a5a6ae631c512f3f
-
Filesize
10.7MB
MD56b1eb54b0153066ddbe5595a58e40536
SHA1adf81c3104e5d62853fa82c2bd9b0a5becb4589a
SHA256d39627a497bf5f7e89642ef14bb0134193bc12ad18a2eadddf305c4f8d69b0b8
SHA512104faaa4085c9173274d4e0e468eaf75fb22c4cfe38226e4594e6aa0a1dcb148bde7e5e0756b664f14b680872d2476340ebd69fac883d8e99b20acfb5f5dbf04
-
Filesize
1.1MB
MD58569ef968c0c4045782e1ef4ecc96fec
SHA16f59472c780116468aa2953f8286c89c3188457e
SHA2561c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334
SHA5124c9be25acce42fd404ad213cacc823d927e7c3249613771c1644a9054ff49e3edc0f4695240d067af49baf049546a2014fbe7966a37950c6d68d9f5c740e8af9
-
Filesize
1.0MB
MD518b80be4ccf569476db98955ad019621
SHA12c160dc5cd238d9d7f0ca4b4a6419eacb4d6a76b
SHA256df4be4cd1353fcc4da27d21950f9080647884f8985cac8a5c54cc8f5fd2a843c
SHA51259565a2a19b8530dd15ac855d361ff7da9e534511787ee296f2e33aad87ebd3141b6e3e0bdd10a34482c0f60bfd644dc5ac11913650998ad6ab84c8f5b2a179f
-
Filesize
1.8MB
MD519a38385f077241168986482aca1745e
SHA172eebe027f024674814b165393af33b917a77e7e
SHA256a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f
SHA5120df2c4752effe858bae2edf474116ba517e7f03dcbc861b0f6da36b0e15f80e968012146d223bc03e1f269e830da381ad99153158c655992b0f49f3806ac33aa
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
95KB
MD57f61eacbbba2ecf6bf4acf498fa52ce1
SHA13174913f971d031929c310b5e51872597d613606
SHA25685de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
-
Filesize
6.9MB
MD5f918173fbdc6e75c93f64784f2c17050
SHA1163ef51d4338b01c3bc03d6729f8e90ae39d8f04
SHA2562c7a31dec06df4eec6b068a0b4b009c8f52ef34ace785c8b584408cb29ce28fd
SHA5125405d5995e97805e68e91e1f191dc5e7910a7f2ba31619eb64aff54877cbd1b3fa08b7a24b411d095edb21877956976777409d3db58d29da32219bf578ce4ef2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
177KB
MD5ebb660902937073ec9695ce08900b13d
SHA1881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA25652e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA51219d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
Filesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
1.4MB
MD5926dc90bd9faf4efe1700564aa2a1700
SHA1763e5af4be07444395c2ab11550c70ee59284e6d
SHA25650825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
-
Filesize
18.0MB
MD5f0587004f479243c18d0ccff0665d7f6
SHA1b3014badadfffdd6be2931a77a9df4673750fee7
SHA2568ce148c264ce50e64ab866e34759de81b816a3f54b21c3426513bed3f239649a
SHA5126dedaa729ee93520907ce46054f0573fb887ac0890bea9d1d22382e9d05f8c14a8c151fe2061a0ec1dae791b13752e0fbc00ccc85838caa7524edba35d469434
-
Filesize
304KB
MD515a7cae61788e4718d3c33abb7be6436
SHA162dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f
SHA256bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200
SHA5125b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45
-
Filesize
1.4MB
MD5fe3f1a17359c69cbdd0572a86e7f1f04
SHA1f81d2d798a8b92d8313d60d1536fa6b59b0634d2
SHA25628681dc720f47253cdc952621192d3753c8daf5a2c01803c4ab1560f449d500a
SHA512d26db6aecc04a1c43cfb97cb96f570d309b7b678453df449be7b97836beb5167ca57463f6a7de2e489ee5e3dbccb10f986247d620e2c434b5d212da01981901e
-
Filesize
279KB
MD58fa26f1e37d3ff7f736fc93d520bc8ab
SHA1ad532e1cb4a1b3cd82c7a85647f8f6dd99833bb1
SHA2566c47da8fbd12f22d7272fbf223e054bf5093c0922d0e8fb7d6289a5913c2e45d
SHA5128a0b53cbc3a20e2f0fd41c486b1af1fbbcf7f2fed9f7368b672a07f25faaa2568bbdbcf0841233ac8c473a4d1dee099e90bf6098a6fa15e44b8526efdafc1287
-
Filesize
381KB
MD51b75671fb234ae1fb72406a317fa752a
SHA1bd47c38b7fb55d013b85c60cd51c8c5ee56f3757
SHA256499d5830b76daff19e04393ba05f63baa893f8d86ae358fc59365a5938177cbe
SHA5124c96d2c40862f73314394f48bc9c0930d5c51bfaa389185518c84ac921ceafab0f296df48655a9640d4232265daf67f3b0f4b886bfd31d230e8ec9ed11bbc2f5